Vulnerabilities

In RSA Authentication Agent before 7.4.7, service paths and shortcut paths may be vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks.

RSA Authentication Manager before 8.7 SP2 Patch 1 allows XML External Entity (XXE) attacks via a license file, resulting in attacker-controlled files being stored on the product's server.

Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Windows user accounts to modify the endpoint agent service configuration: to either disable it complet…

Archer Platform 6.8 before 6.11 P3 (6.11.0.3) contains an improper API access control vulnerability in a multi-instance system that could potentially present unauthorized metadata to an authenticated user of the affected…

Archer Platform 6.9 SP2 P2 before 6.11 P3 (6.11.0.3) contain a reflected XSS vulnerability.

Archer Platform 6.x before 6.11 P3 contain an HTML injection vulnerability.

RSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a File with a Dangerous Type.

Archer Platform 6.3 before 6.11 (6.11.0.0) contains an Improper Access Control Vulnerability within SSO ADFS functionality that could potentially be exploited by malicious users to compromise the affected system.

The REST API in Archer Platform 6.x before 6.11 (6.11.0.0) contains an Authorization Bypass Vulnerability.

RSA Archer 6.x through 6.9 SP1 P4 (6.9.1.4) allows stored XSS.

In RSA Archer 6.x through 6.9 SP3 (6.9.3.0), an authenticated attacker can make a GET request to a REST API endpoint that is vulnerable to an Insecure Direct Object Reference (IDOR) issue and retrieve sensitive data.

In RSA Archer 6.9.SP1 P3, if some application functions are precluded by the Administrator, this can be bypassed by intercepting the API request at the /api/V2/internal/TaskPermissions/CheckTaskAccess endpoint.

Archer 6.x through 6.10 (6.10.0.0) contains a reflected XSS vulnerability.

Archer 6.x through 6.9 P2 (6.9.0.2) is affected by an open redirect vulnerability.

Archer 6.x through 6.9 SP2 P1 (6.9.2.1) contains an improper access control vulnerability on attachments.

The Archer RSS feed integration for Archer 6.x through 6.9 SP1 (6.9.1.0) is affected by an insecure credential storage vulnerability.

Archer 6.x through 6.9 SP3 (6.9.3.0) contains a reflected XSS vulnerability.

The Tableau integration in RSA Archer 6.4 P1 (6.4.0.1) through 6.9 P2 (6.9.0.2) is affected by an insecure credential storage vulnerability.

RSA Archer before 6.9 SP1 P1 (6.9.1.1) contains a stored XSS vulnerability.

Archer before 6.9 P1 (6.9.0.1) contains an improper access control vulnerability in an API.

Archer before 6.8 P2 (6.8.0.2) is affected by a path exposure vulnerability.

Archer before 6.8 P2 (6.8.0.2) is affected by an open redirect vulnerability.

Archer before 6.8 P4 (6.8.0.4) contains a stored XSS vulnerability.

RSA Archer 6.8 through 6.8.0.3 and 6.9 contains a URL injection vulnerability.

Authentication Bypass Vulnerability RSA MFA Agent 2.0 for Microsoft Windows contains an Authentication Bypass vulnerability.