Micro Focus NetIQ eDirectory PKI Plugin Design Vulnerability

Micro Focus NetIQ eDirectory is an identity management infrastructure platform that combines identity management architecture and directory services technology from Micro Focus, UK. The platform provides authentication policies, data backup and recovery services, data disaster recovery, etc. PKI...

Micro Focus Novell Access Manager iManager Cross-Site Scripting Vulnerability

Micro Focus Novell Access Manager is a comprehensive Web access management solution from Micro Focus UK. iManager is one of the Web-based applications that can manage and configure eDirectory objects using wireless devices. A cross-site scripting vulnerability exists in Micro Focus Novell Access...

NetIQ iManager Authentication Vulnerability

NetIQ iManager is a WEB-based application from American NetIQ. You can use wireless devices to manage and configure eDirectory objects. A security vulnerability exists in NetIQ iManager versions prior to 3.0.3 that originates when the program sends an SSL private key from a Java application to...

Cross site scripting

Multiple cross site scripting attacks were found in the Identity Manager Plug-in, hosted on iManager 2.7.7.7, before Identity Manager 4.6.1. In certain scenarios it was possible to execute arbitrary JavaScript code in the context of vulnerable application, via user.Context in the Object Selector,...

CVE-2017-7427

Multiple cross site scripting attacks were found in the Identity Manager Plug-in, hosted on iManager 2.7.7.7, before Identity Manager 4.6.1. In certain scenarios it was possible to execute arbitrary JavaScript code in the context of vulnerable application, via user.Context in the Object Selector,...

CVE-2017-7427

CVE-2017-7427 affects Micro Focus Identity Manager/iManager Plug-in (version 2.7.7.7 and prior to 4.6.1). The vulnerability is a family of multiple cross-site scripting (XSS) flaws that allow an attacker to execute arbitrary JavaScript in the context of the vulnerable application. Exploitation pa...

CVE-2017-7427 iManager - Multiple Reflected Cross-Site Scripting attacks

Multiple cross site scripting attacks were found in the Identity Manager Plug-in, hosted on iManager 2.7.7.7, before Identity Manager 4.6.1. In certain scenarios it was possible to execute arbitrary JavaScript code in the context of vulnerable application, via user.Context in the Object Selector,...

Cross site scripting

Novell Access Manager iManager before 4.3.3 did not validate parameters so that cross site scripting content could be reflected back into the result page using the "a" parameter...

CVE-2017-5189

NetIQ iManager before 3.0.3 delivered a SSL private key in a Java application JAR file for authentication to Sentinel, allowing attackers to extract and establish their own connections to the Sentinel appliance...

CVE-2017-7429

The certificate upload in NetIQ eDirectory PKI plugin before 8.8.8 Patch 10 Hotfix 1 could be abused to upload JSP code which could be used by authenticated attackers to execute JSP applets on the iManager server...

CVE-2017-5189

NetIQ iManager before 3.0.3 delivered a SSL private key in a Java application JAR file for authentication to Sentinel, allowing attackers to extract and establish their own connections to the Sentinel appliance...

CVE-2017-9276

Novell Access Manager iManager before 4.3.3 did not validate parameters so that cross site scripting content could be reflected back into the result page using the "a" parameter...

CVE-2017-7429

The certificate upload in NetIQ eDirectory PKI plugin before 8.8.8 Patch 10 Hotfix 1 could be abused to upload JSP code which could be used by authenticated attackers to execute JSP applets on the iManager server...

Design/Logic Flaw

The certificate upload in NetIQ eDirectory PKI plugin before 8.8.8 Patch 10 Hotfix 1 could be abused to upload JSP code which could be used by authenticated attackers to execute JSP applets on the iManager server...

Authentication flaw

NetIQ iManager before 3.0.3 delivered a SSL private key in a Java application JAR file for authentication to Sentinel, allowing attackers to extract and establish their own connections to the Sentinel appliance...

CVE-2017-9276 XSS Vulnerability in iManager

Novell Access Manager iManager before 4.3.3 did not validate parameters so that cross site scripting content could be reflected back into the result page using the "a" parameter...

CVE-2017-9276

The CVE-2017-9276 entry describes a cross-site scripting (XSS) vulnerability in Micro Focus Novell Access Manager iManager prior to version 4.3.3. The root cause is that iManager failed to validate parameters, allowing XSS content to be reflected back into the result page via the parameter "a". P...

CVE-2017-7429 Fix for NetIQ shell code upload

The certificate upload in NetIQ eDirectory PKI plugin before 8.8.8 Patch 10 Hotfix 1 could be abused to upload JSP code which could be used by authenticated attackers to execute JSP applets on the iManager server...

CVE-2017-5189

CVE-2017-5189 affects NetIQ iManager prior to 3.0.3, where a SSL private key was embedded in a Java application (JAR) used to authenticate to the Sentinel appliance. This flaw enables an attacker to extract the private key and establish their own connections to Sentinel. The available sources des...

CVE-2017-5189 private SSL key embedded in JAR file in iManager

NetIQ iManager before 3.0.3 delivered a SSL private key in a Java application JAR file for authentication to Sentinel, allowing attackers to extract and establish their own connections to the Sentinel appliance...