Broadcom: >> Symantec Identity Governance And Administration >> 14.3 Security Vulnerabilities
An authenticated user can supply malicious HTML and JavaScript code that will be executed in the client browser.
CVSS Score
5.4
EPSS Score
0.005
Published
2023-01-26
User’s supplied input (usually a CRLF sequence) can be used to split a returning response into two responses.
CVSS Score
6.1
EPSS Score
0.007
Published
2023-01-26
Ability to enumerate the Oracle LDAP attributes for the current user by modifying the query used by the application
CVSS Score
6.1
EPSS Score
0.006
Published
2023-01-26
An unauthenticated user can access Identity Manager’s management console specific page URLs. However, the system doesn’t allow the user to carry out server side tasks without a valid web session.
CVSS Score
5.3
EPSS Score
0.006
Published
2022-12-16
An authenticated administrator who has physical access to the environment can carry out Remote Command Execution on Management Console in Symantec Identity Manager 14.4
CVSS Score
6.7
EPSS Score
0.007
Published
2022-12-16
An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4
CVSS Score
8.8
EPSS Score
0.001
Published
2022-12-16