Broadcom Symantec Privileged Access Management
18 CVEs affecting Broadcom Symantec Privileged Access Management. Latest disclosed: 2025-01-30. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-38493 | Medium | 6.1 | 2024-07-15 | A reflected cross-site scripting (XSS) vulnerability exists in the PAM UI web interface. A remote attacker able to convince a PAM user to click on a specially… |
CVE-2025-24507 | | 2025-01-30 | This vulnerability allows appliance compromise at boot time. | |
CVE-2025-24506 | | 2025-01-30 | A specific authentication strategy allows to learn ids of PAM users associated with certain authentication types. | |
CVE-2025-24505 | | 2025-01-30 | This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by uploading a specially craf… | |
CVE-2025-24504 | | 2025-01-30 | An improper input validation the CSRF filter results in unsanitized user input written to the application logs. | |
CVE-2025-24503 | | 2025-01-30 | A malicious actor can fix the session of a PAM user by tricking the user to click on a specially crafted link to the PAM server. | |
CVE-2025-24502 | | 2025-01-30 | An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of an incorrect user by… | |
CVE-2025-24501 | | 2025-01-30 | An improper input validation allows an unauthenticated attacker to alter PAM logs by sending a specially crafted HTTP request. | |
CVE-2025-24500 | | 2025-01-30 | The vulnerability allows an unauthenticated attacker to access information in PAM database. | |
CVE-2024-38496 | | 2024-07-15 | The vulnerability allows a malicious low-privileged PAM user to access information about other PAM users and their group memberships. | |
CVE-2024-38495 | | 2024-07-15 | A specific authentication strategy allows a malicious attacker to learn ids of all PAM users defined in its database. | |
CVE-2024-38494 | | 2024-07-15 | This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by sending a specially crafte… | |
CVE-2024-38492 | | 2024-07-15 | This vulnerability allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by uploading a specially crafted PAM upgra… | |
CVE-2024-38491 | | 2024-07-15 | The vulnerability allows an unauthenticated attacker to read arbitrary information from the database. | |
CVE-2024-36458 | | 2024-07-15 | The vulnerability allows a malicious low-privileged PAM user to perform server upgrade related actions. | |
CVE-2024-36457 | | 2024-07-15 | The vulnerability allows an attacker to bypass the authentication requirements for a specific PAM endpoint. | |
CVE-2024-36456 | | 2024-07-15 | This vulnerability allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by uploading a specially crafted PAM upgra… | |
CVE-2024-36455 | | 2024-07-15 | An improper input validation allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by sending a specially crafted H… |