Multiple Cross-Site Scripting Vulnerabilities in Micro Focus Identity Manager and iManager Identity Manager Plug-in

Micro Focus Identity Manager is a suite of identity management solutions from Micro Focus UK. The solution provides the basis for account provisioning, user self-service, authorization and Web services, and supports data sharing and synchronization. iManager is one of the WEB-based application. Y...

Micro Focus Novell Access Manager iManager Cross-Site Scripting Vulnerability

Micro Focus Novell Access Manager is a comprehensive Web access management solution from Micro Focus UK. iManager is one of the Web-based applications that can manage and configure eDirectory objects using wireless devices. A cross-site scripting vulnerability exists in Micro Focus Novell Access...

Micro Focus NetIQ eDirectory PKI Plugin Design Vulnerability

Micro Focus NetIQ eDirectory is an identity management infrastructure platform that combines identity management architecture and directory services technology from Micro Focus, UK. The platform provides authentication policies, data backup and recovery services, data disaster recovery, etc. PKI...

NetIQ iManager Authentication Vulnerability

NetIQ iManager is a WEB-based application from American NetIQ. You can use wireless devices to manage and configure eDirectory objects. A security vulnerability exists in NetIQ iManager versions prior to 3.0.3 that originates when the program sends an SSL private key from a Java application to...

Cross site scripting

Multiple cross site scripting attacks were found in the Identity Manager Plug-in, hosted on iManager 2.7.7.7, before Identity Manager 4.6.1. In certain scenarios it was possible to execute arbitrary JavaScript code in the context of vulnerable application, via user.Context in the Object Selector,...

CVE-2017-7427

Multiple cross site scripting attacks were found in the Identity Manager Plug-in, hosted on iManager 2.7.7.7, before Identity Manager 4.6.1. In certain scenarios it was possible to execute arbitrary JavaScript code in the context of vulnerable application, via user.Context in the Object Selector,...

CVE-2017-7427

CVE-2017-7427 affects Micro Focus Identity Manager/iManager Plug-in (version 2.7.7.7 and prior to 4.6.1). The vulnerability is a family of multiple cross-site scripting (XSS) flaws that allow an attacker to execute arbitrary JavaScript in the context of the vulnerable application. Exploitation pa...

CVE-2017-7427 iManager - Multiple Reflected Cross-Site Scripting attacks

Multiple cross site scripting attacks were found in the Identity Manager Plug-in, hosted on iManager 2.7.7.7, before Identity Manager 4.6.1. In certain scenarios it was possible to execute arbitrary JavaScript code in the context of vulnerable application, via user.Context in the Object Selector,...

Cross site scripting

Novell Access Manager iManager before 4.3.3 did not validate parameters so that cross site scripting content could be reflected back into the result page using the "a" parameter...

CVE-2017-5189

NetIQ iManager before 3.0.3 delivered a SSL private key in a Java application JAR file for authentication to Sentinel, allowing attackers to extract and establish their own connections to the Sentinel appliance...

CVE-2017-5189

NetIQ iManager before 3.0.3 delivered a SSL private key in a Java application JAR file for authentication to Sentinel, allowing attackers to extract and establish their own connections to the Sentinel appliance...

CVE-2017-7429

The certificate upload in NetIQ eDirectory PKI plugin before 8.8.8 Patch 10 Hotfix 1 could be abused to upload JSP code which could be used by authenticated attackers to execute JSP applets on the iManager server...

CVE-2017-9276

Novell Access Manager iManager before 4.3.3 did not validate parameters so that cross site scripting content could be reflected back into the result page using the "a" parameter...

Design/Logic Flaw

The certificate upload in NetIQ eDirectory PKI plugin before 8.8.8 Patch 10 Hotfix 1 could be abused to upload JSP code which could be used by authenticated attackers to execute JSP applets on the iManager server...

CVE-2017-7429

The certificate upload in NetIQ eDirectory PKI plugin before 8.8.8 Patch 10 Hotfix 1 could be abused to upload JSP code which could be used by authenticated attackers to execute JSP applets on the iManager server...

Authentication flaw

NetIQ iManager before 3.0.3 delivered a SSL private key in a Java application JAR file for authentication to Sentinel, allowing attackers to extract and establish their own connections to the Sentinel appliance...

CVE-2017-9276 XSS Vulnerability in iManager

Novell Access Manager iManager before 4.3.3 did not validate parameters so that cross site scripting content could be reflected back into the result page using the "a" parameter...

CVE-2017-7429 Fix for NetIQ shell code upload

The certificate upload in NetIQ eDirectory PKI plugin before 8.8.8 Patch 10 Hotfix 1 could be abused to upload JSP code which could be used by authenticated attackers to execute JSP applets on the iManager server...

CVE-2017-9276

The CVE-2017-9276 entry describes a cross-site scripting (XSS) vulnerability in Micro Focus Novell Access Manager iManager prior to version 4.3.3. The root cause is that iManager failed to validate parameters, allowing XSS content to be reflected back into the result page via the parameter "a". P...

CVE-2017-5189 private SSL key embedded in JAR file in iManager

NetIQ iManager before 3.0.3 delivered a SSL private key in a Java application JAR file for authentication to Sentinel, allowing attackers to extract and establish their own connections to the Sentinel appliance...