ESA-2013-079: RSA Archer® GRC Multiple Cross-Site Scripting Vulnerabilities

ESA-2013-079.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-079: RSA Archer® GRC Multiple Cross-Site Scripting Vulnerabilities EMC Identifier: ESA-2013-079 CVE Identifier: CVE-2013-6178 Severity Rating: CVSS v2 Base Score: 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P Affected Products: RSA Archer...

CVE-2013-6178

Multiple cross-site scripting XSS vulnerabilities in EMC RSA Archer GRC 5.x before 5.4 SP1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-6178

RSA Archer GRC 5.x is affected by multiple cross-site scripting (XSS) vulnerabilities (CVE-2013-6178). The issue lies in RSA Archer GRC 5.x before 5.4 SP1; exploitation could allow attackers to execute arbitrary HTML/Script in a user session. RSA advises upgrading to RSA Archer GRC 5.4 P2 or 5.4 ...

RSA Archer GRC security vulnerabilities

Invalid login restrictions, open redirect...

ESA-2013-057: RSA Archer(r) GRC Multiple Vulnerabilities

ESA-2013-057.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-057: RSA Archer® GRC Multiple Vulnerabilities EMC Identifier: ESA-2013-057 CVE Identifier: CVE-2013-3276, CVE-2013-3277 Severity Rating: CVSS v2 Base Score: See below for individual scores Affected Products: RSA Archer versio...

CVE-2013-3276

EMC RSA Archer GRC 5.x before 5.4 allows remote authenticated users to bypass intended access restrictions and complete a login by leveraging a deactivated account...

CVE-2013-3277

Open redirect vulnerability in EMC RSA Archer GRC 5.x before 5.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

Design/Logic Flaw

EMC RSA Archer GRC 5.x before 5.4 allows remote authenticated users to bypass intended access restrictions and complete a login by leveraging a deactivated account...

CVE-2013-3276

EMC RSA Archer GRC 5.x before 5.4 allows remote authenticated users to bypass intended access restrictions and complete a login by leveraging a deactivated account...

CVE-2013-3276

RSA Archer GRC 5.x before 5.4 is affected by CVE-2013-3276: an improper restriction of user login allows remote authenticated users to bypass login by leveraging a deactivated account. The vulnerability (CVSSv2 base score 6.0) impacts authentication, with partial confidentiality, integrity, and a...

CVE-2013-3277

Open redirect vulnerability in EMC RSA Archer GRC 5.x before 5.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2013-3277

RSA Archer GRC 5.x (pre-5.4) contains an open redirect vulnerability (CVE-2013-3277) that could enable phishing by redirecting users to arbitrary sites. The issue affects EMC RSA Archer GRC platform versions prior to 5.4; downgrade is not indicated. The public advisory ESA-2013-057 notes this vul...

Design/Logic Flaw

EMC RSA Archer 5.x before GRC 5.3SP1, and Archer Smart Suite Framework 4.x, allows remote authenticated users to bypass intended access restrictions and upload arbitrary files via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in EMC RSA Archer 5.x before GRC 5.3SP1, and Archer Smart Suite Framework 4.x, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-0932

CVE-2013-0932 affects EMC RSA Archer GRC 5.x (before 5.3SP1) and Archer Smart Suite Framework 4.x. It allows remote authenticated users to bypass access controls and upload arbitrary files via unspecified vectors, enabling potential compromise of the Archer platform. RSA ESA-2013-015 documents th...

CVE-2013-0934

CVE-2013-0934 affects EMC RSA Archer GRC 5.x (before 5.3SP1) and Archer Smart Suite Framework 4.x. The root cause is improper authorization that can let remote authenticated users bypass access restrictions and modify global reports via unspecified vectors. Impact is unauthorized modification of ...

CVE-2013-0933

CVE-2013-0933 involves multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Archer 5.x (before GRC 5.3SP1) and Archer Smart Suite Framework 4.x. The underlying issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Connected advisories (ESA-2013-01...

ESA-2013-015: RSA Archer® GRC Multiple Vulnerabilities

ESA-2013-015.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-015: RSA Archer® GRC Multiple Vulnerabilities EMC Identifier: ESA-2013-015 CVE Identifier: CVE-2013-0932, CVE-2013-0933, CVE-2013-0934 Severity Rating: CVSS v2 Base Score: See below for individual scores Affected Products: RS...

RSA Archer GRC multiple security vulnerabilities

Directory traversal, clickjacking, crossite access, crossite scripting...

ESA-2013-002: RSA Archer® GRC Multiple Vulnerabilities

ESA-2013-002.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-002: RSA Archer® GRC Multiple Vulnerabilities EMC Identifier: ESA-2013-002 CVE Identifier: CVE-2012-2293, CVE-2012-2292, CVE-2012-1064, CVE-2012-2294 Severity Rating: See below for scores for individual issues Affected...