CVSS: 9.1EPSS: 1%CPEs: 2EXPL: 0CVE-2018-11061 – RSA NetWitness Platform Server-Side Template Injection
https://notcve.org/view.php?id=CVE-2018-11061
21 Aug 2018 — RSA NetWitness Platform versions prior to 11.1.0.2 and RSA Security Analytics versions prior to 10.6.6 are vulnerable to a server-side template injection vulnerability due to insecure configuration of the template engine used in the product. A remote authenticated malicious RSA NetWitness Server user with an Admin or Operator role could exploit this vulnerability to execute arbitrary commands on the server with root privileges. RSA NetWitness Platform en versiones anteriores a la 11.1.0.2 y RSA Security Ana... • http://seclists.org/fulldisclosure/2018/Aug/32 •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2018-1245 – Authorization ByPass Vulnerability
https://notcve.org/view.php?id=CVE-2018-1245
12 Jul 2018 — RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains an authorization bypass vulnerability within the workflow architect component (ACM). A remote authenticated malicious user with non-admin privileges could potentially bypass the Java Security Policies. Once bypassed, a malicious user could potentially run arbitrary system commands at the OS level with application owner privileges on the affected system. RSA Identity Lifecycle and Governance en versiones 7.0.1, 7.0.2 y 7.1.0 conti... • http://seclists.org/fulldisclosure/2018/Jul/46 • CWE-863: Incorrect Authorization •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2018-1255 – Reflected Cross-Site Scripting Vulnerability
https://notcve.org/view.php?id=CVE-2018-1255
12 Jul 2018 — RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to a vulnerable web application, which is then reflected back to the victim and executed by the web browser. RSA Identity Lifecycle and Governance en versiones 7.0.1, 7.0.2 y 7.1.0 contiene una vulnerabilidad de Cross-Site S... • http://seclists.org/fulldisclosure/2018/Jul/46 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.3EPSS: 0%CPEs: 4EXPL: 0CVE-2018-11049 – RSA Identity Governance and Lifecycle Uncontrolled Search Path Vulnerability
https://notcve.org/view.php?id=CVE-2018-11049
05 Jul 2018 — RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG releases have an uncontrolled search vulnerability. The installation scripts set an environment variable in an unintended manner. A local authenticated malicious user could trick the root user to run malicious code on the targeted system. RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance y RSA IMG tienen una vulnerabilidad de búsqueda no controlada. Los scripts de instalación establecen una variable de... • http://seclists.org/fulldisclosure/2018/Jul/23 • CWE-427: Uncontrolled Search Path Element •
CVSS: 7.5EPSS: 5%CPEs: 1EXPL: 0CVE-2018-11051 – RSA Certificate Manager Path Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2018-11051
03 Jul 2018 — RSA Certificate Manager Versions 6.9 build 560 through 6.9 build 564 contain a path traversal vulnerability in the RSA CMP Enroll Server and the RSA REST Enroll Server. A remote unauthenticated attacker could potentially exploit this vulnerability by manipulating input parameters of the application to gain unauthorized read access to the files stored on the server filesystem, with the privileges of the running web application. RSA Certificate Manager desde la versión 6.9 build 560 hasta la 6.9 build 564 con... • http://seclists.org/fulldisclosure/2018/Jul/11 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 0%CPEs: 13EXPL: 0CVE-2018-1253 – Stored cross-site scripting vulnerability
https://notcve.org/view.php?id=CVE-2018-1253
14 Jun 2018 — RSA Authentication Manager Operation Console, versions 8.3 P1 and earlier, contains a stored cross-site scripting vulnerability. A malicious Operations Console administrator could potentially exploit this vulnerability to store arbitrary HTML or JavaScript code through the web interface. When other Operations Console administrators open the affected page, the injected scripts could potentially be executed in their browser. RSA Authentication Manager Operation Console, en versiones 8.3 P1 y anteriores, conti... • http://seclists.org/fulldisclosure/2018/Jun/39 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1254 – RSA Authentication Manager Cross Site Scripting
https://notcve.org/view.php?id=CVE-2018-1254
14 Jun 2018 — RSA Authentication Manager Security Console, versions 8.3 P1 and earlier, contains a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim Security Console administrator to supply malicious HTML or JavaScript code to a vulnerable web application, which is then reflected back to the victim and executed by the web browser. RSA Authentication Manager Security Console en versiones 8.3 P1 y anteriores contiene una vulnera... • http://seclists.org/fulldisclosure/2018/Jun/39 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 56%CPEs: 2EXPL: 4CVE-2018-1235 – Dell EMC RecoverPoint < 5.1.2 - Local Root Command Execution
https://notcve.org/view.php?id=CVE-2018-1235
28 May 2018 — Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, contain a command injection vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability to execute arbitrary commands on the affected system with root privilege. Dell EMC RecoverPoint, en versiones anteriores a la 5.1.2 y RecoverPoint for VMs en versiones anteriores a la 5.1.1.3, contienen una vulnerabilidad de inyección de comandos. Un atacante remoto no autenticado podría expl... • https://packetstorm.news/files/id/148265 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.8EPSS: 1%CPEs: 2EXPL: 0CVE-2018-1241 – Dell EMC RecoverPoint Command Injection / LDAP Password Leak / File Read
https://notcve.org/view.php?id=CVE-2018-1241
28 May 2018 — Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, under certain conditions, may leak LDAP password in plain-text into the RecoverPoint log file. An authenticated malicious user with access to the RecoverPoint log files may obtain the exposed LDAP password to use it in further attacks. Dell EMC RecoverPoint, en versiones anteriores a la 5.1.2 y RecoverPoint for VMs en versiones anteriores a la 5.1.1.3, podrían filtrar contraseñas LDAP en texto plano en el archi... • http://seclists.org/fulldisclosure/2018/May/61 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 6.5EPSS: 7%CPEs: 2EXPL: 0CVE-2018-1242 – Dell EMC RecoverPoint Command Injection / LDAP Password Leak / File Read
https://notcve.org/view.php?id=CVE-2018-1242
28 May 2018 — Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, contains a command injection vulnerability in the Boxmgmt CLI. An authenticated malicious user with boxmgmt privileges may potentially exploit this vulnerability to read RPA files. Note that files that require root permission cannot be read. Dell EMC RecoverPoint, en versiones anteriores a la 5.1.2 y RecoverPoint for VMs en versiones anteriores a la 5.1.1.3, contienen una vulnerabilidad de inyección de comandos... • http://seclists.org/fulldisclosure/2018/May/61 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •