CVSS: 8.8EPSS: 0%CPEs: 38EXPL: 0CVE-2019-3760
https://notcve.org/view.php?id=CVE-2019-3760
The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a SQL Injection vulnerability in Workflow Architect. A remote authenticated malicious user could potentially exploit this vulnerability to execute SQL commands on the back-end database to gain unauthorized access to the data by supplying specially crafted input data to the affected application. El software RSA Identity Governance and Lifecycle y los productos RSA Via Lifecycle and Governance versiones anteriores a 7.1.0 P08, contienen una vulnerabilidad de inyección SQL en Workflow Architect. Un usuario malicioso autenticado remotamente podría explotar potencialmente esta vulnerabilidad para ejecutar comandos SQL en la base de datos del back-end para conseguir acceso no autorizado a los datos mediante el suministro de datos de entrada especialmente diseñados para la aplicación afectada. • https://community.rsa.com/docs/DOC-106943 • CWE-20: Improper Input Validation CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.1EPSS: 0%CPEs: 38EXPL: 1CVE-2019-3759 – RSA IG&L Aveksa 7.1.1 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-3759
The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a code injection vulnerability. A remote authenticated malicious user could potentially exploit this vulnerability to run custom Groovy scripts to gain limited access to view or modify information on the Workflow system. El software RSA Identity Governance and Lifecycle y los productos RSA Via Lifecycle and Governance versiones anteriores a 7.1.0 P08, contienen una vulnerabilidad de inyección de código. Un usuario malicioso autenticado remoto podría explotar potencialmente esta vulnerabilidad para ejecutar scripts Groovy personalizados para conseguir acceso limitado para visualizar o modificar información en el sistema Workflow. RSA IG+L Aveksa version 7.1.1 suffers from a remote code execution vulnerability due to an authorization bypass issue. • https://www.exploit-db.com/exploits/48639 http://packetstormsecurity.com/files/158324/RSA-IG-L-Aveksa-7.1.1-Remote-Code-Execution.html https://community.rsa.com/docs/DOC-106943 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2018-1255 – Reflected Cross-Site Scripting Vulnerability
https://notcve.org/view.php?id=CVE-2018-1255
RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to a vulnerable web application, which is then reflected back to the victim and executed by the web browser. RSA Identity Lifecycle and Governance en versiones 7.0.1, 7.0.2 y 7.1.0 contiene una vulnerabilidad de Cross-Site Scripting (XSS) reflejado. Un atacante remoto no autenticado podría explotar esta vulnerabilidad engañando a un usuario de una aplicación víctima para que proporcione código HTML o JavaScript malicioso a una aplicación web vulnerable, que se devuelve a la víctima y es ejecutado por el navegador web. • http://seclists.org/fulldisclosure/2018/Jul/46 http://www.securitytracker.com/id/1041287 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2018-1245 – Authorization ByPass Vulnerability
https://notcve.org/view.php?id=CVE-2018-1245
RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains an authorization bypass vulnerability within the workflow architect component (ACM). A remote authenticated malicious user with non-admin privileges could potentially bypass the Java Security Policies. Once bypassed, a malicious user could potentially run arbitrary system commands at the OS level with application owner privileges on the affected system. RSA Identity Lifecycle and Governance en versiones 7.0.1, 7.0.2 y 7.1.0 contiene una vulnerabilidad de omisión de autenticación en el componente workflow architect component (ACM). Un usuario autenticado remoto malicioso con privilegios no administrativos podría omitir las políticas de seguridad de Java. • http://seclists.org/fulldisclosure/2018/Jul/46 http://www.securitytracker.com/id/1041287 • CWE-863: Incorrect Authorization •
CVSS: 7.3EPSS: 0%CPEs: 4EXPL: 0CVE-2018-11049 – RSA Identity Governance and Lifecycle Uncontrolled Search Path Vulnerability
https://notcve.org/view.php?id=CVE-2018-11049
RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG releases have an uncontrolled search vulnerability. The installation scripts set an environment variable in an unintended manner. A local authenticated malicious user could trick the root user to run malicious code on the targeted system. RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance y RSA IMG tienen una vulnerabilidad de búsqueda no controlada. Los scripts de instalación establecen una variable de entorno de forma no planeada. • http://seclists.org/fulldisclosure/2018/Jul/23 http://www.securityfocus.com/bid/104722 http://www.securitytracker.com/id/1041228 • CWE-427: Uncontrolled Search Path Element •