Priority LOW 30
Archer Platform 6.8 before 6.11 P3 (6.11.0.3) contains an improper API access control vulnerability in a multi-instance system that could potentially present unauthorized metadata to an authenticated user of the affected…
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00701 · Published 2022-08-25 · No fix listed
Priority LOW 31
Archer Platform 6.9 SP2 P2 before 6.11 P3 (6.11.0.3) contain a reflected XSS vulnerability.
CVSS 3.1HIGH 7.0· Network · No auth · No interaction · EPSS 0.00522 · Published 2022-08-25 · No fix listed CWE-79
Priority LOW 34
Archer Platform 6.x before 6.11 P3 contain an HTML injection vulnerability.
CVSS 3.1HIGH 7.6· Network · Low privileges · No interaction · EPSS 0.00701 · Published 2022-08-25 · No fix listed CWE-79
Priority LOW 36
RSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a File with a Dangerous Type.
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.01371 · Published 2022-06-02 · No fix listed CWE-434
Priority MEDIUM 43
Archer Platform 6.3 before 6.11 (6.11.0.0) contains an Improper Access Control Vulnerability within SSO ADFS functionality that could potentially be exploited by malicious users to compromise the affected system.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.01053 · Published 2022-05-26 · No fix listed
Priority LOW 31
The REST API in Archer Platform 6.x before 6.11 (6.11.0.0) contains an Authorization Bypass Vulnerability.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00907 · Published 2022-05-26 · No fix listed
Priority LOW 26
RSA Archer 6.x through 6.9 SP1 P4 (6.9.1.4) allows stored XSS.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.0075 · Published 2022-04-04 · No fix listed CWE-79
Priority LOW 31
In RSA Archer 6.x through 6.9 SP3 (6.9.3.0), an authenticated attacker can make a GET request to a REST API endpoint that is vulnerable to an Insecure Direct Object Reference (IDOR) issue and retrieve sensitive data.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00982 · Published 2022-03-30 · No fix listed CWE-639
Priority LOW 30
In RSA Archer 6.9.SP1 P3, if some application functions are precluded by the Administrator, this can be bypassed by intercepting the API request at the /api/V2/internal/TaskPermissions/CheckTaskAccess endpoint.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00785 · Published 2022-03-29 · No fix listed
Priority LOW 30
Archer 6.x through 6.10 (6.10.0.0) contains a reflected XSS vulnerability.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00568 · Published 2022-03-29 · No fix listed CWE-79
Priority LOW 28
Archer 6.x through 6.9 P2 (6.9.0.2) is affected by an open redirect vulnerability.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00552 · Published 2022-03-29 · No fix listed CWE-601
Priority LOW 31
Archer 6.x through 6.9 SP2 P1 (6.9.2.1) contains an improper access control vulnerability on attachments.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00953 · Published 2022-03-29 · No fix listed
Priority LOW 34
The Archer RSS feed integration for Archer 6.x through 6.9 SP1 (6.9.1.0) is affected by an insecure credential storage vulnerability.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00586 · Published 2022-03-29 · No fix listed CWE-522
Priority LOW 29
Archer 6.x through 6.9 SP3 (6.9.3.0) contains a reflected XSS vulnerability.
CVSS 3.1MEDIUM 6.3· Network · Low privileges · User interaction · EPSS 0.00634 · Published 2022-03-29 · No fix listed CWE-79
Priority LOW 24
The Tableau integration in RSA Archer 6.4 P1 (6.4.0.1) through 6.9 P2 (6.9.0.2) is affected by an insecure credential storage vulnerability.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00201 · Published 2021-05-26 · No fix listed CWE-522
Priority LOW 26
RSA Archer before 6.9 SP1 P1 (6.9.1.1) contains a stored XSS vulnerability.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00812 · Published 2021-05-26 · No fix listed CWE-79
Priority LOW 24
Archer before 6.9 P1 (6.9.0.1) contains an improper access control vulnerability in an API.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.00981 · Published 2021-01-29 · No fix listed
Priority LOW 21
Archer before 6.8 P2 (6.8.0.2) is affected by a path exposure vulnerability.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00544 · Published 2021-01-29 · No fix listed CWE-327
Priority LOW 26
Archer before 6.8 P2 (6.8.0.2) is affected by an open redirect vulnerability.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00816 · Published 2021-01-29 · No fix listed CWE-601
Priority LOW 26
Archer before 6.8 P4 (6.8.0.4) contains a stored XSS vulnerability.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.0082 · Published 2021-01-29 · No fix listed CWE-79
Priority LOW 29
RSA Archer 6.8 through 6.8.0.3 and 6.9 contains a URL injection vulnerability.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00833 · Published 2020-11-18 · No fix listed CWE-74
Priority LOW 29
RSA Archer, versions prior to 6.7 P1 (6.7.0.1), contain a URL redirection vulnerability.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00754 · Published 2020-05-04 · Fixed in 6.7 P1 CWE-601
Priority LOW 28
RSA Archer, versions prior to 6.7 P1 (6.7.0.1), contain a URL injection vulnerability.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00705 · Published 2020-05-04 · Fixed in 6.7 P1 CWE-79
Priority LOW 38
RSA Archer, versions prior to 6.7 P2 (6.7.0.2), contain a cross-site request forgery vulnerability.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00457 · Published 2020-05-04 · Fixed in 6.7 P2 CWE-352
Priority LOW 37
RSA Archer, versions prior to 6.7 P2 (6.7.0.2), contains a Document Object Model (DOM) based cross-site scripting vulnerability.
CVSS 3.1HIGH 8.2· Network · Low privileges · User interaction · EPSS 0.00862 · Published 2020-05-04 · Fixed in 6.7 P2 CWE-79
Load more
THREATIST.IORead the docs