CVE-2018-15780

CVE-2018-15780 affects RSA Archer 6.x prior to 6.5.0.1, due to improper access control that could let an authenticated attacker bypass authorization and read restricted user information. Public sources in connected documents corroborate an authorization-bypass vulnerability impacting versions bef...

CVE-2019-3715

RSA Archer before 6.5 SP1 is affected by an information disclosure vulnerability (CVE-2019-3715) caused by logging users’ session information in plaintext in RSA Archer log files. A local authenticated user with access to the logs can obtain the exposed information for further attacks. Remediatio...

CVE-2019-3716

CVE-2019-3716 affects RSA Archer prior to 6.5 SP2. An authenticated local attacker who can access RSA Archer log files may obtain the database connection password because it is logged in plaintext, enabling use in further attacks. Affected product is Dell EMC RSA Archer (enterprise IT governance/...

CVE-2017-14369

CVE-2017-14369 affects the RSA Archer GRC Platform prior to version 6.2.0.5. A low privileged user may exploit a privilege escalation vulnerability to elevate privileges and export certain application records. The provided documents do not specify the exact root cause or exploit details. A remedi...

CVE-2017-14371

CVE-2017-14371 affects RSA Archer GRC Platform before 6.2.0.5. The issue is a reflected cross-site scripting vulnerability via the request URL, allowing an attacker to cause arbitrary HTML execution in the user’s browser within the affected RSA Archer application. The connected sources corroborat...

CVE-2017-14372

RSA Archer GRC Platform prior to 6.2.0.5 is affected by reflected cross-site scripting via RSA Archer Help pages. An attacker could execute arbitrary HTML in a user’s browser session in the context of the affected application. Affected product/version: RSA Archer GRC Platform < 6.2.0.5. Root c...

CVE-2017-14370

CVE-2017-14370 concerns RSA Archer GRC Platform versions prior to 6.2.0.5. The vulnerability is a stored cross-site scripting (XSS) via the Source Asset ID field, allowing an authenticated attacker to cause arbitrary HTML execution in a user’s browser session within the affected application. The ...