Micro Focus
127 CVEs across 102 Micro Focus products. Browse Micro Focus vulnerabilities, severities, and proof-of-concept exploits.
Micro Focus products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-25835 | Medium | 5.9 | 2023-12-09 | A potential vulnerability has been identified in Micro Focus ArcSight Management Center. The vulnerability could be remotely exploited resulting in stored Cros… |
CVE-2023-32265 | High | 7.1 | 2023-07-20 | A potential security vulnerability has been identified in the Enterprise Server Common Web Administration (ESCWA) component used in Enterprise Server, Enterpr… |
CVE-2023-32263 | Low | 2.6 | 2023-07-19 | A potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability could be exploited to retrieve a login ce… |
CVE-2023-32262 | Medium | 4.3 | 2023-07-19 | A potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability allows attackers with Item/Configure perm… |
CVE-2023-32261 | Medium | 4.2 | 2023-07-19 | A potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability allows attackers with Overall/Read permis… |
CVE-2022-38758 | High | 7.2 | 2023-01-26 | Cross-site Scripting (XSS) vulnerability in NetIQ iManager prior to version 3.2.6 allows attacker to execute malicious scripts on the user's browser. This issu… |
CVE-2022-26329 | Low | 1.8 | 2023-01-26 | File existence disclosure vulnerability in NetIQ Identity Manager plugin prior to version 4.8.5 allows attacker to determine whether a file exists on the files… |
CVE-2022-38757 | High | 7.2 | 2022-12-23 | A vulnerability has been identified in Micro Focus ZENworks 2020 Update 3a and prior versions. This vulnerability allows administrators with rights to perform… |
CVE-2022-38756 | Medium | 4.3 | 2022-12-16 | A vulnerability has been identified in Micro Focus GroupWise Web in versions prior to 18.4.2. The GW Web component makes a request to the Post Office Agent tha… |
CVE-2022-38754 | High | 8.0 | 2022-12-08 | A potential vulnerability has been identified in Micro Focus Operations Bridge - Containerized. The vulnerability could be exploited by a malicious authenticat… |
CVE-2022-38755 | Medium | 5.3 | 2022-11-21 | A vulnerability has been identified in Micro Focus Filr in versions prior to 4.3.1.1. The vulnerability could be exploited to allow a remote unauthenticated at… |
CVE-2022-26331 | Medium | 6.1 | 2022-08-31 | Potential vulnerabilities have been identified in Micro Focus ArcSight Logger. The vulnerabilities could be remotely exploited resulting in Information Disclos… |
CVE-2022-26330 | Medium | 6.5 | 2022-08-31 | Potential vulnerabilities have been identified in Micro Focus ArcSight Logger. The vulnerabilities could be remotely exploited resulting in Information Disclos… |
CVE-2022-26326 | Medium | 4.0 | 2022-05-02 | Potential open redirection vulnerability when URL is crafted in specific format in NetIQ Access Manager prior to 5.0.2 |
CVE-2022-26325 | Low | 2.9 | 2022-05-02 | Reflected Cross Site Scripting (XSS) vulnerability in NetIQ Access Manager prior to 5.0.2 |
CVE-2021-22528 | High | 8.0 | 2021-09-13 | Reflected Cross Site Scripting (XSS) vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4 |
CVE-2021-22527 | Medium | 6.0 | 2021-09-13 | Information leakage vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4 |
CVE-2021-22526 | Medium | 4.9 | 2021-09-13 | Open Redirection vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4 |
CVE-2021-22524 | Medium | 5.4 | 2021-09-13 | Injection attack caused the denial of service vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4 |
CVE-2021-22515 | Medium | 4.8 | 2021-07-12 | Multi-Factor Authentication (MFA) functionality can be bypassed, allowing the use of single factor authentication in NetIQ Advanced Authentication versions pri… |
CVE-2021-22497 | Low | 3.8 | 2021-04-12 | Advanced Authentication versions prior to 6.3 SP4 have a potential broken authentication due to improper session management issue. |
CVE-2019-18947 | Low | 3.5 | 2021-02-26 | Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to information disclosure. |
CVE-2019-18946 | Medium | 4.8 | 2021-02-26 | Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to session fixation. |
CVE-2019-18945 | High | 7.3 | 2021-02-26 | Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to privilege escalation vulnerability. |
CVE-2019-18944 | Medium | 4.9 | 2021-02-26 | Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to reflected XSS. |
CVE-2019-18943 | Medium | 6.1 | 2021-02-26 | Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to XML External Entity Processing (XXE) on certain operations. |
CVE-2019-18942 | Medium | 5.5 | 2021-02-26 | Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to stored XSS. The application reflects previously stored user input without enc… |
CVE-2020-25833 | Medium | 4.8 | 2020-11-17 | Persistent cross-Site Scripting vulnerability on Micro Focus IDOL product, affecting all version prior to version 12.7. The vulnerability could be exploited to… |
CVE-2020-25832 | Medium | 5.4 | 2020-11-17 | Reflected Cross Site scripting vulnerability on Micro Focus Filr product, affecting version 4.2.1. The vulnerability could be exploited to perform Reflected XS… |
CVE-2020-11851 | Critical | 9.8 | 2020-11-17 | Arbitrary code execution vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1. The vulnerability could be remotely exploi… |
CVE-2020-25834 | Medium | 5.4 | 2020-11-17 | Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting version 7.1. The vulnerability could be remotely exploited resulting in Cr… |
CVE-2020-11860 | Medium | 6.1 | 2020-11-17 | Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1. The vulnerability could be remotely exploited… |
CVE-2020-11858 | High | 7.8 | 2020-10-27 | Code execution with escalated privileges vulnerability in Micro Focus products Operation Bridge Manager and Operation Bridge (containerized). The vulneravility… |
CVE-2020-11854 | Critical | 9.8 | 2020-10-27 | Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) vulnerability in Mi… |
CVE-2020-11853 | High | 8.8 | 2020-10-22 | Arbitrary code execution vulnerability affecting multiple Micro Focus products. 1.) Operation Bridge Manager affecting version: 2020.05, 2019.11, 2019.05, 2018… |
CVE-2020-11844 | Critical | 10.0 | 2020-05-29 | Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to… |
CVE-2019-11664 | Medium | 6.5 | 2019-09-18 | Clear text password in browser in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9… |
CVE-2019-11663 | Medium | 6.5 | 2019-09-18 | Clear text credentials are used to access managers app in Tomcat in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41… |
CVE-2019-11662 | Medium | 4.3 | 2019-09-18 | Class and method names in error message in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60… |
CVE-2019-11661 | High | 8.3 | 2019-09-18 | Allow changes to some table by non-SysAdmin in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9… |
CVE-2019-11665 | High | 7.5 | 2019-09-17 | Data exposure in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerabi… |
CVE-2019-11666 | High | 8.8 | 2019-09-17 | Insecure deserialization of untrusted data in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9… |
CVE-2019-11667 | High | 7.5 | 2019-09-17 | Unauthorized access to contact information in Micro Focus Service Manager, versions 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerability could be exploi… |
CVE-2019-11669 | High | 7.5 | 2019-09-10 | Modifiable read only check box In Micro Focus Service Manager, versions 9.60p1, 9.61, 9.62. This vulnerability could be exploited to allow unauthorized modific… |
CVE-2019-11658 | Medium | 4.3 | 2019-08-30 | Information exposure in Micro Focus Content Manager, versions 9.1, 9.2 and 9.3. This vulnerability when configured to use an Oracle database, allows valid syst… |
CVE-2019-11654 | High | 7.5 | 2019-08-23 | Path traversal vulnerability in Micro Focus Verastream Host Integrator (VHI), versions 7.7 SP2 and earlier, The vulnerability allows remote unauthenticated att… |
CVE-2019-11652 | Critical | 9.8 | 2019-08-14 | A potential authorization bypass issue was found in Micro Focus Self Service Password Reset (SSPR) versions prior to: 4.4.0.3, 4.3.0.6, and 4.2.0.6. Upgrade to… |
CVE-2019-11653 | Medium | 5.4 | 2019-08-07 | Remote Access Control Bypass in Micro Focus Content Manager. versions 9.1, 9.2, 9.3. The vulnerability could be exploited to manipulate data stored during anot… |
CVE-2019-3486 | Medium | 4.6 | 2019-07-25 | Mitigates a stored cross site scripting issue in ArcSight Security Management Center versions prior to 2.9.1 |
CVE-2019-3485 | Medium | 4.6 | 2019-07-24 | Mitigates a stored cross site scripting issue in ArcSight Logger versions prior to 6.7.1 |
CVE-2019-11650 | Medium | 5.9 | 2019-07-10 | A potential Man in the Middle attack (MITM) was found in NetIQ Advanced Authentication Framework versions prior to 6.0. |
CVE-2019-11648 | High | 7.5 | 2019-06-24 | An information leakage exists in Micro Focus NetIQ Self Service Password Reset Software all versions prior to version 4.4. The vulnerability could be exploited… |
CVE-2019-11647 | Medium | 6.1 | 2019-06-24 | A potential XSS exists in Self Service Password Reset, in Micro Focus NetIQ Software all versions prior to version 4.4. The vulnerability could be exploited to… |
CVE-2019-11649 | Medium | 5.4 | 2019-06-19 | Cross-Site Scripting vulnerability in Micro Focus Fortify Software Security Center Server, versions 17.2, 18.1, 18.2, has been identified in Micro Focus Softwa… |
CVE-2019-3477 | Medium | 6.1 | 2019-06-07 | Micro Focus Solution Business Manager versions prior to 11.4.2 is susceptible to open redirect. |
CVE-2019-3493 | High | 8.8 | 2019-04-29 | A potential security vulnerability has been identified in Micro Focus Network Automation Software 9.20, 9.21, 10.00, 10.10, 10.20, 10.30, 10.40, 10.50, 2018.05… |
CVE-2019-3489 | High | 7.5 | 2019-04-01 | An unauthenticated file upload vulnerability has been identified in the Web Client component of Micro Focus Content Manager 9.1, 9.2, and 9.3 when configured t… |
CVE-2018-19644 | Medium | 5.0 | 2019-03-27 | Reflected cross site script issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5. |
CVE-2018-19643 | Medium | 4.7 | 2019-03-27 | Information leakage issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5. |
CVE-2018-19642 | Medium | 5.1 | 2019-03-27 | Denial of service issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5. |
CVE-2018-19641 | Medium | 6.1 | 2019-03-27 | Unauthenticated remote code execution issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5. |
CVE-2019-3475 | High | 7.8 | 2019-02-20 | A local privilege escalation vulnerability in the famtd component of Micro Focus Filr 3.0 allows a local attacker authenticated as a low privilege user to esca… |
CVE-2019-3474 | Medium | 6.5 | 2019-02-20 | A path traversal vulnerability in the web application component of Micro Focus Filr 3.x allows a remote attacker authenticated as a low privilege user to downl… |
CVE-2018-18593 | Medium | 6.5 | 2018-12-31 | Remote Directory Traversal and Remote Disclosure of Privileged Information in UCMDB Configuration Management Service, version 10.22, 10.22 CUP1, 10.22 CUP2, 10… |
CVE-2018-7691 | Medium | 6.5 | 2018-12-13 | A potential Remote Unauthorized Access in Micro Focus Fortify Software Security Center (SSC), versions 17.10, 17.20, 18.10 this exploitation could allow Remote… |
CVE-2018-7690 | Medium | 6.5 | 2018-12-13 | A potential Remote Unauthorized Access in Micro Focus Fortify Software Security Center (SSC), versions 17.10, 17.20, 18.10 this exploitation could allow Remote… |
CVE-2018-17952 | Medium | 6.1 | 2018-12-12 | Cross site scripting vulnerability in eDirectory prior to 9.1 SP2 |
CVE-2018-17950 | High | 7.5 | 2018-12-12 | Incorrect enforcement of authorization checks in eDirectory prior to 9.1 SP2 |
CVE-2018-17949 | Medium | 6.1 | 2018-12-12 | Cross site scripting vulnerability in iManager prior to 3.1 SP2. |
CVE-2018-18591 | Medium | 6.8 | 2018-11-13 | A potential unauthorized disclosure of data vulnerability has been identified in Micro Focus Service Manager versions: 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40… |
CVE-2018-18590 | Critical | 9.6 | 2018-11-07 | A potential remote code execution and information disclosure vulnerability exists in Micro Focus Operations Bridge containerized suite versions 2017.11, 2018.0… |
CVE-2018-18589 | Medium | 6.3 | 2018-10-23 | A potential Remote Arbitrary Code Execution vulnerability has been identified in Micro Focus' Real User Monitoring software, versions 9.26IP, 9.30, 9.40 and 9… |
CVE-2018-12469 | High | 7.5 | 2018-10-12 | Incorrect handling of an invalid value for an HTTP request parameter by Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterpris… |
CVE-2018-6505 | High | 7.5 | 2018-09-20 | A potential Unauthenticated File Download vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81. This vulnerabi… |
CVE-2018-6504 | High | 8.8 | 2018-09-20 | A potential Cross-Site Request Forgery (CSRF) vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81. This vulne… |
CVE-2018-6503 | Medium | 6.5 | 2018-09-20 | A potential Access Control vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81. This vulnerability could be e… |
CVE-2018-6502 | Medium | 6.5 | 2018-09-20 | A potential Reflected Cross-Site Scripting (XSS) Security vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81… |
CVE-2018-6500 | High | 7.5 | 2018-09-20 | A potential Directory Traversal Security vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81. This vulnerabil… |
CVE-2018-6499 | High | 7.1 | 2018-08-30 | Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized… |
CVE-2018-6498 | High | 8.8 | 2018-08-30 | Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized… |
CVE-2018-7692 | Medium | 6.1 | 2018-08-09 | Unvalidated redirect vulnerability in in NetIQ eDirectory before 9.1.1 HF1. |
CVE-2018-7686 | High | 7.5 | 2018-08-09 | Information leakage vulnerability in NetIQ eDirectory before 9.1.1 HF1 due to shared memory usage. |
CVE-2018-12468 | Critical | 9.1 | 2018-08-01 | A vulnerability in the administration console of Micro Focus GroupWise prior to version 18.0.2 may allow a remote attacker authenticated as an administrator to… |
CVE-2018-12463 | Critical | 9.8 | 2018-07-12 | An XML external entity (XXE) vulnerability in Fortify Software Security Center (SSC), version 17.1, 17.2, 18.1 allows remote unauthenticated users to read arbi… |
CVE-2018-12465 | Critical | 9.1 | 2018-06-29 | An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway (SMG) allows a remote attacker authenticated… |
CVE-2018-12464 | Critical | 10.0 | 2018-06-29 | A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthenticated remote atta… |
CVE-2018-7682 | Medium | 6.5 | 2018-06-22 | Micro Focus Solutions Business Manager versions prior to 11.4 allows a user to invoke SBM RESTful services across domains. |
CVE-2018-7683 | High | 7.5 | 2018-06-21 | Micro Focus Solutions Business Manager versions prior to 11.4 might reveal certain sensitive information in server log files. |
CVE-2018-7681 | Medium | 4.8 | 2018-06-21 | Micro Focus Solutions Business Manager versions prior to 11.4 allows JavaScript to be embedded in URLs placed in "Favorites" folder. If the user has certain ad… |
CVE-2018-7680 | Medium | 6.1 | 2018-06-21 | Micro Focus Solutions Business Manager versions prior to 11.4 can reflect back HTTP header values. |
CVE-2018-7679 | Critical | 9.8 | 2018-06-21 | Micro Focus Solutions Business Manager versions prior to 11.4 when ASP.NET is configured with execute permission on the virtual directories and does not valida… |
CVE-2018-6497 | High | 8.8 | 2018-06-16 | Remote Cross-site Request forgery (CSRF) potential has been identified in UCMBD Server version DDM Content Pack V 10.20, 10.21, 10.22, 10.22 CUP7, 10.30, 10.31… |
CVE-2018-6496 | High | 8.8 | 2018-06-16 | Remote Cross-site Request forgery (CSRF) potential has been identified in UCMBD Browser version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15, 4.15.1 which could allow fo… |
CVE-2018-6495 | Medium | 5.4 | 2018-05-23 | Cross-Site Scripting (XSS) in Micro Focus Universal CMDB, version 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, 10.33, 11.0, CMS, version 4.10, 4.11, 4.12, 4.13, 4… |
CVE-2018-6493 | High | 8.8 | 2018-05-22 | SQL Injection in HP Network Operations Management Ultimate, version 2017.07, 2017.11, 2018.02 and in Network Automation, version 10.00, 10.10, 10.11, 10.20, 10… |
CVE-2018-6492 | Medium | 4.7 | 2018-05-22 | Persistent Cross-Site Scripting, and non-persistent HTML Injection in HP Network Operations Management Ultimate, version 2017.07, 2017.11, 2018.02 and in Netwo… |
CVE-2018-6494 | Medium | 5.4 | 2018-05-22 | Remote SQL Injection against the HP Service Manager Software Web Tier, version 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, may lead to unauthor… |
CVE-2018-7687 | High | 7.8 | 2018-05-21 | The Micro Focus Client for OES before version 2 SP4 IR8a has a vulnerability that could allow a local attacker to elevate privileges via a buffer overflow in n… |
CVE-2018-6491 | High | 8.1 | 2018-04-24 | Local Escalation of Privilege vulnerability to Micro Focus Universal CMDB, versions 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, 10.33, 11.00. The vulnerability c… |
CVE-2018-1343 | Critical | 9.8 | 2018-03-06 | PAM exposure enabling unauthenticated access to remote host |