CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2018-1255 – Reflected Cross-Site Scripting Vulnerability
https://notcve.org/view.php?id=CVE-2018-1255
RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to a vulnerable web application, which is then reflected back to the victim and executed by the web browser. RSA Identity Lifecycle and Governance en versiones 7.0.1, 7.0.2 y 7.1.0 contiene una vulnerabilidad de Cross-Site Scripting (XSS) reflejado. Un atacante remoto no autenticado podría explotar esta vulnerabilidad engañando a un usuario de una aplicación víctima para que proporcione código HTML o JavaScript malicioso a una aplicación web vulnerable, que se devuelve a la víctima y es ejecutado por el navegador web. • http://seclists.org/fulldisclosure/2018/Jul/46 http://www.securitytracker.com/id/1041287 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2018-1245 – Authorization ByPass Vulnerability
https://notcve.org/view.php?id=CVE-2018-1245
RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains an authorization bypass vulnerability within the workflow architect component (ACM). A remote authenticated malicious user with non-admin privileges could potentially bypass the Java Security Policies. Once bypassed, a malicious user could potentially run arbitrary system commands at the OS level with application owner privileges on the affected system. RSA Identity Lifecycle and Governance en versiones 7.0.1, 7.0.2 y 7.1.0 contiene una vulnerabilidad de omisión de autenticación en el componente workflow architect component (ACM). Un usuario autenticado remoto malicioso con privilegios no administrativos podría omitir las políticas de seguridad de Java. • http://seclists.org/fulldisclosure/2018/Jul/46 http://www.securitytracker.com/id/1041287 • CWE-863: Incorrect Authorization •
CVSS: 7.3EPSS: 0%CPEs: 4EXPL: 0CVE-2018-11049 – RSA Identity Governance and Lifecycle Uncontrolled Search Path Vulnerability
https://notcve.org/view.php?id=CVE-2018-11049
RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG releases have an uncontrolled search vulnerability. The installation scripts set an environment variable in an unintended manner. A local authenticated malicious user could trick the root user to run malicious code on the targeted system. RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance y RSA IMG tienen una vulnerabilidad de búsqueda no controlada. Los scripts de instalación establecen una variable de entorno de forma no planeada. • http://seclists.org/fulldisclosure/2018/Jul/23 http://www.securityfocus.com/bid/104722 http://www.securitytracker.com/id/1041228 • CWE-427: Uncontrolled Search Path Element •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-11051 – RSA Certificate Manager Path Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2018-11051
RSA Certificate Manager Versions 6.9 build 560 through 6.9 build 564 contain a path traversal vulnerability in the RSA CMP Enroll Server and the RSA REST Enroll Server. A remote unauthenticated attacker could potentially exploit this vulnerability by manipulating input parameters of the application to gain unauthorized read access to the files stored on the server filesystem, with the privileges of the running web application. RSA Certificate Manager desde la versión 6.9 build 560 hasta la 6.9 build 564 contiene una vulnerabilidad de salto de directorio en los servidores RSA CMP Enroll y RSA REST Enroll. Un atacante remoto no autenticado podría explotar esta vulnerabilidad manipulando los parámetros de entrada de la aplicación para obtener acceso de lectura no autorizado a los archivos almacenados en el sistema de archivos del servidor, con los privilegios de la aplicación web en ejecución. • http://seclists.org/fulldisclosure/2018/Jul/11 http://www.securityfocus.com/bid/104674 http://www.securitytracker.com/id/1041211 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 0%CPEs: 13EXPL: 0CVE-2018-1253 – Stored cross-site scripting vulnerability
https://notcve.org/view.php?id=CVE-2018-1253
RSA Authentication Manager Operation Console, versions 8.3 P1 and earlier, contains a stored cross-site scripting vulnerability. A malicious Operations Console administrator could potentially exploit this vulnerability to store arbitrary HTML or JavaScript code through the web interface. When other Operations Console administrators open the affected page, the injected scripts could potentially be executed in their browser. RSA Authentication Manager Operation Console, en versiones 8.3 P1 y anteriores, contiene una vulnerabilidad de Cross-Site Scripting (XSS) persistente. Un administrador de Operations Console podría explotar esta vulnerabilidad para almacenar código HTML o JavaScript arbitrario mediante la interfaz web. • http://seclists.org/fulldisclosure/2018/Jun/39 http://www.securityfocus.com/bid/104534 http://www.securitytracker.com/id/1041134 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •