CVE-2019-6716: Authorization Bypass Through User-Controlled Key

An unauthenticated Insecure Direct Object Reference IDOR in Wicket Core in LogonBox Nervepoint Access Manager 2013 through 2017 allows a remote attacker to enumerate internal Active Directory usernames and group names, and alter back-end server jobs backup and synchronization jobs, which could...

PT-2019-18282

Name of the Vulnerable Software and Affected Versions LogonBox Nervepoint Access Manager versions 2013 through 2017 Description The issue is related to an unauthenticated Insecure Direct Object Reference IDOR in Wicket Core. This allows a remote attacker to enumerate internal Active Directory...