CVSS: 8.8EPSS: 0%CPEs: 38EXPL: 0CVE-2019-3760
https://notcve.org/view.php?id=CVE-2019-3760
The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a SQL Injection vulnerability in Workflow Architect. A remote authenticated malicious user could potentially exploit this vulnerability to execute SQL commands on the back-end database to gain unauthorized access to the data by supplying specially crafted input data to the affected application. El software RSA Identity Governance and Lifecycle y los productos RSA Via Lifecycle and Governance versiones anteriores a 7.1.0 P08, contienen una vulnerabilidad de inyección SQL en Workflow Architect. Un usuario malicioso autenticado remotamente podría explotar potencialmente esta vulnerabilidad para ejecutar comandos SQL en la base de datos del back-end para conseguir acceso no autorizado a los datos mediante el suministro de datos de entrada especialmente diseñados para la aplicación afectada. • https://community.rsa.com/docs/DOC-106943 • CWE-20: Improper Input Validation CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.1EPSS: 0%CPEs: 38EXPL: 1CVE-2019-3759 – RSA IG&L Aveksa 7.1.1 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-3759
The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a code injection vulnerability. A remote authenticated malicious user could potentially exploit this vulnerability to run custom Groovy scripts to gain limited access to view or modify information on the Workflow system. El software RSA Identity Governance and Lifecycle y los productos RSA Via Lifecycle and Governance versiones anteriores a 7.1.0 P08, contienen una vulnerabilidad de inyección de código. Un usuario malicioso autenticado remoto podría explotar potencialmente esta vulnerabilidad para ejecutar scripts Groovy personalizados para conseguir acceso limitado para visualizar o modificar información en el sistema Workflow. RSA IG+L Aveksa version 7.1.1 suffers from a remote code execution vulnerability due to an authorization bypass issue. • https://www.exploit-db.com/exploits/48639 http://packetstormsecurity.com/files/158324/RSA-IG-L-Aveksa-7.1.1-Remote-Code-Execution.html https://community.rsa.com/docs/DOC-106943 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2018-1245 – Authorization ByPass Vulnerability
https://notcve.org/view.php?id=CVE-2018-1245
RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains an authorization bypass vulnerability within the workflow architect component (ACM). A remote authenticated malicious user with non-admin privileges could potentially bypass the Java Security Policies. Once bypassed, a malicious user could potentially run arbitrary system commands at the OS level with application owner privileges on the affected system. RSA Identity Lifecycle and Governance en versiones 7.0.1, 7.0.2 y 7.1.0 contiene una vulnerabilidad de omisión de autenticación en el componente workflow architect component (ACM). Un usuario autenticado remoto malicioso con privilegios no administrativos podría omitir las políticas de seguridad de Java. • http://seclists.org/fulldisclosure/2018/Jul/46 http://www.securitytracker.com/id/1041287 • CWE-863: Incorrect Authorization •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2018-1255 – Reflected Cross-Site Scripting Vulnerability
https://notcve.org/view.php?id=CVE-2018-1255
RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to a vulnerable web application, which is then reflected back to the victim and executed by the web browser. RSA Identity Lifecycle and Governance en versiones 7.0.1, 7.0.2 y 7.1.0 contiene una vulnerabilidad de Cross-Site Scripting (XSS) reflejado. Un atacante remoto no autenticado podría explotar esta vulnerabilidad engañando a un usuario de una aplicación víctima para que proporcione código HTML o JavaScript malicioso a una aplicación web vulnerable, que se devuelve a la víctima y es ejecutado por el navegador web. • http://seclists.org/fulldisclosure/2018/Jul/46 http://www.securitytracker.com/id/1041287 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 37EXPL: 0CVE-2017-8004
https://notcve.org/view.php?id=CVE-2017-8004
The EMC RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance and RSA IMG products (RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels; RSA Via Lifecycle and Governance version 7.0, all patch levels; RSA Identity Management and Governance (RSA IMG) versions 6.9.1, all patch levels) allow an application administrator to upload arbitrary files that may potentially contain a malicious code. The malicious file could be then executed on the affected system with the privileges of the user the application is running under. Los productos RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance y RSA IMG de EMC (RSA Identity Governance and Lifecycle versiones 7.0.1, 7.0.2, todos los niveles de parches ; RSA Via Lifecycle and Governance versión 7.0, todos los niveles de parches; RSA Identity Management and Governance (RSA IMG) versiones 6.9.1, todos los niveles de parches), permiten a un administrador de aplicación cargar archivos arbitrarios que potencialmente contengan un código malicioso. El archivo malicioso podría ser luego ejecutado en el sistema afectado con los privilegios del usuario bajo el que se ejecuta la aplicación. • http://seclists.org/fulldisclosure/2017/Jul/24 http://www.securityfocus.com/bid/99591 http://www.securitytracker.com/id/1038877 • CWE-20: Improper Input Validation •