Netiq
71 CVEs across 21 Netiq products. Browse Netiq vulnerabilities, severities, and proof-of-concept exploits.
Netiq products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-26322 | Medium | 4.9 | 2024-09-12 | Possible Insertion of Sensitive Information into Log File Vulnerability in Identity Manager has been discovered in OpenText™ Identity Manager REST Driver. Th… |
CVE-2020-11843 | Medium | 6.5 | 2024-06-11 | This allows the information exposure to unauthorized users. This issue affects NetIQ Access Manager using version 4.5 or before |
CVE-2024-1470 | High | 7.1 | 2024-02-29 | Authorization Bypass Through User-Controlled Key vulnerability in NetIQ (OpenText) Client Login Extension on Windows allows Privilege Escalation, Code Injectio… |
CVE-2022-38758 | High | 7.2 | 2023-01-26 | Cross-site Scripting (XSS) vulnerability in NetIQ iManager prior to version 3.2.6 allows attacker to execute malicious scripts on the user's browser. This issu… |
CVE-2022-26329 | Low | 1.8 | 2023-01-26 | File existence disclosure vulnerability in NetIQ Identity Manager plugin prior to version 4.8.5 allows attacker to determine whether a file exists on the files… |
CVE-2019-11648 | High | 7.5 | 2019-06-24 | An information leakage exists in Micro Focus NetIQ Self Service Password Reset Software all versions prior to version 4.4. The vulnerability could be exploited… |
CVE-2016-1600 | High | 7.5 | 2019-05-09 | The ServiceNow driver in NetIQ Identity Manager versions prior to 4.6 are susceptible to an information disclosure vulnerability. |
CVE-2018-12462 | Medium | 4.8 | 2018-07-10 | NetIQ iManager 3.1.1 addresses potential XSS vulnerabilities. |
CVE-2018-12461 | Low | 3.5 | 2018-07-10 | Fixed issues with NetIQ eDirectory prior to 9.1.1 when checking certificate revocation. |
CVE-2017-9284 | Medium | 4.8 | 2018-04-26 | IDM 4.6 Identity Applications prior to 4.6.2.1 may expose sensitive information. |
CVE-2017-9275 | Low | 2.8 | 2018-04-26 | NetIQ Identity Reporting, in versions prior to 5.5 Service Pack 1, is susceptible to an XSS attack. |
CVE-2018-7676 | Low | 3.9 | 2018-03-28 | The NetIQ Identity Manager, in versions prior to 4.7, userapp with log / trace enabled may leak sensitive information. |
CVE-2018-7674 | Low | 2.1 | 2018-03-28 | The NetIQ Identity Manager user console, in versions prior to 4.7, is susceptible to URL redirection. |
CVE-2018-7673 | Medium | 5.1 | 2018-03-26 | The NetIQ Identity Manager communication channel, in versions prior to 4.7, is susceptible to a DoS attack. |
CVE-2018-1350 | Low | 2.3 | 2018-03-26 | The NetIQ Identity Manager driver log file, in versions prior to 4.7, provides details that could aid in system enumeration. |
CVE-2018-1349 | Low | 2.3 | 2018-03-26 | The NetIQ Identity Manager driver log file, in versions prior to 4.7, provides details that could aid in system or configuration enumeration. |
CVE-2018-1348 | Medium | 5.3 | 2018-03-26 | NetIQ Identity Manager driver, in versions prior to 4.7, allows for an SSL handshake renegotiation which could result in a MITM attack. |
CVE-2018-1347 | Medium | 5.3 | 2018-03-21 | The administrative web interface in NetIQ iManager, versions prior to 3.1, are vulnerable to reflected cross site scripting. |
CVE-2018-1346 | Low | 3.1 | 2018-03-21 | Addresses denial of service attack to eDirectory versions prior to 9.1. |
CVE-2018-1345 | Medium | 5.9 | 2018-03-21 | NetIQ iManager, versions prior to 3.1, under some circumstances could be susceptible to an elevation of privilege attack. |
CVE-2018-1344 | Low | 3.1 | 2018-03-21 | Addresses potential communication downgrade attack in NetIQ iManager versions prior to 3.1 |
CVE-2018-7678 | Low | 3.5 | 2018-03-14 | A cross site scripting vulnerability exist in the Administration Console in NetIQ Access Manager (NAM) 4.3 and 4.4. |
CVE-2018-7677 | Low | 3.5 | 2018-03-14 | A CSRF exposure exists in NetIQ Access Manager (NAM) 4.4 Identity Server component. |
CVE-2018-1343 | Critical | 9.8 | 2018-03-06 | PAM exposure enabling unauthenticated access to remote host |
CVE-2017-7437 | Medium | 4.6 | 2018-03-05 | NetIQ Privileged Account Manager before 3.1 Patch Update 3 allowed cross site scripting attacks via the "type" and "account" parameters of json requests. |
CVE-2017-7427 | Medium | 5.4 | 2018-03-05 | Multiple cross site scripting attacks were found in the Identity Manager Plug-in, hosted on iManager 2.7.7.7, before Identity Manager 4.6.1. In certain scenari… |
CVE-2017-9285 | Medium | 5.4 | 2018-03-02 | NetIQ eDirectory before 9.0 SP4 did not enforce login restrictions when "ebaclient" was used, allowing unpermitted access to eDirectory services. |
CVE-2017-9280 | Medium | 4.3 | 2018-03-02 | Some NetIQ Identity Manager Applications before Identity Manager 4.5.6.1 included the session token in GET URLs, potentially allowing exposure of user sessions… |
CVE-2017-9279 | Low | 2.0 | 2018-03-02 | NetIQ Identity Manager before 4.5.6.1 allowed uploading files with double extensions or non-image content in the Themes handling of the User Application Admini… |
CVE-2017-9278 | Low | 3.3 | 2018-03-02 | The NetIQ Identity Manager Oracle EBS driver before 4.0.2.0 sent EBS logs containing the driver authentication password, potentially disclosing this to attacke… |
CVE-2017-9276 | Medium | 5.4 | 2018-03-02 | Novell Access Manager iManager before 4.3.3 did not validate parameters so that cross site scripting content could be reflected back into the result page using… |
CVE-2017-7438 | Medium | 4.6 | 2018-03-02 | NetIQ Privileged Account Manager before 3.1 Patch Update 3 allowed cross site scripting attacks via javascript DOM modification using the supplied cookie param… |
CVE-2017-7434 | Low | 3.3 | 2018-03-02 | In the JDBC driver of NetIQ Identity Manager before 4.6 sending out incorrect XML configurations could result in passwords being logged into exception logfiles. |
CVE-2017-7429 | High | 8.8 | 2018-03-02 | The certificate upload in NetIQ eDirectory PKI plugin before 8.8.8 Patch 10 Hotfix 1 could be abused to upload JSP code which could be used by authenticated at… |
CVE-2017-7419 | Medium | 4.6 | 2018-03-02 | A OAuth application in NetIQ Access Manager 4.3 before 4.3.2 and 4.2 before 4.2.4 allowed cross site scripting attacks due to unescaped "description" field tha… |
CVE-2017-5189 | Medium | 4.3 | 2018-03-02 | NetIQ iManager before 3.0.3 delivered a SSL private key in a Java application (JAR file) for authentication to Sentinel, allowing attackers to extract and esta… |
CVE-2017-14802 | Medium | 5.4 | 2018-03-02 | Novell Access Manager Admin Console and IDP servers before 4.3.3 have a URL that could be used by remote attackers to trigger unvalidated redirects to third pa… |
CVE-2017-14801 | Medium | 4.6 | 2018-03-02 | Reflected XSS in the NetIQ Access Manager before 4.3.3 allowed attackers to reflect back xss into the called page using the url parameter. |
CVE-2017-7426 | Medium | 5.4 | 2018-03-01 | The NetIQ Identity Manager Plugins before 4.6.1 contained various XML External XML Entity (XXE) handling flaws that could be used by attackers to leak informat… |
CVE-2017-14800 | Medium | 5.4 | 2018-03-01 | A reflected cross site scripting attack in the NetIQ Access Manager before 4.3.3 using the "typecontainerid" parameter of the policy editor could allowed code… |
CVE-2017-14799 | Medium | 4.6 | 2018-03-01 | A cross site scripting attack in handling the ESP login parameter handling in NetIQ Access Manager before 4.3.3 could be used to inject javascript code into th… |
CVE-2018-1342 | Critical | 9.8 | 2018-01-26 | A Vulnerability exists on Admin Console where an attacker can upload files to the Admin Console server, and potentially execute them. This impacts NetIQ Access… |
CVE-2017-14803 | Critical | 9.8 | 2018-01-20 | In NetIQ Access Manager 4.3 and 4.4, a bug exists in Identity Server when accessing a basic SSO connector and downloading the BasicSSO connector plugins on IE1… |
CVE-2017-7425 | High | 7.6 | 2017-11-06 | Multiple potential reflected XSS issues exist in NetIQ iManager versions before 2.7.7 Patch 10 HF2 and 3.0.3.2. |
CVE-2017-7432 | Critical | 9.8 | 2017-05-03 | Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have a webshell upload vulnerability. |
CVE-2017-7431 | High | 8.8 | 2017-05-03 | Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have persistent CSRF in object management. |
CVE-2017-7430 | Medium | 6.1 | 2017-05-03 | Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have a persistent XSS vulnerability in Framework. |
CVE-2017-7428 | Medium | 5.3 | 2017-05-03 | NetIQ iManager 3.x before 3.0.3.1 has an issue in the renegotiation of connection parameters with Tomcat. |
CVE-2017-5186 | High | 7.5 | 2017-04-27 | Novell iManager 2.7 before SP7 Patch 9, NetIQ iManager 3.x before 3.0.2.1, Novell eDirectory 8.8.x before 8.8 SP8 Patch 9 Hotfix 2, and NetIQ eDirectory 9.x be… |
CVE-2017-5191 | Medium | 6.1 | 2017-04-24 | An XSS vulnerability on the /NAGErrors URI in NetIQ Access Manager 4.2 and 4.3 exists because Access Gateway Error pages do not validate the HTTP Referer heade… |
CVE-2017-5183 | Medium | 6.1 | 2017-04-20 | NetIQ Access Manager 4.2.2 and 4.3.x before 4.3.1+, when configured as an Identity Server, has XSS in the AssertionConsumerServiceURL field of a signed AuthnRe… |
CVE-2017-5190 | Low | 3.1 | 2017-04-20 | NetIQ Access Manager 4.2 before SP3 HF1 and 4.3 before SP1 HF1, when configured as a SAML 2.0 Identity Server with Virtual Attributes, has a concurrency issue… |
CVE-2016-5758 | High | 8.8 | 2017-03-23 | A cross site request forgery protection mechanism in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be circumvented by repeated upl… |
CVE-2016-5757 | Critical | 9.8 | 2017-03-23 | iManager Admin Console in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to iFrame manipulation attacks, which could allow… |
CVE-2016-5756 | Medium | 6.1 | 2017-03-23 | Multiple components of the web tools in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 were vulnerable to Reflected Cross Site Scripting… |
CVE-2016-5755 | Medium | 6.5 | 2017-03-23 | NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to clickjacking attacks due to a missing SAMEORIGIN filter in the "high enc… |
CVE-2016-5754 | High | 7.5 | 2017-03-23 | Presence of a .htaccess file could leak information in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before SP2. |
CVE-2016-5752 | High | 7.5 | 2017-03-23 | The SAML2 implementation in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 was handling unsigned SAML requests incorrectly… |
CVE-2016-5751 | Medium | 6.1 | 2017-03-23 | An unfiltered finalizer target URL in the SAML processing feature in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 could be… |
CVE-2016-5750 | High | 8.8 | 2017-03-23 | The certificate upload feature in iManager in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to upload JSP pages that would… |
CVE-2016-5749 | Medium | 5.5 | 2017-03-23 | NetIQ Access Manager 4.1 before 4.1.2 HF 1 and 4.2 before 4.2.2 was parsing incoming SAML requests with external entity resolution enabled, which could lead to… |
CVE-2016-5748 | Medium | 5.5 | 2017-03-23 | External Entity Processing (XXE) vulnerability in the "risk score" application of NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be… |
CVE-2016-1597 | High | 8.8 | 2017-03-23 | A logged-in user in NetIQ Access Governance Suite 6.0 through 6.4 could escalate privileges to administrator. |
CVE-2016-1592 | Medium | 6.1 | 2016-10-27 | XSS in NetIQ Designer for Identity Manager before 4.5.3 allows remote attackers to inject arbitrary HTML code via the nrfEntitlementReport.do CGI. |
CVE-2015-0787 | Medium | 6.1 | 2016-10-27 | XSS in NetIQ Designer for Identity Manager before 4.5.3 allows remote attackers to inject arbitrary HTML code via the accessMgrDN value of the forgotUser.do CG… |
CVE-2016-1605 | Medium | 6.5 | 2016-08-01 | Directory traversal vulnerability in the ReportViewServlet servlet in the server in NetIQ Sentinel 7.4.x before 7.4.2 allows remote attackers to read arbitrary… |
CVE-2014-4509 | | 2014-06-21 | The MKDQUOTESAFE function in the Fan-out driver scripts in Fan-Out Platform Services in Novell Identity Manager (aka IDM) 4.0.2 allows local users to execute a… | |
CVE-2007-4526 | | 2007-08-25 | The Client Login Extension (CLE) in Novell Identity Manager before 3.5.1 20070730 stores the username and password in a local file, which allows local users to… | |
CVE-2006-4803 | | 2006-09-14 | The Fan-Out Linux and UNIX receiver scripts in Novell Identity Manager (IDM) 3.0.1 allows local users to execute arbitrary commands via unspecified vectors inv… | |
CVE-2006-4506 | | 2006-08-31 | idmlib.sh in nxdrv in Novell Identity Manager (IDM) 3.0.1 allows local users to execute arbitrary commands via unspecified vectors, possibly involving the " (q… | |
CVE-2005-1244 | | 2005-04-20 | Directory traversal vulnerability in the third party tool from NetIQ, as used to secure the iSeries AS/400 FTP server, allows remote attackers to access arbitr… |