Rsa
87 CVEs across 41 Rsa products. Browse Rsa vulnerabilities, severities, and proof-of-concept exploits.
Rsa products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-47856 | Critical | 9.8 | 2025-11-24 | In RSA Authentication Agent before 7.4.7, service paths and shortcut paths may be vulnerable to path interception if the path has one or more spaces and is not… |
CVE-2024-25066 | Medium | 4.3 | 2025-02-17 | RSA Authentication Manager before 8.7 SP2 Patch 1 allows XML External Entity (XXE) attacks via a license file, resulting in attacker-controlled files being sto… |
CVE-2022-47529 | Medium | 6.7 | 2023-03-28 | Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Windows user accounts to modify the endpo… |
CVE-2022-37318 | High | 7.0 | 2022-08-25 | Archer Platform 6.9 SP2 P2 before 6.11 P3 (6.11.0.3) contain a reflected XSS vulnerability. A remote unauthenticated malicious Archer user could potentially ex… |
CVE-2022-37317 | High | 7.6 | 2022-08-25 | Archer Platform 6.x before 6.11 P3 contain an HTML injection vulnerability. An authenticated remote attacker could potentially exploit this vulnerability by tr… |
CVE-2022-37316 | Medium | 6.5 | 2022-08-25 | Archer Platform 6.8 before 6.11 P3 (6.11.0.3) contains an improper API access control vulnerability in a multi-instance system that could potentially present u… |
CVE-2021-33615 | High | 7.5 | 2022-06-02 | RSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a File with a Dangerous Type. |
CVE-2022-30585 | Medium | 6.5 | 2022-05-26 | The REST API in Archer Platform 6.x before 6.11 (6.11.0.0) contains an Authorization Bypass Vulnerability. A remote authenticated malicious user could potentia… |
CVE-2022-30584 | Critical | 9.6 | 2022-05-26 | Archer Platform 6.3 before 6.11 (6.11.0.0) contains an Improper Access Control Vulnerability within SSO ADFS functionality that could potentially be exploited… |
CVE-2021-33616 | Medium | 5.4 | 2022-04-04 | RSA Archer 6.x through 6.9 SP1 P4 (6.9.1.4) allows stored XSS. |
CVE-2021-38362 | Medium | 6.5 | 2022-03-30 | In RSA Archer 6.x through 6.9 SP3 (6.9.3.0), an authenticated attacker can make a GET request to a REST API endpoint that is vulnerable to an Insecure Direct O… |
CVE-2022-26951 | Medium | 6.5 | 2022-03-30 | Archer 6.x through 6.10 (6.10.0.0) contains a reflected XSS vulnerability. A remote SAML-unauthenticated malicious Archer user could potentially exploit this v… |
CVE-2022-26950 | Medium | 5.4 | 2022-03-30 | Archer 6.x through 6.9 P2 (6.9.0.2) is affected by an open redirect vulnerability. A remote unprivileged attacker may potentially redirect legitimate users to… |
CVE-2022-26949 | Medium | 5.3 | 2022-03-30 | Archer 6.x through 6.9 SP2 P1 (6.9.2.1) contains an improper access control vulnerability on attachments. A remote authenticated malicious user could potential… |
CVE-2022-26948 | Medium | 5.8 | 2022-03-30 | The Archer RSS feed integration for Archer 6.x through 6.9 SP1 (6.9.1.0) is affected by an insecure credential storage vulnerability. A malicious attacker may… |
CVE-2022-26947 | Medium | 6.3 | 2022-03-30 | Archer 6.x through 6.9 SP3 (6.9.3.0) contains a reflected XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulner… |
CVE-2021-41594 | Medium | 6.5 | 2022-03-30 | In RSA Archer 6.9.SP1 P3, if some application functions are precluded by the Administrator, this can be bypassed by intercepting the API request at the /api/V2… |
CVE-2021-29253 | Medium | 5.1 | 2021-05-26 | The Tableau integration in RSA Archer 6.4 P1 (6.4.0.1) through 6.9 P2 (6.9.0.2) is affected by an insecure credential storage vulnerability. An malicious attac… |
CVE-2021-29252 | Medium | 5.4 | 2021-05-26 | RSA Archer before 6.9 SP1 P1 (6.9.1.1) contains a stored XSS vulnerability. A remote authenticated malicious Archer user with access to modify link name fields… |
CVE-2020-29538 | Medium | 4.9 | 2021-01-29 | Archer before 6.9 P1 (6.9.0.1) contains an improper access control vulnerability in an API. A remote authenticated malicious administrative user can potentiall… |
CVE-2020-29537 | Medium | 4.6 | 2021-01-29 | Archer before 6.8 P2 (6.8.0.2) is affected by an open redirect vulnerability. A remote privileged attacker may potentially redirect legitimate users to arbitra… |
CVE-2020-29536 | Medium | 4.3 | 2021-01-29 | Archer before 6.8 P2 (6.8.0.2) is affected by a path exposure vulnerability. A remote authenticated malicious attacker with access to service files may obtain… |
CVE-2020-29535 | Medium | 5.3 | 2021-01-29 | Archer before 6.8 P4 (6.8.0.4) contains a stored XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability t… |
CVE-2020-26884 | Medium | 6.1 | 2020-11-18 | RSA Archer 6.8 through 6.8.0.3 and 6.9 contains a URL injection vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability… |
CVE-2020-5384 | High | 8.4 | 2020-07-31 | Authentication Bypass Vulnerability RSA MFA Agent 2.0 for Microsoft Windows contains an Authentication Bypass vulnerability. A local unauthenticated attacker c… |
CVE-2020-5337 | Medium | 4.6 | 2020-05-04 | RSA Archer, versions prior to 6.7 P1 (6.7.0.1), contain a URL redirection vulnerability. A remote unauthenticated attacker could potentially exploit this vulne… |
CVE-2020-5336 | Medium | 4.6 | 2020-05-04 | RSA Archer, versions prior to 6.7 P1 (6.7.0.1), contain a URL injection vulnerability. An unauthenticated attacker could potentially exploit this vulnerability… |
CVE-2020-5335 | Medium | 5.0 | 2020-05-04 | RSA Archer, versions prior to 6.7 P2 (6.7.0.2), contain a cross-site request forgery vulnerability. A remote unauthenticated attacker could potentially exploit… |
CVE-2020-5334 | High | 8.2 | 2020-05-04 | RSA Archer, versions prior to 6.7 P2 (6.7.0.2), contains a Document Object Model (DOM) based cross-site scripting vulnerability. A remote unauthenticated attac… |
CVE-2020-5333 | Medium | 4.3 | 2020-05-04 | RSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain an authorization bypass vulnerability in the REST API. A remote authenticated malicious Archer user cou… |
CVE-2020-5332 | High | 7.2 | 2020-05-04 | RSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain a command injection vulnerability. AN authenticated malicious user with administrator privileges could… |
CVE-2020-5331 | High | 8.8 | 2020-05-04 | RSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain an information exposure vulnerability. Users’ session information could potentially be stored in cache… |
CVE-2019-18574 | Medium | 4.8 | 2019-12-03 | RSA Authentication Manager software versions prior to 8.4 P8 contain a stored cross-site scripting vulnerability in the Security Console. A malicious Security… |
CVE-2019-3758 | Critical | 9.8 | 2019-09-18 | RSA Archer, versions prior to 6.6 P2 (6.6.0.2), contain an improper authentication vulnerability. The vulnerability allows sysadmins to create user accounts wi… |
CVE-2019-3756 | Medium | 6.5 | 2019-09-18 | RSA Archer, versions prior to 6.6 P3 (6.6.0.3), contain an information disclosure vulnerability. Information relating to the backend database gets disclosed to… |
CVE-2019-3725 | Critical | 9.8 | 2019-05-15 | RSA Netwitness Platform versions prior to 11.2.1.1 and RSA Security Analytics versions prior to 10.6.6.1 are vulnerable to a Command Injection vulnerability du… |
CVE-2019-3724 | Medium | 6.5 | 2019-05-15 | RSA Netwitness Platform versions prior to 11.2.1.1 is vulnerable to an Authorization Bypass vulnerability. A remote low privileged attacker could potentially e… |
CVE-2019-3716 | High | 7.8 | 2019-03-13 | RSA Archer versions, prior to 6.5 SP2, contain an information exposure vulnerability. The database connection password may get logged in plain text in the RSA… |
CVE-2019-3715 | High | 7.8 | 2019-03-13 | RSA Archer versions, prior to 6.5 SP1, contain an information exposure vulnerability. Users' session information is logged in plain text in the RSA Archer log… |
CVE-2019-3711 | Medium | 5.8 | 2019-03-13 | RSA Authentication Manager versions prior to 8.4 P1 contain an Insecure Credential Management Vulnerability. A malicious Operations Console administrator may b… |
CVE-2018-15782 | High | 7.7 | 2019-01-16 | The Quick Setup component of RSA Authentication Manager versions prior to 8.4 is vulnerable to a relative path traversal vulnerability. A local attacker could… |
CVE-2018-15780 | Medium | 4.3 | 2019-01-03 | RSA Archer versions prior to 6.5.0.1 contain an improper access control vulnerability. A remote malicious user could potentially exploit this vulnerability to… |
CVE-2018-11075 | Medium | 5.8 | 2018-09-28 | RSA Authentication Manager versions prior to 8.3 P3 contain a reflected cross-site scripting vulnerability in a Security Console page. A remote, unauthenticate… |
CVE-2018-11074 | Medium | 6.1 | 2018-09-28 | RSA Authentication Manager versions prior to 8.3 P3 are affected by a DOM-based cross-site scripting vulnerability which exists in its embedded MadCap Flare He… |
CVE-2018-11073 | Medium | 6.5 | 2018-09-28 | RSA Authentication Manager versions prior to 8.3 P3 contain a stored cross-site scripting vulnerability in the Operations Console. A malicious Operations Conso… |
CVE-2018-11058 | Critical | 9.8 | 2018-09-14 | RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition, version prior to 4.0.5… |
CVE-2018-11057 | Medium | 5.9 | 2018-08-31 | RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x) contains a Covert Timing Channel vulnerability during RSA de… |
CVE-2018-11056 | Medium | 6.5 | 2018-08-31 | RSA BSAFE Micro Edition Suite, prior to 4.1.6.1 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition versions prior to 4.0.5.3 (in 4.0.x) contain an Uncontrolled R… |
CVE-2018-11055 | Medium | 5.5 | 2018-08-31 | RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x), contains an Improper Clearing of Heap Memory Before Release… |
CVE-2018-11054 | High | 7.5 | 2018-08-31 | RSA BSAFE Micro Edition Suite, version 4.1.6, contains an integer overflow vulnerability. A remote attacker could use maliciously constructed ASN.1 data to pot… |
CVE-2018-11065 | Low | 2.7 | 2018-08-24 | The WorkPoint component, which is embedded in all RSA Archer, versions 6.1.x, 6.2.x, 6.3.x prior to 6.3.0.7 and 6.4.x prior to 6.4.0.1, contains a SQL injectio… |
CVE-2018-11060 | High | 8.8 | 2018-07-24 | RSA Archer, versions prior to 6.4.0.1, contain an authorization bypass vulnerability in the REST API. A remote authenticated malicious Archer user could potent… |
CVE-2018-11059 | High | 8.2 | 2018-07-24 | RSA Archer, versions prior to 6.4.0.1, contain a stored cross-site scripting vulnerability. A remote authenticated malicious Archer user could potentially expl… |
CVE-2018-1255 | Medium | 6.1 | 2018-07-13 | RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains a reflected cross-site scripting vulnerability. A remote unauthenticated attacke… |
CVE-2018-1245 | Critical | 9.0 | 2018-07-13 | RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains an authorization bypass vulnerability within the workflow architect component (A… |
CVE-2018-11049 | High | 7.3 | 2018-07-11 | RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG releases have an uncontrolled search vulnerability. The installation scrip… |
CVE-2018-11051 | High | 7.5 | 2018-07-03 | RSA Certificate Manager Versions 6.9 build 560 through 6.9 build 564 contain a path traversal vulnerability in the RSA CMP Enroll Server and the RSA REST Enrol… |
CVE-2018-1254 | Medium | 6.1 | 2018-06-21 | RSA Authentication Manager Security Console, versions 8.3 P1 and earlier, contains a reflected cross-site scripting vulnerability. A remote unauthenticated att… |
CVE-2018-1253 | Medium | 6.1 | 2018-06-21 | RSA Authentication Manager Operation Console, versions 8.3 P1 and earlier, contains a stored cross-site scripting vulnerability. A malicious Operations Console… |
CVE-2018-1252 | High | 8.8 | 2018-06-05 | RSA Web Threat Detection versions prior to 6.4, contain an SQL injection vulnerability in the Administration and Forensics applications. An authenticated malic… |
CVE-2018-1248 | Medium | 6.1 | 2018-05-08 | RSA Authentication Manager Security Console, Operation Console and Self-Service Console, version 8.3 and earlier, is affected by a Host header injection vulner… |
CVE-2018-1247 | High | 7.1 | 2018-05-08 | RSA Authentication Manager Security Console, version 8.3 and earlier, contains a XML External Entity (XXE) vulnerability. This could potentially allow admin us… |
CVE-2018-1234 | Medium | 5.5 | 2018-03-30 | RSA Authentication Agent version 8.0.1 and earlier for Web for IIS is affected by a problem where access control list (ACL) permissions on a Windows Named Pipe… |
CVE-2018-1233 | Medium | 6.1 | 2018-03-30 | RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are affected by a cross-site scripting vulnerability. The attacke… |
CVE-2018-1232 | High | 7.5 | 2018-03-30 | RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are impacted by a stack-based buffer overflow which may occur whe… |
CVE-2018-1182 | High | 7.8 | 2018-03-08 | An issue was discovered in EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels (hardware appliance and software bundle deployment… |
CVE-2017-14377 | Critical | 9.8 | 2017-11-29 | EMC RSA Authentication Agent for Web: Apache Web Server version 8.0 and RSA Authentication Agent for Web: Apache Web Server version 8.0.1 prior to Build 618 ha… |
CVE-2017-14372 | Medium | 6.1 | 2017-10-11 | RSA Archer GRC Platform prior to 6.2.0.5 is affected by reflected cross-site scripting vulnerabilities via certain RSA Archer Help pages. Attackers could poten… |
CVE-2017-14371 | Medium | 6.1 | 2017-10-11 | RSA Archer GRC Platform prior to 6.2.0.5 is affected by reflected cross-site scripting via the request URL. Attackers could potentially exploit this to execute… |
CVE-2017-14370 | Medium | 5.4 | 2017-10-11 | RSA Archer GRC Platform prior to 6.2.0.5 is affected by stored cross-site scripting via the Source Asset ID field. An authenticated attacker may potentially ex… |
CVE-2017-14369 | Medium | 4.3 | 2017-10-11 | RSA Archer GRC Platform prior to 6.2.0.5 is affected by a privilege escalation vulnerability. A low privileged RSA Archer user may potentially exploit this vul… |
CVE-2017-8005 | Medium | 5.4 | 2017-07-17 | The EMC RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG products (RSA Identity Governance and Lifecycle versions 7.0.1, 7… |
CVE-2017-8004 | High | 7.2 | 2017-07-17 | The EMC RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance and RSA IMG products (RSA Identity Governance and Lifecycle versions 7.0.1, 7.0… |
CVE-2017-5004 | Medium | 5.4 | 2017-06-09 | EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2 (all patch levels); RSA Via Lifecycle and Governance version 7.0 (all patch levels); and RSA Id… |
CVE-2017-5003 | Medium | 6.1 | 2017-06-09 | EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2 (all patch levels); RSA Via Lifecycle and Governance version 7.0 (all patch levels); and RSA Id… |
CVE-2017-4978 | Medium | 5.4 | 2017-05-19 | EMC RSA Adaptive Authentication (On-Premise) versions prior to 7.3 P2 (exclusive) contains a fix for a cross-site scripting vulnerability that could potentiall… |
CVE-2016-0919 | Medium | 6.1 | 2017-02-03 | EMC RSA Web Threat Detection version 5.0, RSA Web Threat Detection version 5.1, RSA Web Threat Detection version 5.1.2 has a cross site scripting vulnerability… |
CVE-2015-6851 | Medium | 6.7 | 2015-12-23 | EMC RSA SecurID Web Agent before 8.0 allows physically proximate attackers to bypass the privacy-screen protection mechanism by leveraging an unattended workst… |
CVE-2015-4548 | | 2015-10-12 | EMC RSA Web Threat Detection before 5.1 SP1 allows local users to obtain root privileges by leveraging access to a service account and writing commands to a se… | |
CVE-2015-4547 | | 2015-10-12 | EMC RSA Web Threat Detection before 5.1 SP1 stores a cleartext AnnoDB password in a configuration file, which allows remote authenticated users to obtain sensi… | |
CVE-2015-0541 | | 2015-06-05 | Cross-site request forgery (CSRF) vulnerability in EMC RSA Web Threat Detection before 5.1 allows remote attackers to hijack the authentication of arbitrary us… | |
CVE-2014-4627 | High | 8.8 | 2014-11-07 | SQL injection vulnerability in EMC RSA Web Threat Detection 4.x before 4.6.1.1 allows remote authenticated users to execute arbitrary SQL commands via unspecif… |
CVE-2013-3273 | | 2013-07-08 | EMC RSA Authentication Manager 8.0 before P2 and 7.1 before SP4 P26, as used in Appliance 3.0, does not omit the cleartext administrative password from trace l… | |
CVE-2013-0947 | | 2013-06-07 | EMC RSA Authentication Manager 8.0 before P1 allows local users to discover cleartext operating-system passwords, HTTP plug-in proxy passwords, and SNMP commun… | |
CVE-2013-0941 | | 2013-05-22 | EMC RSA Authentication API before 8.1 SP1, RSA Web Agent before 5.3.5 for Apache Web Server, RSA Web Agent before 5.3.5 for IIS, RSA PAM Agent before 7.0, and… | |
CVE-2013-0931 | | 2013-03-05 | EMC RSA Authentication Agent 7.1.x before 7.1.2 on Windows does not enforce the Quick PIN Unlock timeout feature, which allows physically proximate attackers t… | |
CVE-2012-2280 | | 2012-07-13 | EMC RSA Authentication Manager 7.1 before SP4 P14 and RSA SecurID Appliance 3.0 before SP4 P14 do not properly use frames, which allows remote attackers to inj… | |
CVE-2012-2279 | | 2012-07-13 | Open redirect vulnerability in the Security Console in EMC RSA Authentication Manager 7.1 before SP4 P14 and RSA SecurID Appliance 3.0 before SP4 P14 allows re… | |
CVE-2012-2278 | | 2012-07-13 | Multiple cross-site scripting (XSS) vulnerabilities in the (1) Self-Service Console and (2) Security Console in EMC RSA Authentication Manager 7.1 before SP4 P… | |
CVE-2012-2281 | | 2012-07-05 | EMC RSA Access Manager Server 6.x before 6.1 SP4 and RSA Access Manager Agent do not properly validate session tokens after a logout, which might allow remote… | |
CVE-2012-0403 | | 2012-03-20 | Directory traversal vulnerability in EMC RSA enVision 4.x before 4.1 Patch 4 allows remote authenticated users to have an unspecified impact via unknown vector… | |
CVE-2012-0402 | | 2012-03-20 | EMC RSA enVision 4.x before 4.1 Patch 4 uses unspecified hardcoded credentials, which makes it easier for remote attackers to obtain access via unknown vectors. | |
CVE-2012-0401 | | 2012-03-20 | Multiple SQL injection vulnerabilities in EMC RSA enVision 4.x before 4.1 Patch 4 allow remote authenticated users to execute arbitrary SQL commands via unspec… | |
CVE-2012-0400 | | 2012-03-20 | EMC RSA enVision 4.x before 4.1 Patch 4 does not properly restrict the number of failed authentication attempts, which makes it easier for remote attackers to… | |
CVE-2012-0399 | | 2012-03-20 | Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA enVision 4.x before 4.1 Patch 4 allow remote attackers to inject arbitrary web script or HTML vi… | |
CVE-2012-0397 | | 2012-03-06 | Buffer overflow in EMC RSA SecurID Software Token Converter before 2.6.1 allows remote attackers to cause a denial of service or possibly execute arbitrary cod… | |
CVE-2011-4143 | | 2012-01-27 | EMC RSA enVision 4.0 before SP4 P5 and 4.1 before P3 allows remote attackers to obtain sensitive information about environment variables in the web system via… | |
CVE-2011-4141 | | 2011-12-17 | Untrusted search path vulnerability in EMC RSA SecurID Software Token 4.1 before 4.1.1 allows local users to gain privileges via a Trojan horse DLL in the curr… | |
CVE-2011-2737 | | 2011-08-25 | RSA enVision 3.x and 4.x before 4 SP4 P3 allows remote attackers to read arbitrary files via unspecified vectors, related to an "arbitrary file retrieval vulne… | |
CVE-2011-2736 | | 2011-08-25 | RSA enVision 4.x before 4 SP4 P3 places cleartext administrative credentials in Task Escalation e-mail messages, which allows remote attackers to obtain sensit… |