CVSS: 8.8EPSS: 0%CPEs: 38EXPL: 0CVE-2019-3763
https://notcve.org/view.php?id=CVE-2019-3763
The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain an information exposure vulnerability. The Office 365 user password may get logged in a plain text format in the Office 365 connector debug log file. An authenticated malicious local user with access to the debug logs may obtain the exposed password to use in further attacks. El software RSA Identity Governance and Lifecycle y los productos RSA Via Lifecycle and Governance versiones anteriores a 7.1.0 P08, contienen una vulnerabilidad de exposición de información. La contraseña de usuario de Office 365 puede registrarse en un formato de texto plano en el archivo de registro de depuración del conector de Office 365. • https://community.rsa.com/docs/DOC-106943 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 5.4EPSS: 0%CPEs: 38EXPL: 0CVE-2019-3761
https://notcve.org/view.php?id=CVE-2019-3761
The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a stored cross-site scripting vulnerability in the Access Request module. A remote authenticated malicious user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the stored malicious code would gets executed by the web browser in the context of the vulnerable web application. El software RSA Identity Governance and Lifecycle y los productos RSA Via Lifecycle and Governance versiones anteriores a 7.1.0 P08, contienen una vulnerabilidad de tipo cross-site scripting almacenado en el módulo Access Request. Un usuario malicioso autenticado remotamente podría explotar potencialmente esta vulnerabilidad para almacenar código HTML o JavaScript malicioso en un almacén de datos de aplicaciones confiable. • https://community.rsa.com/docs/DOC-106943 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 38EXPL: 0CVE-2019-3760
https://notcve.org/view.php?id=CVE-2019-3760
The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a SQL Injection vulnerability in Workflow Architect. A remote authenticated malicious user could potentially exploit this vulnerability to execute SQL commands on the back-end database to gain unauthorized access to the data by supplying specially crafted input data to the affected application. El software RSA Identity Governance and Lifecycle y los productos RSA Via Lifecycle and Governance versiones anteriores a 7.1.0 P08, contienen una vulnerabilidad de inyección SQL en Workflow Architect. Un usuario malicioso autenticado remotamente podría explotar potencialmente esta vulnerabilidad para ejecutar comandos SQL en la base de datos del back-end para conseguir acceso no autorizado a los datos mediante el suministro de datos de entrada especialmente diseñados para la aplicación afectada. • https://community.rsa.com/docs/DOC-106943 • CWE-20: Improper Input Validation CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.1EPSS: 0%CPEs: 38EXPL: 1CVE-2019-3759 – RSA IG&L Aveksa 7.1.1 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-3759
The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a code injection vulnerability. A remote authenticated malicious user could potentially exploit this vulnerability to run custom Groovy scripts to gain limited access to view or modify information on the Workflow system. El software RSA Identity Governance and Lifecycle y los productos RSA Via Lifecycle and Governance versiones anteriores a 7.1.0 P08, contienen una vulnerabilidad de inyección de código. Un usuario malicioso autenticado remoto podría explotar potencialmente esta vulnerabilidad para ejecutar scripts Groovy personalizados para conseguir acceso limitado para visualizar o modificar información en el sistema Workflow. RSA IG+L Aveksa version 7.1.1 suffers from a remote code execution vulnerability due to an authorization bypass issue. • https://www.exploit-db.com/exploits/48639 http://packetstormsecurity.com/files/158324/RSA-IG-L-Aveksa-7.1.1-Remote-Code-Execution.html https://community.rsa.com/docs/DOC-106943 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.2EPSS: 0%CPEs: 37EXPL: 0CVE-2017-8004
https://notcve.org/view.php?id=CVE-2017-8004
The EMC RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance and RSA IMG products (RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels; RSA Via Lifecycle and Governance version 7.0, all patch levels; RSA Identity Management and Governance (RSA IMG) versions 6.9.1, all patch levels) allow an application administrator to upload arbitrary files that may potentially contain a malicious code. The malicious file could be then executed on the affected system with the privileges of the user the application is running under. Los productos RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance y RSA IMG de EMC (RSA Identity Governance and Lifecycle versiones 7.0.1, 7.0.2, todos los niveles de parches ; RSA Via Lifecycle and Governance versión 7.0, todos los niveles de parches; RSA Identity Management and Governance (RSA IMG) versiones 6.9.1, todos los niveles de parches), permiten a un administrador de aplicación cargar archivos arbitrarios que potencialmente contengan un código malicioso. El archivo malicioso podría ser luego ejecutado en el sistema afectado con los privilegios del usuario bajo el que se ejecuta la aplicación. • http://seclists.org/fulldisclosure/2017/Jul/24 http://www.securityfocus.com/bid/99591 http://www.securitytracker.com/id/1038877 • CWE-20: Improper Input Validation •