Vulnerabilities > EMC > RSA Adaptive Authentication ON Premise > Medium

DATE CVE VULNERABILITY TITLE RISK
2014-12-08 CVE-2014-4631 Improper Authentication vulnerability in EMC RSA Adaptive Authentication On-Premise 6.0.2.1/7.0/7.1
RSA Adaptive Authentication (On-Premise) 6.0.2.1 through 7.1 P3, when using device binding in a Challenge SOAP call or using the RSA Adaptive Authentication Integration Adapters with Out-of-Band Phone (Authentify) functionality, conducts permanent device binding even when authentication fails, which allows remote attackers to bypass authentication.
network
low complexity
emc CWE-287
5.0
2014-04-04 CVE-2014-0638 Cross-Site Scripting vulnerability in EMC RSA Adaptive Authentication On-Premise
Cross-site scripting (XSS) vulnerability in RSA Adaptive Authentication (On-Premise) 6.x and 7.x before 7.1 SP0 P2 allows remote attackers to inject arbitrary web script or HTML via vectors involving FRAME elements, related to a "cross-frame scripting" issue.
network
emc CWE-79
4.3
2014-04-04 CVE-2014-0637 Cross-Site Scripting vulnerability in EMC RSA Adaptive Authentication On-Premise
Cross-site scripting (XSS) vulnerability in the back-office case-management application in RSA Adaptive Authentication (On-Premise) 6.x and 7.x before 7.1 SP0 P2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
network
emc CWE-79
4.3
2012-11-27 CVE-2012-4611 Cross-Site Scripting vulnerability in EMC RSA Adaptive Authentication On-Premise
Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Adaptive Authentication On-Premise (AAOP) before 7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
network
emc CWE-79
4.3
2011-12-14 CVE-2011-2742 Permissions, Privileges, and Access Controls vulnerability in EMC RSA Adaptive Authentication On-Premise 6.0.2.1
EMC RSA Adaptive Authentication On-Premise (AAOP) 6.0.2.1 SP1 Patch 2, SP1 Patch 3, SP2, SP2 Patch 1, and SP3 does not properly perform forensic evaluation upon receipt of device tokens from mobile apps, which might allow remote attackers to bypass intended application restrictions via a mobile device.
network
emc CWE-264
6.8
2011-12-14 CVE-2011-2741 Permissions, Privileges, and Access Controls vulnerability in EMC RSA Adaptive Authentication On-Premise 6.0.2.1
EMC RSA Adaptive Authentication On-Premise (AAOP) 6.0.2.1 SP1 Patch 2, SP1 Patch 3, SP2, SP2 Patch 1, and SP3 does not properly implement Device Recovery and Device Identification, which might allow remote attackers to bypass intended security restrictions on a (1) previously non-registered device or (2) registered device by sending unspecified "data elements."
network
emc CWE-264
6.8
2011-04-22 CVE-2011-1422 Cross-Site Scripting vulnerability in EMC RSA Adaptive Authentication On-Premise
Cross-site scripting (XSS) vulnerability in an unspecified Shockwave Flash file in EMC RSA Adaptive Authentication On-Premise (AAOP) 2.x, 5.7.x, and 6.x allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
network
emc CWE-79
4.3