Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
39 results
Aug 28, 2024Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText NetIQ Access Manager allows access the sensitive informCVE-2024-4556 · Other software · OpenText · reported by security@opentext.comMedium 5.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText NetIQ Access Manager allows access the sensitive information. This issue affects NetIQ Access Manager before 5.0.4 and before 5.1.
- Product
- NetIQ Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmicrofocus.commicrofocus.com
Aug 28, 2024Improper Privilege Management vulnerability in OpenText NetIQ Access Manager allows user account impersonation in specific scenario.CVE-2024-4555 · Other software · OpenText · reported by security@opentext.comHigh 7.7
Improper Privilege Management vulnerability in OpenText NetIQ Access Manager allows user account impersonation in specific scenario. This issue affects NetIQ Access Manager before 5.0.4.1 and before 5.1
- Product
- NetIQ Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmicrofocus.commicrofocus.com
Aug 28, 2024Improper Input Validation vulnerability in OpenText NetIQ Access Manager leads to Cross-Site Scripting (XSS) attack.CVE-2024-4554 · Other software · OpenText · reported by security@opentext.comHigh 7.3
Improper Input Validation vulnerability in OpenText NetIQ Access Manager leads to Cross-Site Scripting (XSS) attack. This issue affects Access Manager before 5.0.4.1 and 5.1.
- Product
- Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmicrofocus.commicrofocus.com
Jun 11, 2024This allows the information exposure to unauthorized users.CVE-2020-11843 · Other software · OpenText · reported by security@opentext.comMedium 6.5
This allows the information exposure to unauthorized users. This issue affects NetIQ Access Manager using version 4.5 or before
- Product
- NetIQ Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2022Potential open redirection vulnerability when URL is crafted in specific format in NetIQ Access Manager prior to 5.0.2CVE-2022-26326 · Other software · Micro Focus · reported by security@opentext.comMedium 4
Potential open redirection vulnerability when URL is crafted in specific format in NetIQ Access Manager prior to 5.0.2
- Product
- NetIQ Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmicrofocus.commicrofocus.com
May 2, 2022Reflected Cross Site Scripting (XSS) vulnerability in NetIQ Access Manager prior to 5.0.2CVE-2022-26325 · Other software · Micro Focus · reported by security@opentext.comLow 2.9
Reflected Cross Site Scripting (XSS) vulnerability in NetIQ Access Manager prior to 5.0.2
- Product
- NetIQ Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmicrofocus.commicrofocus.com
Sep 13, 2021Reflected Cross Site Scripting (XSS) vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4CVE-2021-22528 · Other software · Micro Focus · reported by security@opentext.comHigh 8
Reflected Cross Site Scripting (XSS) vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4
- Product
- NetIQ Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.microfocus.commicrofocus.com
Sep 13, 2021Information leakage vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4CVE-2021-22527 · Other software · Micro Focus · reported by security@opentext.comMedium 6
Information leakage vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4
- Product
- NetIQ Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.microfocus.commicrofocus.com
Sep 13, 2021Open Redirection vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4CVE-2021-22526 · Other software · Micro Focus · reported by security@opentext.comMedium 4.9
Open Redirection vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4
- Product
- NetIQ Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.microfocus.commicrofocus.com
Sep 13, 2021Injection attack caused the denial of service vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4CVE-2021-22524 · Other software · Micro Focus · reported by security@opentext.comMedium 5.4
Injection attack caused the denial of service vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4
- Product
- NetIQ Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.microfocus.commicrofocus.com
Sep 2, 2021This release addresses a potential information leakage vulnerability in NetIQ Access Manager versions prior to 5.0.1CVE-2021-22525 · Other software · Microfocus · reported by security@opentext.comMedium 5.5
This release addresses a potential information leakage vulnerability in NetIQ Access Manager versions prior to 5.0.1
- Product
- Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.microfocus.comsupport.microfocus.com
Feb 12, 2019An Authentication Bypass issue exists in Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5.CVE-2018-19645 · Other software · NetIQ eDirectory · reported by security@opentext.comCritical 9.8
An Authentication Bypass issue exists in Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5.
- Product
- NetIQ Access Manager (NAM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.serena.comhelp.serena.com
Nov 15, 2018Mitigates an XSS issue in NetIQ Access Manager versions prior to 4.4 SP3.CVE-2018-12480 · Other software · NetIQ eDirectory · reported by security@opentext.comMedium 6.1
Mitigates an XSS issue in NetIQ Access Manager versions prior to 4.4 SP3.
- Product
- NetIQ Access Manager (NAM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.microfocus.comnetiq.com
Mar 14, 2018A cross site scripting vulnerability exist in the Administration Console in NetIQ Access Manager (NAM) 4.3 and 4.4.CVE-2018-7678 · Other software · NetIQ · reported by security@opentext.comLow 3.5
A cross site scripting vulnerability exist in the Administration Console in NetIQ Access Manager (NAM) 4.3 and 4.4.
- Product
- NetIQ Access Manager (NAM) Admin Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comnetiq.com
Mar 14, 2018A CSRF exposure exists in NetIQ Access Manager (NAM) 4.4 Identity Server component.CVE-2018-7677 · Other software · NetIQ · reported by security@opentext.comLow 3.5
A CSRF exposure exists in NetIQ Access Manager (NAM) 4.4 Identity Server component.
- Product
- NetIQ Access Manager (NAM) Admin Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comnetiq.com
Mar 2, 2018A OAuth application in NetIQ Access Manager 4.3 before 4.3.2 and 4.2 before 4.2.4 allowed cross site scripting attacks due to unescaped "description" field thatCVE-2017-7419 · Other software · NetIQ · reported by security@opentext.comMedium 4.6
A OAuth application in NetIQ Access Manager 4.3 before 4.3.2 and 4.2 before 4.2.4 allowed cross site scripting attacks due to unescaped "description" field that could be specified by the provider.
- Product
- Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comnovell.com
Mar 2, 2018Reflected XSS in the NetIQ Access Manager before 4.3.3 allowed attackers to reflect back xss into the called page using the url parameter.CVE-2017-14801 · Other software · NetIQ · reported by security@opentext.comMedium 4.6
Reflected XSS in the NetIQ Access Manager before 4.3.3 allowed attackers to reflect back xss into the called page using the url parameter.
- Product
- Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2018A reflected cross site scripting attack in the NetIQ Access Manager before 4.3.3 using the "typecontainerid" parameter of the policy editor could allowed code iCVE-2017-14800 · Other software · NetIQ · reported by security@opentext.comMedium 5.4
A reflected cross site scripting attack in the NetIQ Access Manager before 4.3.3 using the "typecontainerid" parameter of the policy editor could allowed code injection into pages of authenticated users.
- Product
- Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2018A cross site scripting attack in handling the ESP login parameter handling in NetIQ Access Manager before 4.3.3 could be used to inject javascript code into theCVE-2017-14799 · Other software · NetIQ · reported by security@opentext.comMedium 4.6
A cross site scripting attack in handling the ESP login parameter handling in NetIQ Access Manager before 4.3.3 could be used to inject javascript code into the login page.
- Product
- Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2018A Vulnerability exists on Admin Console where an attacker can upload files to the Admin Console server, and potentially execute them.CVE-2018-1342 · Other software · Micro Focus · reported by security@opentext.comCritical 9.8
A Vulnerability exists on Admin Console where an attacker can upload files to the Admin Console server, and potentially execute them. This impacts NetIQ Access Manager versions 4.3 and 4.4 as well as the Administrative console.
- Product
- NetIQ Access Manager, Administrative Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2018In NetIQ Access Manager 4.3 and 4.4, a bug exists in Identity Server when accessing a basic SSO connector and downloading the BasicSSO connector plugins on IE11CVE-2017-14803 · Other software · Micro Focus · reported by security@opentext.comCritical 9.8
In NetIQ Access Manager 4.3 and 4.4, a bug exists in Identity Server when accessing a basic SSO connector and downloading the BasicSSO connector plugins on IE11 where an attacker can execute arbitrary code on the system.
- Product
- NetIQ Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2017An XSS vulnerability on the /NAGErrors URI in NetIQ Access Manager 4.2 and 4.3 exists because Access Gateway Error pages do not validate the HTTP Referer headerCVE-2017-5191 · Other software · Netiq · reported by security@opentext.comMedium 6.1
An XSS vulnerability on the /NAGErrors URI in NetIQ Access Manager 4.2 and 4.3 exists because Access Gateway Error pages do not validate the HTTP Referer header.
- Product
- Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comnovell.com
Apr 20, 2017NetIQ Access Manager 4.2.2 and 4.3.x before 4.3.1+, when configured as an Identity Server, has XSS in the AssertionConsumerServiceURL field of a signed AuthnReqCVE-2017-5183 · Other software · Netiq · reported by security@opentext.comMedium 6.1
NetIQ Access Manager 4.2.2 and 4.3.x before 4.3.1+, when configured as an Identity Server, has XSS in the AssertionConsumerServiceURL field of a signed AuthnRequest in a samlp:AuthnRequest document.
- Product
- Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2017NetIQ Access Manager 4.2 before SP3 HF1 and 4.3 before SP1 HF1, when configured as a SAML 2.0 Identity Server with Virtual Attributes, has a concurrency issue cCVE-2017-5190 · Other software · Netiq · reported by security@opentext.comLow 3.1
NetIQ Access Manager 4.2 before SP3 HF1 and 4.3 before SP1 HF1, when configured as a SAML 2.0 Identity Server with Virtual Attributes, has a concurrency issue causing information leakage, related to a stale profile.
- Product
- Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Mar 23, 2017A cross site request forgery protection mechanism in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be circumvented by repeated uploCVE-2016-5758 · Other software · Netiq · reported by security@opentext.comHigh 8.8
A cross site request forgery protection mechanism in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be circumvented by repeated uploads causing a high load.
- Product
- Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comnovell.com
Mar 23, 2017iManager Admin Console in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to iFrame manipulation attacks, which could allow CVE-2016-5757 · Other software · Netiq · reported by security@opentext.comCritical 9.8
iManager Admin Console in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to iFrame manipulation attacks, which could allow remote users to gain access to authentication credentials.
- Product
- Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2017Multiple components of the web tools in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 were vulnerable to Reflected Cross Site Scripting aCVE-2016-5756 · Other software · Netiq · reported by security@opentext.comMedium 6.1
Multiple components of the web tools in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 were vulnerable to Reflected Cross Site Scripting attacks which could be used to hijack user sessions: nps/servlet/frameservice, nps/servlet/webacc, roma/admin/cntl, roma/jsp/admin/appliance/devicedetail_edit.jsp, roma/jsp/admin/managementip/mgmt_ip_details_frameset.jsp, roma/jsp/admin/managementip/mgmt_ip_details_middleframe.jsp, roma/jsp/volsc/monitoring/appliance.jsp, and roma/jsp/volsc/monitoring/graph.jsp.
- Product
- Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2017NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to clickjacking attacks due to a missing SAMEORIGIN filter in the "high encrCVE-2016-5755 · Other software · Netiq · reported by security@opentext.comMedium 6.5
NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to clickjacking attacks due to a missing SAMEORIGIN filter in the "high encryption" setting.
- Product
- Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2017Presence of a .htaccess file could leak information in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before SP2.CVE-2016-5754 · Other software · Netiq · reported by security@opentext.comHigh 7.5
Presence of a .htaccess file could leak information in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before SP2.
- Product
- Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2017The SAML2 implementation in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 was handling unsigned SAML requests incorrectly, lCVE-2016-5752 · Other software · Netiq · reported by security@opentext.comHigh 7.5
The SAML2 implementation in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 was handling unsigned SAML requests incorrectly, leaking results to a potentially malicious "Assertion Consumer Service URL" instead of the original requester.
- Product
- Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2017An unfiltered finalizer target URL in the SAML processing feature in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 could be CVE-2016-5751 · Other software · Netiq · reported by security@opentext.comMedium 6.1
An unfiltered finalizer target URL in the SAML processing feature in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 could be used to trigger XSS and leak authentication credentials.
- Product
- Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2017The certificate upload feature in iManager in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to upload JSP pages that would CVE-2016-5750 · Other software · Netiq · reported by security@opentext.comHigh 8.8
The certificate upload feature in iManager in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to upload JSP pages that would be executed as the iManager user, allowing code execution by logged-in remote users.
- Product
- Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2017NetIQ Access Manager 4.1 before 4.1.2 HF 1 and 4.2 before 4.2.2 was parsing incoming SAML requests with external entity resolution enabled, which could lead to CVE-2016-5749 · Other software · Netiq · reported by security@opentext.comMedium 5.5
NetIQ Access Manager 4.1 before 4.1.2 HF 1 and 4.2 before 4.2.2 was parsing incoming SAML requests with external entity resolution enabled, which could lead to local file disclosure via an XML External Entity (XXE) attack.
- Product
- Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2017External Entity Processing (XXE) vulnerability in the "risk score" application of NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be CVE-2016-5748 · Other software · Netiq · reported by security@opentext.comMedium 5.5
External Entity Processing (XXE) vulnerability in the "risk score" application of NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to disclose the content of local files to logged-in users.
- Product
- Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2014Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.1 allow remote attackers to inject arbitrary web script or HTML vCVE-2014-9412 · Other software · Microfocus · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.1 allow remote attackers to inject arbitrary web script or HTML via (1) an arbitrary parameter to roma/jsp/debug/debug.jsp or (2) an arbitrary parameter in a debug.DumpAll action to nps/servlet/webacc, a different issue than CVE-2014-5216.
- Product
- Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Dec 23, 2014Cross-site request forgery (CSRF) vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Access Manager (NAM) 4.x before 4.1 allows rCVE-2014-5217 · Other software · Microfocus · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Access Manager (NAM) 4.x before 4.1 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via an fw.SetPassword action.
- Product
- Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Dec 23, 2014Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allow remote attackers to inject arbitrary web script or CVE-2014-5216 · Other software · Microfocus · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allow remote attackers to inject arbitrary web script or HTML via (1) the location parameter in a dev.Empty action to nps/servlet/webacc, (2) the error parameter to nidp/jsp/x509err.jsp, (3) the lang parameter to sslvpn/applet_agent.jsp, or (4) the secureLoggingServersA parameter to roma/system/cntl, a different issue than CVE-2014-9412.
- Product
- Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Dec 23, 2014NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allows remote authenticated administrators to discover service-account passwords via a request to (1) roma/jsp/vCVE-2014-5215 · Other software · Microfocus · reported by MITREMedium 4
NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allows remote authenticated administrators to discover service-account passwords via a request to (1) roma/jsp/volsc/monitoring/dev_services.jsp or (2) roma/jsp/debug/debug.jsp.
- Product
- Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Dec 23, 2014nps/servlet/webacc in iManager in the Administration Console server in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allows remote authenticated novlwww usersCVE-2014-5214 · Other software · Microfocus · reported by MITREMedium 4
nps/servlet/webacc in iManager in the Administration Console server in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allows remote authenticated novlwww users to read arbitrary files via a query parameter containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Product
- Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.