CVE-2012-1064

CVE-2012-1064 affects EMC RSA Archer GRC 5.x and SmartSuite Framework 4.x; multiple XSS vulnerabilities allowed remote attackers to inject arbitrary script/HTML via unspecified vectors in affected RSA Archer components. The ESA advisory notes fixes in RSA Archer GRC 5.3 and 5.2SP1 (upgrade to 5.3...

CVE-2012-2294

CVE-2012-2294 affects EMC RSA Archer SmartSuite Framework 4.x and RSA Archer GRC 5.x earlier than 5.2SP1. The issue is a clickjacking vulnerability exposed via crafted web pages, allowing remote attackers to entice user actions in a legitimate session. The NVD entry lists a CVSSv2 base score of 6...

CVE-2015-0542

RSA Archer GRC 5.5 SP1 contains multiple Cross-Site Request Forgery (CSRF) vulnerabilities that could allow an attacker to hijack the authentication of arbitrary users. The issue is tied to the RSA Archer GRC platform before the P3 release of 5.5 SP1. According to ESA-2015-094, fixes are included...

CVE-2012-2292

The CVE-2012-2292 issue affects RSA Archer products: EMC RSA Archer SmartSuite Framework 4.x and RSA Archer GRC 5.x prior to 5.2SP1. Root cause: a misconfigured Silverlight cross-domain policy that does not restrict access to the Archer application, allowing remote attackers to bypass the Same Or...

CVE-2012-2293

The CVE-2012-2293 issue affects EMC RSA Archer SmartSuite Framework 4.x and RSA Archer GRC 5.x prior to 5.2SP1. A directory traversal flaw allows remote authenticated users to upload files via a relative path, enabling arbitrary code execution on the affected system. Root cause: improper validati...

CVE-2013-0934

CVE-2013-0934 affects EMC RSA Archer GRC 5.x (before 5.3SP1) and Archer Smart Suite Framework 4.x. The root cause is improper authorization that can let remote authenticated users bypass access restrictions and modify global reports via unspecified vectors. Impact is unauthorized modification of ...

CVE-2013-6178

RSA Archer GRC 5.x is affected by multiple cross-site scripting (XSS) vulnerabilities (CVE-2013-6178). The issue lies in RSA Archer GRC 5.x before 5.4 SP1; exploitation could allow attackers to execute arbitrary HTML/Script in a user session. RSA advises upgrading to RSA Archer GRC 5.4 P2 or 5.4 ...

CVE-2013-3276

RSA Archer GRC 5.x before 5.4 is affected by CVE-2013-3276: an improper restriction of user login allows remote authenticated users to bypass login by leveraging a deactivated account. The vulnerability (CVSSv2 base score 6.0) impacts authentication, with partial confidentiality, integrity, and a...

CVE-2017-5000

CVE-2017-5000 corresponds to an information disclosure vulnerability in EMC RSA Archer, affecting versions 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, and 5.5.1.1. The issue is described as information exposure via error messages, allowing a remote low-privileged attacker to gain disclosure and ...

CVE-2017-5002

CVE-2017-5002 : EMC RSA Archer versions 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1 are affected by an open redirect vulnerability. A remote, unprivileged attacker could redirect legitimate users to arbitrary external sites, enabling phishing attempts and the potential theft of credentia...

CVE-2014-0640

CVE-2014-0640 affects EMC RSA Archer GRC Platform 5.x, prior to 5.5 SP1, where remote authenticated users can bypass resource-access restrictions via unspecified vectors. The RSA advisory ESA-2014-071 confirms this vulnerability within the 5.5 SP1 fixes bundle for RSA Archer GRC Platform 5.x. Imp...

CVE-2017-4999

CVE-2017-4999 pertains to EMC RSA Archer across multiple 5.x releases (e.g., 5.4.1.3, 5.5.x). The vulnerability is an authorization bypass in the Discussion Forum Messages component caused by handling of input via user-controlled keys, enabling a remote, low-privileged attacker to elevate privile...

CVE-2017-5001

CVE-2017-5001 affects EMC RSA Archer versions 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1. It describes an information-exposure through an error message vulnerability where a remote low-privileged attacker may leverage information disclosed in error messages to facilitate a more targeted...

CVE-2017-4998

CVE-2017-4998 affects EMC RSA Archer, with cross-site request forgery (CSRF) in versions listed (e.g., 5.4.1.3, 5.5.x, 5.5.1.x). A remote, low-privileged attacker could perform unauthorized actions on behalf of an authenticated user. CVSSv3: 8.8 ( HIGH ). Exploitation is mediated by a compromised...

CVE-2014-0639

CVE-2014-0639 affects RSA Archer GRC 5.x, with fixes only in RSA Archer GRC 5.4 SP1 P3. The ESA-2014-021 advisory confirms multiple cross-site scripting vulnerabilities in RSA Archer GRC 5.4 SP1 P3 platform, allowing an attacker to execute arbitrary HTML/JavaScript in a user’s browser session wit...

CVE-2014-0641

The CVE-2014-0641 issue affects EMC RSA Archer GRC Platform 5.x (up to 5.5 SP1). It is a Cross-Site Request Forgery (CSRF) vulnerability that could allow a remote attacker to hijack an authenticated user’s session in the victim’s browser by enticing the user to click crafted links or similar acti...

CVE-2013-0932

CVE-2013-0932 affects EMC RSA Archer GRC 5.x (before 5.3SP1) and Archer Smart Suite Framework 4.x. It allows remote authenticated users to bypass access controls and upload arbitrary files via unspecified vectors, enabling potential compromise of the Archer platform. RSA ESA-2013-015 documents th...

CVE-2013-0933

CVE-2013-0933 involves multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Archer 5.x (before GRC 5.3SP1) and Archer Smart Suite Framework 4.x. The underlying issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Connected advisories (ESA-2013-01...

CVE-2014-2505

RSA Archer GRC Platform 5.x prior to 5.5 SP1 is affected by CVE-2014-2505, which allows an attacker to cause the application to download code from an untrusted control sphere, potentially changing functionality. The linked advisory (ESA-2014-071) confirms the vulnerability as one of several in RS...

CVE-2016-0899

CVE-2016-0899 affects EMC RSA Archer GRC 5.5.x before 5.5.3.4. Affects web application where remote authenticated users can read the web.config.bak file by altering IIS to set a Content-Type header for .bak files, enabling access to sensitive credential information. Root cause: improper handling ...

CVE-2013-3277

RSA Archer GRC 5.x (pre-5.4) contains an open redirect vulnerability (CVE-2013-3277) that could enable phishing by redirecting users to arbitrary sites. The issue affects EMC RSA Archer GRC platform versions prior to 5.4; downgrade is not indicated. The public advisory ESA-2013-057 notes this vul...

CVE-2014-2517

Summary: CVE-2014-2517 is a privilege escalation vulnerability affecting EMC RSA Archer GRC Platform 5.x. Connected advisory ESA-2014-071 confirms a vulnerability in RSA Archer GRC Platform 5.5 SP1 timeframe where malicious non-privileged users could perform unauthorized operations within the app...

CVE-2014-4633

CVE-2014-4633 is a persistent Cross-Site Scripting (XSS) vulnerability in EMC RSA Archer GRC Platform 5.x, exploitable in versions prior to 5.5.1.1. The issue could allow an attacker to execute arbitrary HTML/script in a user’s browser session within the affected RSA Archer application. The ESA-2...