Mohit Rawat

The issue exists due to insufficient input validation in the Identity Console component of Oracle Identity Manager. This can be exploited by a remote attacker to create, delete, or modify access to critical data using the HTTP protocol. Successful attacks may significantly impact additional products and can result in unauthorized access to critical data or complete access to all Identity Manager accessible data, as well as unauthorized update, insert, or delete access to some of Identity Manager accessible data.

The issue allows for cross-site scripting (XSS) attacks by exploiting a crafted name field on the /profile page, which is then mishandled on the /admin/users page. This enables any malicious user with limited access to store an XSS payload in their name field. When an administrator views this information, the XSS payload is triggered.

An issue in Cloudera Manager allows for potential cross-site scripting (XSS) due to the lack of validation of the `returnUrl` parameter. This parameter is used to redirect the user to another page in Cloudera Manager after completing a wizard. As a result, an attacker could redirect the user to an external site or execute malicious JavaScript functions. The fix involves restricting the `returnUrl` parameter to prevent external redirects, with exceptions for explicitly configured SAML Login/Logout URLs.

The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session.

The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session.

The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session.

A cross-site scripting (XSS) issue allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. This can lead to the execution of malicious code on the user's browser.