NetIQ Identity Manager Driver Component Information Leakage

The NetIQ Identity Manager driver log file, in versions prior to 4.7, provides details that could aid in system enumeration.

NetIQ Identity Manager Driver Component Log File Information Leakage

The NetIQ Identity Manager driver log file, in versions prior to 4.7, provides details that could aid in system or configuration enumeration.

NetIQ Identity Manager SSL Renegotiation

NetIQ Identity Manager driver, in versions prior to 4.7, allows for an SSL handshake renegotiation which could result in a MITM attack.

NetIQ iManager, versions prior to 3.1, reflected XSS issue

The administrative web interface in NetIQ iManager, versions prior to 3.1, are vulnerable to reflected cross site scripting.

NetIQ eDirectory Denial of Service

Addresses denial of service attack to eDirectory versions prior to 9.1.

iManager elevation of privilege

NetIQ iManager, versions prior to 3.1, under some circumstances could be susceptible to an elevation of privilege attack.

NetIQ iManager Communication Downgrade Attack

Addresses potential communication downgrade attack in NetIQ iManager versions prior to 3.1

PAM exposure enabling unauthenticated access to remote host

A Vulnerability exists on Admin Console where an attacker can upload files to the Admin Console server, and potentially execute them. This impacts NetIQ Access Manager versions 4.3 and 4.4 as well as the Administrative console.

NetIQ iManager XSS vulnerabilities

NetIQ iManager 3.1.1 addresses potential XSS vulnerabilities.

Certificate Revocation Check failure

Fixed issues with NetIQ eDirectory prior to 9.1.1 when checking certificate revocation.

Login restrictions not applied when using ebaclient against NetIQ eDirectory EBA interface

NetIQ eDirectory before 9.0 SP4 did not enforce login restrictions when "ebaclient" was used, allowing unpermitted access to eDirectory services.

IDM 4.6 Identity Applications information leakage

IDM 4.6 Identity Applications prior to 4.6.2.1 may expose sensitive information.

Novell Identity Manager User Application get request url contains the session token.

Some NetIQ Identity Manager Applications before Identity Manager 4.5.6.1 included the session token in GET URLs, potentially allowing exposure of user sessions to untrusted third parties via proxies, referer urls or similar.

NetIQ Identity Manager allowed uploading of user icons with incorrect types or extensions

NetIQ Identity Manager before 4.5.6.1 allowed uploading files with double extensions or non-image content in the Themes handling of the User Application Administration, allowing malicious user administrators to potentially execute code or mislead users.

Avoid password disclosure via EBS event logging in the iManager Oracle driver

The NetIQ Identity Manager Oracle EBS driver before 4.0.2.0 sent EBS logs containing the driver authentication password, potentially disclosing this to attackers able to read the EBS tables.

XSS Vulnerability in iManager

Novell Access Manager iManager before 4.3.3 did not validate parameters so that cross site scripting content could be reflected back into the result page using the "a" parameter.

NetIQ Identity Reporting XSS exposure

NetIQ Identity Reporting, in versions prior to 5.5 Service Pack 1, is susceptible to an XSS attack.

DOM cross site scripting attack against NetIQ Privileged Account Manager

NetIQ Privileged Account Manager before 3.1 Patch Update 3 allowed cross site scripting attacks via javascript DOM modification using the supplied cookie parameter.

Cross site scripting attacks against NetIQ Privileged Account Manager

NetIQ Privileged Account Manager before 3.1 Patch Update 3 allowed cross site scripting attacks via the "type" and "account" parameters of json requests.