CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-9280 – Novell Identity Manager User Application get request url contains the session token.
https://notcve.org/view.php?id=CVE-2017-9280
Some NetIQ Identity Manager Applications before Identity Manager 4.5.6.1 included the session token in GET URLs, potentially allowing exposure of user sessions to untrusted third parties via proxies, referer urls or similar. Algunas versiones de NetIQ Identity Manager Applications anteriores a la Identity Manager 4.5.6.1 incluían el token de sesión en las URL GET. Esto podría permitir se expongan sesiones de usuario a terceros mediante proxies, url de referencia o similares. • https://bugzilla.suse.com/show_bug.cgi?id=1049143 https://download.novell.com/Download?buildid=K7lbPAGJyIk~ • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-598: Use of GET Request Method With Sensitive Query Strings •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-9278 – Avoid password disclosure via EBS event logging in the iManager Oracle driver
https://notcve.org/view.php?id=CVE-2017-9278
The NetIQ Identity Manager Oracle EBS driver before 4.0.2.0 sent EBS logs containing the driver authentication password, potentially disclosing this to attackers able to read the EBS tables. El controlador NetIQ Identity Manager Oracle EBS, en versiones anteriores a la 4.0.2.0, enviaba logs EBS que contenían las contraseña de autenticación del controlador. Esto podría revelar esta información a atacantes capaces de leer las tablas EBS. • https://bugzilla.suse.com/show_bug.cgi?id=1053200 https://download.novell.com/Download?buildid=DKFkx_xPeaw~ • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7434 – NetIQ Identity Manager JDBC driver could leak passwords in exception traces
https://notcve.org/view.php?id=CVE-2017-7434
In the JDBC driver of NetIQ Identity Manager before 4.6 sending out incorrect XML configurations could result in passwords being logged into exception logfiles. En el controlador JDBC en NetIQ Identity Manager en versiones anteriores a la 4.6, el envío de configuraciones XML incorrectas podría resultar en que las contraseñas se registren en archivos de registro de excepciones. • https://bugzilla.suse.com/show_bug.cgi?id=1005907 https://www.netiq.com/documentation/identity-manager-46/releasenotes_idm46/data/releasenotes_idm46.html • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2017-9279 – NetIQ Identity Manager allowed uploading of user icons with incorrect types or extensions
https://notcve.org/view.php?id=CVE-2017-9279
NetIQ Identity Manager before 4.5.6.1 allowed uploading files with double extensions or non-image content in the Themes handling of the User Application Administration, allowing malicious user administrators to potentially execute code or mislead users. NetIQ Identity Manager, en versiones anteriores a la 4.5.6.1, permitía la subida de archivos con doble extensión o contenido sin imágenes en la manipulación de temas de User Application Administration. Esto permitía que usuarios administradores maliciosos ejecutasen código o confundiesen a los usuarios. • https://bugzilla.suse.com/show_bug.cgi?id=1049129 https://download.novell.com/Download?buildid=K7lbPAGJyIk~ • CWE-20: Improper Input Validation CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7426 – iManager - XML External Entity vulnerabilities
https://notcve.org/view.php?id=CVE-2017-7426
The NetIQ Identity Manager Plugins before 4.6.1 contained various XML External XML Entity (XXE) handling flaws that could be used by attackers to leak information or cause denial of service attacks. NetIQ Identity Manager Plugins, en versiones anteriores a la 4.6.1, contenía varios errores de gestión de XEE (XML External Entity) que podrían ser empleados por atacantes para filtrar información o provocar ataques de denegación de servicio (DoS). • https://www.novell.com/support/kb/doc.php?id=7021173 • CWE-611: Improper Restriction of XML External Entity Reference •