CVE-2018-7676

The CVE refers to Micro Focus NetIQ Identity Manager. In versions prior to 4.7, when userapp with log/trace enabled, there is an information disclosure vulnerability that may leak sensitive data. Impact is described as a confidentiality breach (partial) with no integrity/availability impact state...

CVE-2017-9280

CVE-2017-9280 affects NetIQ Identity Manager Applications prior to 4.5.6.1. The vulnerability arises from session tokens being included in GET URLs, which can expose user sessions to untrusted third parties via proxies, referer URLs, or similar channels. The issue is documented across multiple so...

CVE-2017-7434

CVE-2017-7434 affects the NetIQ Identity Manager JDBC driver prior to 4.6. A vulnerability allows passwords to be logged in exception log files due to sending out incorrect XML configurations. Public details in the sources indicate the issue is documented in NVD and CNVD records, with no explicit...

CVE-2017-7427

CVE-2017-7427 affects Micro Focus Identity Manager/iManager Plug-in (version 2.7.7.7 and prior to 4.6.1). The vulnerability is a family of multiple cross-site scripting (XSS) flaws that allow an attacker to execute arbitrary JavaScript in the context of the vulnerable application. Exploitation pa...

CVE-2018-7674

The CVE concerns NetIQ Identity Manager’s user console vulnerability: URL redirection in versions before 4.7. Affected element is the user console; the underlying flaw enables redirection to external sites. The documents state the impact as the ability to direct users to other Web sites, with no ...

CVE-2018-1350

CVE-2018-1350 affects NetIQ Identity Manager, specifically the driver log file component. Versions prior to 4.7 expose details in the log that could aid in system enumeration, representing a misconfiguration/information disclosure risk rather than code execution. The root cause is leakage of oper...

CVE-2007-4526

CVE-2007-4526 concerns the Client Login Extension (CLE) in Novell Identity Manager prior to version 3.5.1 20070730 . The vulnerability arises because CLE stores usernames and passwords in a local file, enabling local users to read sensitive credentials from the filesystem. The provided sources co...

CVE-2017-7426

The CVE-2017-7426 issue affects NetIQ Identity Manager Plugins prior to version 4.6.1. It stems from XML External Entity (XXE) handling flaws in the plugins, enabling attackers to potentially disclose information and cause a denial of service. The NVD entries provide CVSSv3/2 metrics indicating h...

CVE-2017-9279

CVE-2017-9279 affects NetIQ Identity Manager prior to 4.5.6.1. In the Themes handling of the User Application Administration, it allows uploading files with double extensions or non-image content, enabling a malicious administrator to potentially execute code or mislead users. Root cause: insuffi...

CVE-2022-26329

The vulnerability CVE-2022-26329 affects NetIQ Identity Manager plugin (prior to version 4.8.5). It is a File Presence Disclosure vulnerability that lets an attacker determine whether a file exists on the filesystem. Affected products: Micro Focus NetIQ Identity Manager Identity Manager versions ...

CVE-2017-9278

The CVE-2017-9278 entry relates to the NetIQ Identity Manager Oracle EBS driver. Affected component: Oracle EBS driver (NetIQ Identity Manager) prior to version 4.0.2.0. Root cause: the driver logs could contain the driver authentication password, which may be disclosed to any attacker able to re...

CVE-2018-1349

CVE-2018-1349 affects the NetIQ Identity Manager driver log file, where versions prior to 4.7 expose details that could aid in system or configuration enumeration. The vulnerability is a log file information leakage issue in the NetIQ Identity Manager product. The provided connected documents cor...

CVE-2015-0787

NetIQ Designer for Identity Manager is affected by an XSS vulnerability in the forgotUser.do CGI, exploitable via the accessMgrDN parameter. Versions prior to 4.5.3 are impacted; remote attackers could inject arbitrary HTML/Script in a user’s context. Remediation: upgrade to version 4.5.3 or late...

CVE-2017-9284

Affected product/version: Micro Focus IDM Identity Applications (IDM 4.6 Identity Applications) before 4.6.2.1. Vulnerability type / impact: Information disclosure; may expose sensitive information. Root cause / nature (as stated): IDM 4.6 Identity Applications prior to 4.6.2.1 may expose sensiti...

CVE-2014-4509

The CVE-2014-4509 issue affects Novell Identity Manager (IDM) 4.0.2, specifically the MKDQUOTESAFE function in the Fan-out driver scripts within Fan-Out Platform Services. The vulnerability allows local users to execute arbitrary commands by leveraging eDirectory POSIX attribute changes to insert...

CVE-2006-4506

The CVE-2006-4506 entry concerns Novell Identity Manager (IDM) 3.0.1, where idmlib.sh in the nxdrv component allows local users to run arbitrary commands via unspecified vectors, with potential involvement of the " (quote) and \ (backslash) characters and eval injection. Public sources in the NVD...

CVE-2018-7673

The CVE-2018-7673 entry describes a DoS vulnerability in the NetIQ Identity Manager communication channel for versions prior to 4.7. The affected product is NetIQ Identity Manager; affected component is the communication channel. The vulnerability allows a denial of service, with multiple sources...

CVE-2018-1348

CVE-2018-1348 concerns the NetIQ Identity Manager driver. Versions prior to 4.7 are vulnerable to an SSL handshake renegotiation issue that could enable a man-in-the-middle (MITM) attack . The vulnerability arises during TLS renegotiation, enabling an attacker with network access to potentially i...

CVE-2006-4803

The CVE-2006-4803 entry concerns Novell Identity Manager (IDM) 3.0.1, where the Fan-Out Linux and UNIX receiver scripts allow local users to execute arbitrary commands via unspecified vectors involving certain environment variables and code injection. Impact is local command execution with comple...

CVE-2016-1592

NetIQ Designer for Identity Manager is affected by CVE-2016-1592: an XSS vulnerability in the nrfEntitlementReport.do CGI allows remote attackers to inject arbitrary HTML code in pages rendered for Identity Manager, and affects versions prior to 4.5.3. The connected documents confirm the vulnerab...