Symantec Privileged Access Management (Broadcom) - vulnerabilities (CVEs)
18 CVEs, 0 in the last 30 days, 21 known versions, newest CVE from 2025-01-30. Vendor: Broadcom.
CVEs of Symantec Privileged Access Management
- CVE-2025-24507 - CVSS 8.9 (high), 2025-01-30: This vulnerability allows appliance compromise at boot time.
- CVE-2025-24506 - CVSS 5.3 (medium), 2025-01-30: A specific authentication strategy allows to learn ids of PAM users associated with certain authentication types.
- CVE-2025-24505 - CVSS 8.8 (high), 2025-01-30: This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by uploading a specially…
- CVE-2025-24504 - CVSS 5.3 (medium), 2025-01-30: An improper input validation the CSRF filter results in unsanitized user input written to the application logs.
- CVE-2025-24503 - CVSS 9.3 (critical), 2025-01-30: A malicious actor can fix the session of a PAM user by tricking the user to click on a specially crafted link to the PAM server.
- CVE-2025-24501 - CVSS 5.3 (medium), 2025-01-30: An improper input validation allows an unauthenticated attacker to alter PAM logs by sending a specially crafted HTTP request.
- CVE-2025-24500 - CVSS 8.7 (high), 2025-01-30: The vulnerability allows an unauthenticated attacker to access information in PAM database.
- CVE-2025-24502 - CVSS 5.3 (medium), 2025-01-30: An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of an incorrect user by…
- CVE-2024-38495 - CVSS 5.3 (medium), 2024-07-15: A specific authentication strategy allows a malicious attacker to learn ids of all PAM users defined in its database.
- CVE-2024-38496 - CVSS 5.1 (medium), 2024-07-15: The vulnerability allows a malicious low-privileged PAM user to access information about other PAM users and their group memberships.
- CVE-2024-38492 - CVSS 9.4 (critical), 2024-07-15: This vulnerability allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by uploading a specially crafted PAM…
- CVE-2024-38491 - CVSS 8.4 (high), 2024-07-15: The vulnerability allows an unauthenticated attacker to read arbitrary information from the database.
- CVE-2024-38494 - CVSS 8.6 (high), 2024-07-15: This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by sending a specially…
- CVE-2024-36458 - CVSS 5.1 (medium), 2024-07-15: The vulnerability allows a malicious low-privileged PAM user to perform server upgrade related actions.
- CVE-2024-38493 - CVSS 6.8 (medium), 2024-07-15: A reflected cross-site scripting (XSS) vulnerability exists in the PAM UI web interface. A remote attacker able to convince a PAM user to click on a specially…
- CVE-2024-36457 - CVSS 5.3 (medium), 2024-07-15: The vulnerability allows an attacker to bypass the authentication requirements for a specific PAM endpoint.
- CVE-2024-36456 - CVSS 9.4 (critical), 2024-07-15: This vulnerability allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by uploading a specially crafted PAM…
- CVE-2024-36455 - CVSS 9.4 (critical), 2024-07-15: An improper input validation allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by sending a specially crafted…
- CVE-2022-25625 - CVSS 8.8 (high), 2022-08-26: A malicious unauthorized PAM user can access the administration configuration data and change the values.
