CVE-2017-5189 private SSL key embedded in JAR file in iManager

NetIQ iManager before 3.0.3 delivered a SSL private key in a Java application JAR file for authentication to Sentinel, allowing attackers to extract and establish their own connections to the Sentinel appliance...

CVE-2017-9280 Novell Identity Manager User Application get request url contains the session token.

Some NetIQ Identity Manager Applications before Identity Manager 4.5.6.1 included the session token in GET URLs, potentially allowing exposure of user sessions to untrusted third parties via proxies, referer urls or similar...

CVE-2017-7434

CVE-2017-7434 affects the NetIQ Identity Manager JDBC driver prior to 4.6. A vulnerability allows passwords to be logged in exception log files due to sending out incorrect XML configurations. Public details in the sources indicate the issue is documented in NVD and CNVD records, with no explicit...

CVE-2017-5189

CVE-2017-5189 affects NetIQ iManager prior to 3.0.3, where a SSL private key was embedded in a Java application (JAR) used to authenticate to the Sentinel appliance. This flaw enables an attacker to extract the private key and establish their own connections to Sentinel. The available sources des...

CVE-2017-14801

CVE-2017-14801 affects NetIQ Access Manager prior to 4.3.3. It is a reflected Cross-Site Scripting (XSS) vulnerability where an attacker-supplied URL parameter is reflected in the response, enabling script execution in the context of the vulnerable page. Affected product/version: NetIQ Access Man...

CVE-2017-9280

CVE-2017-9280 affects NetIQ Identity Manager Applications prior to 4.5.6.1. The vulnerability arises from session tokens being included in GET URLs, which can expose user sessions to untrusted third parties via proxies, referer URLs, or similar channels. The issue is documented across multiple so...

CVE-2017-9285 Login restrictions not applied when using ebaclient against NetIQ eDirectory EBA interface

NetIQ eDirectory before 9.0 SP4 did not enforce login restrictions when "ebaclient" was used, allowing unpermitted access to eDirectory services...

Micro Focus NetIQ Access Manager Reflective Cross-Site Scripting Vulnerability

Micro Focus NetIQ Access Manager is a resource access control solution from Micro Focus UK. The solution provides multiple authentication, data encryption, single sign-on and SSL VPN for local and remote users. A reflected cross-site scripting vulnerability exists in Micro Focus NetIQ Access...

CVE-2017-14799

A cross site scripting attack in handling the ESP login parameter handling in NetIQ Access Manager before 4.3.3 could be used to inject javascript code into the login page...

CVE-2017-14800

A reflected cross site scripting attack in the NetIQ Access Manager before 4.3.3 using the "typecontainerid" parameter of the policy editor could allowed code injection into pages of authenticated users...

Xxe

The NetIQ Identity Manager Plugins before 4.6.1 contained various XML External XML Entity XXE handling flaws that could be used by attackers to leak information or cause denial of service attacks...

CVE-2017-14799

A cross site scripting attack in handling the ESP login parameter handling in NetIQ Access Manager before 4.3.3 could be used to inject javascript code into the login page...

CVE-2017-7426

The NetIQ Identity Manager Plugins before 4.6.1 contained various XML External XML Entity XXE handling flaws that could be used by attackers to leak information or cause denial of service attacks...

CVE-2017-7426

The NetIQ Identity Manager Plugins before 4.6.1 contained various XML External XML Entity XXE handling flaws that could be used by attackers to leak information or cause denial of service attacks...

Cross site scripting

A reflected cross site scripting attack in the NetIQ Access Manager before 4.3.3 using the "typecontainerid" parameter of the policy editor could allowed code injection into pages of authenticated users...

Cross site scripting

A cross site scripting attack in handling the ESP login parameter handling in NetIQ Access Manager before 4.3.3 could be used to inject javascript code into the login page...

CVE-2017-14800

A reflected cross site scripting attack in the NetIQ Access Manager before 4.3.3 using the "typecontainerid" parameter of the policy editor could allowed code injection into pages of authenticated users...

CVE-2017-14799

The CVE-2017-14799 entry concerns Micro Focus NetIQ Access Manager prior to version 4.3.3, where the ESP login parameter handling is vulnerable to cross-site scripting. The underlying issue is improper handling of ESP login parameters, allowing an attacker to inject JavaScript into the login page...

CVE-2017-14799 XSS Vulnerability with ESP URL

A cross site scripting attack in handling the ESP login parameter handling in NetIQ Access Manager before 4.3.3 could be used to inject javascript code into the login page...

CVE-2017-14800

NetIQ Access Manager (pre-4.3.3) is affected by a reflected cross-site scripting vulnerability that can be triggered via the typecontainerid parameter in the policy editor, enabling code injection into pages viewed by authenticated users. The issue arises in the policy editor flow and is document...