RSA vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2024-47856 In RSA Authentication Agent before 7.4.7, service paths and shortcut paths may be vulnerable to path interception if the path has one or more spaces and is not Critical 9.8 · Nov 24, 2025
• CVE-2024-28058 In RSA NetWitness (NW) Platform before 12.5.1, even when an administrator revokes the access of a specific user with an active session, an internal threat actorHigh 7.5 · Nov 18, 2024
• CVE-2022-37318 Archer Platform 6.9 SP2 P2 before 6.11 P3 (6.11.0.3) contain a reflected XSS vulnerability.High 7 · Aug 25, 2022
• CVE-2022-37317 Archer Platform 6.x before 6.11 P3 contain an HTML injection vulnerability.High 7.6 · Aug 25, 2022
• CVE-2021-33615 RSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a File with a Dangerous Type.High 7.5 · Jun 2, 2022
• CVE-2022-30584 Archer Platform 6.3 before 6.11 (6.11.0.0) contains an Improper Access Control Vulnerability within SSO ADFS functionality that could potentially be exploited bCritical 9.6 · May 26, 2022
• CVE-2019-3725 RSA Netwitness Platform versions prior to 11.2.1.1 and RSA Security Analytics versions prior to 10.6.6.1 are vulnerable to a Command Injection vulnerability dueCritical 9.8 · May 15, 2019
• CVE-2018-11058 RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition, version prior to 4.0.5.3Critical 9.8 · Sep 14, 2018
• CVE-2018-11054 RSA BSAFE Micro Edition Suite, version 4.1.6, contains an integer overflow vulnerability.High 7.5 · Aug 31, 2018
• CVE-2018-1245 RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains an authorization bypass vulnerability within the workflow architect component (ACCritical 9 · Jul 13, 2018
• CVE-2018-11051 RSA Certificate Manager Versions 6.9 build 560 through 6.9 build 564 contain a path traversal vulnerability in the RSA CMP Enroll Server and the RSA REST EnrollHigh 7.5 · Jul 3, 2018
• CVE-2018-1252 RSA Web Threat Detection versions prior to 6.4, contain an SQL injection vulnerability in the Administration and Forensics applications.High 8.8 · Jun 5, 2018
• CVE-2017-14377 EMC RSA Authentication Agent for Web: Apache Web Server version 8.0 and RSA Authentication Agent for Web: Apache Web Server version 8.0.1 prior to Build 618 havCritical 9.8 · Nov 29, 2017
• CVE-2015-4548 EMC RSA Web Threat Detection before 5.1 SP1 allows local users to obtain root privileges by leveraging access to a service account and writing commands to a serHigh 7.2 · Oct 11, 2015
• CVE-2014-4627 SQL injection vulnerability in EMC RSA Web Threat Detection 4.x before 4.6.1.1 allows remote authenticated users to execute arbitrary SQL commands via unspecifiHigh 8.8 · Nov 7, 2014
• CVE-2012-0402 EMC RSA enVision 4.x before 4.1 Patch 4 uses unspecified hardcoded credentials, which makes it easier for remote attackers to obtain access via unknown vectors.High 9.3 · Mar 20, 2012
• CVE-2012-0400 EMC RSA enVision 4.x before 4.1 Patch 4 does not properly restrict the number of failed authentication attempts, which makes it easier for remote attackers to oHigh 7.9 · Mar 20, 2012
• CVE-2012-0397 Buffer overflow in EMC RSA SecurID Software Token Converter before 2.6.1 allows remote attackers to cause a denial of service or possibly execute arbitrary codeHigh 7.6 · Mar 6, 2012
• CVE-2011-4141 Untrusted search path vulnerability in EMC RSA SecurID Software Token 4.1 before 4.1.1 allows local users to gain privileges via a Trojan horse DLL in the curreHigh 9.3 · Dec 16, 2011
• CVE-2011-0322 Unspecified vulnerability in EMC RSA Access Manager Server 5.5.x, 6.0.x, and 6.1.x allows remote attackers to access resources via unknown vectors.High 7.5 · Mar 16, 2011
• CVE-2005-1471 Heap-based buffer overflow in RSA SecurID Web Agent 5, 5.2, and 5.3 allows remote attackers to execute arbitrary code via crafted chunked-encoding data.High 7.5 · May 6, 2005
• CVE-2001-1462 WebID in RSA Security SecurID 5.0 as used by ACE/Agent for Windows, Windows NT and Windows 2000 allows attackers to cause the WebID agent to enter debug mode viHigh 7.5 · Oct 24, 2001
• CVE-2001-1461 Directory traversal vulnerability in WebID in RSA Security SecurID 5.0 as used by ACE/Agent for Windows, Windows NT and Windows 2000 allows attackers to access High 7.5 · Oct 22, 2001
• CVE-1999-0834 Buffer overflow in RSAREF2 via the encryption and decryption functions in the RSAREF library.High 10 · Dec 1, 1999