RSA Authentication Manager any version

DSA-2018-226: RSA® Authentication Manager Relative Path Traversal Vulnerability

DSA-2019-038: RSA® Authentication Manager Insecure Credential Management Vulnerability

RSA Authentication Manager Security Console, version 8.3 and earlier, contains a XML External Entity (XXE) vulnerability. This could potentially allow admin users to cause a denial of service or extract server data via injecting a maliciously crafted DTD in an XML file submitted to the application.

DSA-2018-152: RSA® Authentication Manager Multiple Vulnerabilities

DSA-2018-152: RSA® Authentication Manager Multiple Vulnerabilities

RSA Authentication Manager Security Console, Operation Console and Self-Service Console, version 8.3 and earlier, is affected by a Host header injection vulnerability. This could allow a remote attacker to potentially poison HTTP cache and subsequently redirect users to arbitrary web domains.

DSA-2018-152: RSA® Authentication Manager Multiple Vulnerabilities

RSA Authentication Manager software versions prior to 8.4 P8 contain a stored cross-site scripting vulnerability in the Security Console. A malicious Security Console administrator could exploit this vulnerability to store arbitrary HTML or JavaScript code through the web interface which could then be included in a report. When other Security Console administrators open the affected report, the injected scripts could potentially be executed in their browser.