CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-26947
https://notcve.org/view.php?id=CVE-2022-26947
29 Mar 2022 — Archer 6.x through 6.9 SP3 (6.9.3.0) contains a reflected XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the malicious code is then reflected back to the victim and gets executed by the web browser in the context of the vulnerable web application. Archer versiones 6.x hasta 6.9 SP3 (6.9.3.0) contiene una vulnerabilidad de tipo... • https://www.archerirm.community/t5/general-support-information/tkb-p/information-support • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-29253
https://notcve.org/view.php?id=CVE-2021-29253
26 May 2021 — The Tableau integration in RSA Archer 6.4 P1 (6.4.0.1) through 6.9 P2 (6.9.0.2) is affected by an insecure credential storage vulnerability. An malicious attacker with access to the Tableau workbook file may obtain access to credential information to use it in further attacks. La integración de Tableau en RSA Archer versiones 6.4 P1 (6.4.0.1) hasta 6.9 P2 (6.9.0.2) está afectada por una vulnerabilidad de almacenamiento de credenciales no segura. Un atacante malicioso con acceso al archivo de Tableau wo... • https://community.rsa.com/t5/archer-product-advisories/rsa-2021-04-archer-an-rsa-business-update-for-multiple/ta-p/603223 • CWE-522: Insufficiently Protected Credentials •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-5337
https://notcve.org/view.php?id=CVE-2020-5337
04 May 2020 — RSA Archer, versions prior to 6.7 P1 (6.7.0.1), contain a URL redirection vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to redirect application users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links. The vulnerability could be used to conduct phishing attacks that cause users to unknowingly visit malicious sites. RSA Archer, versiones anteriores a la versión 6.7 P1 (6.7.0.1), contienen una vulnerabilidad de redireccionam... • https://www.dell.com/support/security/en-us/details/DOC-111112/DSA-2020-049-RSA-Archer-Security-Update-for-Multiple-Vulnerabilities • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-5336
https://notcve.org/view.php?id=CVE-2020-5336
04 May 2020 — RSA Archer, versions prior to 6.7 P1 (6.7.0.1), contain a URL injection vulnerability. An unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to execute malicious JavaScript code on the affected system. RSA Archer, versiones anteriores a la versión 6.7 P1 (6.7.0.1), contienen una vulnerabilidad de inyección de URL. Un atacante no autenticado podría explotar potencialmente esta vulnerabilidad al engañar a un usuario víctima de la aplicación para que eje... • https://www.dell.com/support/security/en-us/details/DOC-111112/DSA-2020-049-RSA-Archer-Security-Update-for-Multiple-Vulnerabilities • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-5335
https://notcve.org/view.php?id=CVE-2020-5335
04 May 2020 — RSA Archer, versions prior to 6.7 P2 (6.7.0.2), contain a cross-site request forgery vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to send arbitrary requests to the vulnerable application to perform server operations with the privileges of the authenticated victim user. RSA Archer, versiones anteriores a la versión 6.7 P2 (6.7.0.2), contienen una vulnerabilidad de tipo cross-site request forgery. Un atacante remoto no aute... • https://www.dell.com/support/security/en-us/details/DOC-111112/DSA-2020-049-RSA-Archer-Security-Update-for-Multiple-Vulnerabilities • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 0CVE-2020-5334
https://notcve.org/view.php?id=CVE-2020-5334
04 May 2020 — RSA Archer, versions prior to 6.7 P2 (6.7.0.2), contains a Document Object Model (DOM) based cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to DOM environment in the browser. The malicious code is then executed by the web browser in the context of the vulnerable web application. RSA Archer, versiones anteriores a la versión 6.7 P2 (6.7.0.2), contiene una vulne... • https://www.dell.com/support/security/en-us/details/DOC-111112/DSA-2020-049-RSA-Archer-Security-Update-for-Multiple-Vulnerabilities • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-5333
https://notcve.org/view.php?id=CVE-2020-5333
04 May 2020 — RSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain an authorization bypass vulnerability in the REST API. A remote authenticated malicious Archer user could potentially exploit this vulnerability to view unauthorized information. RSA Archer, versiones anteriores a la versión 6.7 P3 (6.7.0.3), contienen una vulnerabilidad de omisión de autorización en la API REST. Un usuario de Archer malicioso autenticado remoto podría explotar potencialmente esta vulnerabilidad para visualizar información no autorizad... • https://www.dell.com/support/security/en-us/details/DOC-111112/DSA-2020-049-RSA-Archer-Security-Update-for-Multiple-Vulnerabilities • CWE-285: Improper Authorization CWE-863: Incorrect Authorization •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2020-5332
https://notcve.org/view.php?id=CVE-2020-5332
04 May 2020 — RSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain a command injection vulnerability. AN authenticated malicious user with administrator privileges could potentially exploit this vulnerability to execute arbitrary commands on the system where the vulnerable application is deployed. RSA Archer, versiones anteriores a la versión 6.7 P3 (6.7.0.3), contienen una vulnerabilidad de inyección de comandos. Un usuario malicioso autenticado con privilegios de administrador podría explotar potencialmente esta vul... • https://www.dell.com/support/security/en-us/details/DOC-111112/DSA-2020-049-RSA-Archer-Security-Update-for-Multiple-Vulnerabilities • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-5331
https://notcve.org/view.php?id=CVE-2020-5331
04 May 2020 — RSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain an information exposure vulnerability. Users’ session information could potentially be stored in cache or log files. An authenticated malicious local user with access to the log files may obtain the exposed information to use it in further attacks. RSA Archer, versiones anteriores a la versión 6.7 P3 (6.7.0.3), contienen una vulnerabilidad de exposición de información. La información de sesión de los usuarios podría ser almacenada potencialmente en la ... • https://www.dell.com/support/security/en-us/details/DOC-111112/DSA-2020-049-RSA-Archer-Security-Update-for-Multiple-Vulnerabilities • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-598: Use of GET Request Method With Sensitive Query Strings •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-3758
https://notcve.org/view.php?id=CVE-2019-3758
18 Sep 2019 — RSA Archer, versions prior to 6.6 P2 (6.6.0.2), contain an improper authentication vulnerability. The vulnerability allows sysadmins to create user accounts with insufficient credentials. Unauthenticated attackers could gain unauthorized access to the system using those accounts. RSA Archer, versiones anteriores a 6.6 P2 (6.6.0.2), contienen una vulnerabilidad de autenticación inapropiada. La vulnerabilidad permite a los administradores de sistema crear cuentas de usuario con credenciales insuficientes. • https://community.rsa.com/docs/DOC-106759 • CWE-288: Authentication Bypass Using an Alternate Path or Channel CWE-521: Weak Password Requirements •