Archive
March 2018
Vulnerabilities first published in this month (UTC), newest first.
16 results · Clear filters · Feed
-
Low 3.1
IBM Business Process Manager 8.6 could allow an authenticated user with special privileges to reveal sensitive informat…
-
Low 3.9
IDM Information Leakage
The NetIQ Identity Manager, in versions prior to 4.7, userapp with log / trace enabled may leak sensitive information.
-
Low 2.1
IDM URL Redirection attack
The NetIQ Identity Manager user console, in versions prior to 4.7, is susceptible to URL redirection.
-
Low 2.3
NetIQ Identity Manager Driver Component Log File Information Leakage
The NetIQ Identity Manager driver log file, in versions prior to 4.7, provides details that could aid in system or configuration enumeration.
-
Low 2.3
NetIQ Identity Manager Driver Component Information Leakage
The NetIQ Identity Manager driver log file, in versions prior to 4.7, provides details that could aid in system enumeration.
-
Low 3.1
NetIQ eDirectory Denial of Service
Addresses denial of service attack to eDirectory versions prior to 9.1.
-
Low 3.1
NetIQ iManager Communication Downgrade Attack
Addresses potential communication downgrade attack in NetIQ iManager versions prior to 3.1
-
Low 2.9
DocuTrac DTISQLInstaller.exe Hard-Coded Salt
Versions of DocuTrac QuicDoc and Office Therapy that ship with DTISQLInstaller.exe version 1.6.4.0 and prior contains a hard-coded cryptographic salt, "S@l+&pepper".
-
Low 3.1
Windows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windo…
-
Low 3.5
CSRF in NetIQ Access Manager (NAM) Identity Server component
A CSRF exposure exists in NetIQ Access Manager (NAM) 4.4 Identity Server component.
-
Low 3.5
XSS vulnerability in NetIQ Access Manager (NAM) Admin Console component
A cross site scripting vulnerability exist in the Administration Console in NetIQ Access Manager (NAM) 4.3 and 4.4.
-
Low 2.7
Jenkins Coverity Plugin has Insufficiently Protected Credentials
A plaintext storage of a password vulnerability exists in Jenkins Coverity Plugin 1.10.0 and earlier in CIMInstance.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to re…
-
Low 2.8
Potential Information Disclosure in Sentinel
In NetIQ Sentinel before 8.1.x, a Sentinel user is logged into the Sentinel Web Interface. After performing some tasks within Sentinel the user does not log out but does go idle for a period of time. This in turn causes the interface to timeout so that it req…
-
Low 3.3
NetIQ Identity Manager JDBC driver could leak passwords in exception traces
In the JDBC driver of NetIQ Identity Manager before 4.6 sending out incorrect XML configurations could result in passwords being logged into exception logfiles.
-
Low 3.3
Avoid password disclosure via EBS event logging in the iManager Oracle driver
The NetIQ Identity Manager Oracle EBS driver before 4.0.2.0 sent EBS logs containing the driver authentication password, potentially disclosing this to attackers able to read the EBS tables.
-
Low 2.0
NetIQ Identity Manager allowed uploading of user icons with incorrect types or extensions
NetIQ Identity Manager before 4.5.6.1 allowed uploading files with double extensions or non-image content in the Themes handling of the User Application Administration, allowing malicious user administrators to potentially execute code or mislead users.