Broadcom Symantec Identity Governance And Administration vulnerabilities

CVE-2023-23949 [MEDIUM] CWE-79 CVE-2023-23949: An authenticated user can supply malicious HTML and JavaScript code that will be executed in the cli An authenticated user can supply malicious HTML and JavaScript code that will be executed in the client browser.

CVE-2023-23951 [MEDIUM] CWE-79 CVE-2023-23951: Ability to enumerate the Oracle LDAP attributes for the current user by modifying the query used by Ability to enumerate the Oracle LDAP attributes for the current user by modifying the query used by the application

CVE-2023-23950 [MEDIUM] CWE-79 CVE-2023-23950: User’s supplied input (usually a CRLF sequence) can be used to split a returning response into two r User’s supplied input (usually a CRLF sequence) can be used to split a returning response into two responses.

CVE-2022-25628 [HIGH] CWE-611 CVE-2022-25628: An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Id An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4

CVE-2022-25627 [MEDIUM] CWE-284 CVE-2022-25627: An authenticated administrator who has physical access to the environment can carry out Remote Comma An authenticated administrator who has physical access to the environment can carry out Remote Command Execution on Management Console in Symantec Identity Manager 14.4

CVE-2022-25626 [MEDIUM] CWE-425 CVE-2022-25626: An unauthenticated user can access Identity Manager’s management console specific page URLs. However An unauthenticated user can access Identity Manager’s management console specific page URLs. However, the system doesn’t allow the user to carry out server side tasks without a valid web session.