CVSS: 4.8EPSS: 0%CPEs: 9EXPL: 0CVE-2019-18574
https://notcve.org/view.php?id=CVE-2019-18574
RSA Authentication Manager software versions prior to 8.4 P8 contain a stored cross-site scripting vulnerability in the Security Console. A malicious Security Console administrator could exploit this vulnerability to store arbitrary HTML or JavaScript code through the web interface which could then be included in a report. When other Security Console administrators open the affected report, the injected scripts could potentially be executed in their browser. El software RSA Authentication Manager versiones anteriores a 8.4 P8, contienen una vulnerabilidad de tipo cross-site scripting almacenado en la Consola de Seguridad. Un administrador malicioso de la Consola de Seguridad podría explotar esta vulnerabilidad para almacenar código arbitrario HTML o JavaScript por medio de la interfaz web que luego podría ser incluido en un reporte. • https://www.dell.com/support/security/en-us/details/DOC-109297/DSA-2019-168-RSA®%3B-Authentication-Manager-Software-Stored-Cross-Site-Scripting-Vulnerability • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2019-3711 – DSA-2019-038: RSA® Authentication Manager Insecure Credential Management Vulnerability
https://notcve.org/view.php?id=CVE-2019-3711
RSA Authentication Manager versions prior to 8.4 P1 contain an Insecure Credential Management Vulnerability. A malicious Operations Console administrator may be able to obtain the value of a domain password that another Operations Console administrator had set previously and use it for attacks. RSA Authentication Manager, en CVErsiones anteriores a la 8.4 P1, contiene una vulnerabilidad de gestión insegura de credenciales. Un administrador malicioso de la consola de operaciones podría ser capaz de obtener el valor de una contraseña de dominio que había sido establecida por otro administrador de la consola de operaciones y emplearla para ataques. • http://www.securityfocus.com/bid/107210 https://seclists.org/fulldisclosure/2019/Mar/5 •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-15782 – DSA-2018-226: RSA® Authentication Manager Relative Path Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2018-15782
The Quick Setup component of RSA Authentication Manager versions prior to 8.4 is vulnerable to a relative path traversal vulnerability. A local attacker could potentially provide an administrator with a crafted license that if used during the quick setup deployment of the initial RSA Authentication Manager system, could allow the attacker unauthorized access to that system. El componente Quick Setup de las versiones anteriores a la 8.4 de RSA Authentication Manager es vulnerable a un salto de directorio relativo. Un atacante local podría proporcionar una licencia manipulada a un administrador que, si se emplea durante el despliegue de la instalación rápida del sistema inicial de RSA Authentication Manager, podría permitir que el atacante obtenga acceso no autorizado a dicho sistema. • https://seclists.org/fulldisclosure/2019/Jan/18 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2018-11073 – DSA-2018-152: RSA® Authentication Manager Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2018-11073
RSA Authentication Manager versions prior to 8.3 P3 contain a stored cross-site scripting vulnerability in the Operations Console. A malicious Operations Console administrator could exploit this vulnerability to store arbitrary HTML or JavaScript code through the web interface. When other Operations Console administrators open the affected page, the injected scripts could potentially be executed in their browser. RSA Authentication Manager en versiones anteriores a la 8.3 P3 contiene una vulnerabilidad de Cross-Site Scripting (XSS) persistente en Operations Console. Un administrador de Operations Console malicioso podría explotar esta vulnerabilidad para almacenar código HTML o JavaScript arbitrario mediante la interfaz web. • http://www.securityfocus.com/bid/105410 http://www.securitytracker.com/id/1041697 https://seclists.org/fulldisclosure/2018/Sep/39 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2018-11074 – DSA-2018-152: RSA® Authentication Manager Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2018-11074
RSA Authentication Manager versions prior to 8.3 P3 are affected by a DOM-based cross-site scripting vulnerability which exists in its embedded MadCap Flare Help files. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to the browser DOM, which code is then executed by the web browser in the context of the vulnerable web application. RSA Authentication Manager en versiones anteriores a la 8.3 P3 se ha visto afectado por una vulnerabilidad Cross-Site Scripting (XSS) basado en DOM que existe en sus archivos MadCap Flare Help embebidos. Un atacante remoto no autenticado podría explotar esta vulnerabilidad engañando a un usuario de una aplicación víctima para que proporcione código HTML o JavaScript malicioso al DOM del navegador, cuyo código es ejecutado por el navegador web en el contexto de la aplicación web vulnerable. • http://www.securityfocus.com/bid/105410 http://www.securitytracker.com/id/1041697 https://seclists.org/fulldisclosure/2018/Sep/39 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •