archer Archives - CVE Vulnerability

CVE-2020-29538

Sun, 26 Feb 2023 06:40:58 +0000

Archer before 6.9 P1 (6.9.0.1) contains an improper access control vulnerability in an API. A remote authenticated malicious administrative user can potentially exploit this vulnerability to gather information about the system, and may use this information in subsequent attacks.

The post CVE-2020-29538 appeared first on CVE Vulnerability.

CVE-2020-29537

Sun, 26 Feb 2023 06:40:58 +0000

Archer before 6.8 P2 (6.8.0.2) is affected by an open redirect vulnerability. A remote privileged attacker may potentially redirect legitimate users to arbitrary web sites and conduct phishing attacks. The attacker could then steal the victims’ credentials and silently authenticate them to the Archer application without the victims realizing an attack occurred.

The post CVE-2020-29537 appeared first on CVE Vulnerability.

CVE-2020-29536

Sun, 26 Feb 2023 06:40:58 +0000

Archer before 6.8 P2 (6.8.0.2) is affected by a path exposure vulnerability. A remote authenticated malicious attacker with access to service files may obtain sensitive information to use it in further attacks.

The post CVE-2020-29536 appeared first on CVE Vulnerability.

CVE-2020-29535

Sun, 26 Feb 2023 06:40:58 +0000

Archer before 6.8 P4 (6.8.0.4) contains a stored XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When application users access the corrupted data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application.

The post CVE-2020-29535 appeared first on CVE Vulnerability.

CVE-2021-41594

Thu, 23 Feb 2023 14:12:03 +0000

In RSA Archer 6.9.SP1 P3, if some application functions are precluded by the Administrator, this can be bypassed by intercepting the API request at the /api/V2/internal/TaskPermissions/CheckTaskAccess endpoint. If the parameters of this request are replaced with empty fields, the attacker achieves access to the precluded functions.

The post CVE-2021-41594 appeared first on CVE Vulnerability.

CVE-2021-38362

Thu, 23 Feb 2023 14:11:11 +0000

In RSA Archer 6.x through 6.9 SP3 (6.9.3.0), an authenticated attacker can make a GET request to a REST API endpoint that is vulnerable to an Insecure Direct Object Reference (IDOR) issue and retrieve sensitive data.

The post CVE-2021-38362 appeared first on CVE Vulnerability.

CVE-2021-33616

Thu, 23 Feb 2023 14:10:03 +0000

RSA Archer 6.x through 6.9 SP1 P4 (6.9.1.4) allows stored XSS.

The post CVE-2021-33616 appeared first on CVE Vulnerability.

CVE-2021-33615

Thu, 23 Feb 2023 14:10:03 +0000

RSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a File with a Dangerous Type.

The post CVE-2021-33615 appeared first on CVE Vulnerability.

CVE-2021-29252

Thu, 23 Feb 2023 14:08:57 +0000

RSA Archer before 6.9 SP1 P1 (6.9.1.1) contains a stored XSS vulnerability. A remote authenticated malicious Archer user with access to modify link name fields could potentially exploit this vulnerability to execute code in a victim’s browser.

The post CVE-2021-29252 appeared first on CVE Vulnerability.

CVE-2021-29253

Thu, 23 Feb 2023 14:08:57 +0000

The Tableau integration in RSA Archer 6.4 P1 (6.4.0.1) through 6.9 P2 (6.9.0.2) is affected by an insecure credential storage vulnerability. An malicious attacker with access to the Tableau workbook file may obtain access to credential information to use it in further attacks.

The post CVE-2021-29253 appeared first on CVE Vulnerability.