Vulnerabilities > Netiq > Access Manager
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2017-03-23 | CVE-2016-5751 | Cross-site Scripting vulnerability in Netiq Access Manager 4.1/4.2 An unfiltered finalizer target URL in the SAML processing feature in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 could be used to trigger XSS and leak authentication credentials. | 6.1 |
| 2017-03-23 | CVE-2016-5750 | Improper Access Control vulnerability in Netiq Access Manager 4.1/4.2 The certificate upload feature in iManager in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to upload JSP pages that would be executed as the iManager user, allowing code execution by logged-in remote users. | 8.8 |
| 2017-03-23 | CVE-2016-5749 | XXE vulnerability in Netiq Access Manager 4.1/4.2 NetIQ Access Manager 4.1 before 4.1.2 HF 1 and 4.2 before 4.2.2 was parsing incoming SAML requests with external entity resolution enabled, which could lead to local file disclosure via an XML External Entity (XXE) attack. | 5.5 |
| 2017-03-23 | CVE-2016-5748 | XXE vulnerability in Netiq Access Manager 4.1/4.2 External Entity Processing (XXE) vulnerability in the "risk score" application of NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to disclose the content of local files to logged-in users. | 5.5 |