Microfocus
74 CVEs across 97 Microfocus products. Browse Microfocus vulnerabilities, severities, and proof-of-concept exploits.
Microfocus products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-11878 | Medium | 6.1 | 2026-06-24 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText Access Manager allows Cross-Site Scripting (XSS)… |
CVE-2026-11877 | High | 7.5 | 2026-06-24 | An unauthorized user can modify configuration through API calls that affects the OpenText Access Manager. This issue affects Access Manager before 5.1.3. |
CVE-2026-2123 | High | 7.8 | 2026-03-31 | A security audit identified a privilege escalation vulnerability in Operations Agent(<=OA 12.29) on Windows. Under specific conditions Operations Agent may run… |
CVE-2023-24467 | High | 8.8 | 2024-11-22 | Possible Command Injection in iManager GET parameter has been discovered in OpenText™ iManager 3.2.6.0000. |
CVE-2023-24466 | High | 7.5 | 2024-11-22 | Possible XML External Entity Injection in iManager GET parameter has been discovered in OpenText™ iManager 3.2.6.0200. |
CVE-2022-26324 | High | 7.6 | 2024-11-22 | Possible XSS in iManager URL for access Component has been discovered in OpenText™ iManager 3.2.6.0000. |
CVE-2021-38135 | High | 8.6 | 2024-11-22 | Possible External Service Interaction attack in iManager has been discovered in OpenText™ iManager 3.2.6.0000. |
CVE-2021-38134 | Medium | 6.1 | 2024-11-22 | Possible XSS in iManager URL for access Component has been discovered in OpenText™ iManager 3.2.5.0000. |
CVE-2021-38119 | Medium | 6.1 | 2024-11-22 | Possible Reflected Cross-Site Scripting (XSS) Vulnerability in iManager has been discovered in OpenText™ iManager 3.2.4.0000. |
CVE-2021-38118 | Medium | 5.5 | 2024-11-22 | Possible improper input validation Vulnerability in iManager has been discovered in OpenText™ iManager 3.2.4.0000. |
CVE-2021-38117 | High | 8.8 | 2024-11-22 | Possible Command injection Vulnerability in iManager has been discovered in OpenText™ iManager 3.2.4.0000. |
CVE-2021-38116 | High | 8.8 | 2024-11-22 | Possible Elevation of Privilege Vulnerability in iManager has been discovered in OpenText™ iManager. This impacts all versions before 3.2.5 |
CVE-2024-9841 | Medium | 6.1 | 2024-11-08 | A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in OpenText ArcSight Management Center and ArcSight Platform. The vulnerability could… |
CVE-2020-11859 | High | 7.6 | 2024-11-06 | Improper Input Validation vulnerability in OpenText iManager allows Cross-Site Scripting (XSS). This issue affects iManager before 3.2.3 |
CVE-2024-5532 | Medium | 4.8 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Operations Agent. The XSS vulnerabilit… |
CVE-2024-4692 | Low | 2.4 | 2024-10-16 | Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Acc… |
CVE-2024-4690 | High | 8.0 | 2024-10-16 | Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText A… |
CVE-2024-4211 | Low | 2.4 | 2024-10-16 | Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Acc… |
CVE-2024-4189 | High | 8.0 | 2024-10-16 | Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText A… |
CVE-2024-4184 | High | 8.0 | 2024-10-16 | Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText A… |
CVE-2024-6360 | Critical | 9.8 | 2024-10-02 | Incorrect Permission Assignment for Critical Resource vulnerability in OpenText™ Vertica could allow Privilege Abuse and result in unauthorized access or privi… |
CVE-2021-38133 | High | 7.4 | 2024-09-12 | Possible External Service Interaction attack in eDirectory has been discovered in OpenText™ eDirectory. This impact all version before 9.2.6.0000. |
CVE-2021-38132 | Medium | 5.3 | 2024-09-12 | Possible External Service Interaction attack in eDirectory has been discovered in OpenText™ eDirectory. This impact all version before 9.2.6.0000. |
CVE-2021-38131 | Medium | 5.4 | 2024-09-12 | Possible Cross-Site Scripting (XSS) Vulnerability in eDirectory has been discovered in OpenText™ eDirectory 9.2.5.0000. |
CVE-2021-22533 | Medium | 6.5 | 2024-09-12 | Possible Insertion of Sensitive Information into Log File Vulnerability in eDirectory has been discovered in OpenText™ eDirectory 9.2.4.0000. |
CVE-2021-22532 | High | 7.6 | 2024-09-12 | Possible NLDAP Denial of Service attack Vulnerability in eDirectory has been discovered in OpenText™ eDirectory before 9.2.4.0000. |
CVE-2021-22503 | Medium | 5.4 | 2024-09-12 | Possible Improper Neutralization of Input During Web Page Generation Vulnerability in eDirectory has been discovered in OpenText™ eDirectory 9.2.3.0000. |
CVE-2024-4556 | Medium | 5.7 | 2024-08-28 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText NetIQ Access Manager allows access the sensitive infor… |
CVE-2024-4555 | High | 7.7 | 2024-08-28 | Improper Privilege Management vulnerability in OpenText NetIQ Access Manager allows user account impersonation in specific scenario. This issue affects NetIQ A… |
CVE-2024-4554 | High | 7.3 | 2024-08-28 | Improper Input Validation vulnerability in OpenText NetIQ Access Manager leads to Cross-Site Scripting (XSS) attack. This issue affects Access Manager before 5… |
CVE-2021-38122 | Medium | 6.2 | 2024-08-28 | A Cross-Site Scripting vulnerable identified in NetIQ Advance Authentication that impacts the server functionality and disclose sensitive information. This iss… |
CVE-2021-38121 | High | 8.3 | 2024-08-28 | Insufficient or weak TLS protocol version identified in Advance authentication client server communication when specific service is accessed between devices. … |
CVE-2021-38120 | Medium | 5.1 | 2024-08-28 | A vulnerability identified in Advance Authentication that allows bash command Injection in administrative controlled functionality of backup due to improper ha… |
CVE-2021-22530 | High | 8.2 | 2024-08-28 | A vulnerability identified in NetIQ Advance Authentication that doesn't enforce account lockout when brute force attack is performed on API based login. This i… |
CVE-2021-22529 | Medium | 6.3 | 2024-08-28 | A vulnerability identified in NetIQ Advance Authentication that leaks sensitive server information. This issue affects NetIQ Advance Authentication version bef… |
CVE-2021-22509 | High | 8.1 | 2024-08-28 | A vulnerability identified in storing and reusing information in Advance Authentication. This issue can lead to leakage of sensitive data to unauthorized user… |
CVE-2020-11847 | High | 8.2 | 2024-08-21 | SSH authenticated user when access the PAM server can execute an OS command to gain the full system access using bash. This issue affects Privileged Access Man… |
CVE-2020-11846 | High | 8.7 | 2024-08-21 | A vulnerability found in OpenText Privileged Access Manager that issues a token. on successful issuance of the token, a cookie gets set that allows unrestricte… |
CVE-2020-11850 | High | 7.3 | 2024-08-21 | Improper Input Validation vulnerability in OpenText Self Service Password Reset allows Cross-Site Scripting (XSS). This issue affects Self Service Password Res… |
CVE-2024-4429 | Medium | 5.4 | 2024-05-28 | Cross-Site Request Forgery vulnerability has been discovered in OpenText™ iManager 3.2.6.0200. This could lead to sensitive information disclosure. |
CVE-2024-3969 | High | 7.8 | 2024-05-28 | XML External Entity injection vulnerability found in OpenText™ iManager 3.2.6.0200. This could lead to remote code execution by parsing untrusted XML payload |
CVE-2024-3970 | Medium | 5.3 | 2024-05-15 | Server Side Request Forgery vulnerability has been discovered in OpenText™ iManager 3.2.6.0200. This could lead to senstive information disclosure by directory… |
CVE-2024-3968 | High | 7.8 | 2024-05-15 | Remote Code Execution has been discovered in OpenText™ iManager 3.2.6.0200. The vulnerability can trigger remote code execution using custom file upload task. |
CVE-2024-3967 | High | 7.6 | 2024-05-15 | Remote Code Execution has been discovered in OpenText™ iManager 3.2.6.0200. The vulnerability can trigger remote code execution unisng unsafe java object deser… |
CVE-2024-3488 | Medium | 5.6 | 2024-05-15 | File Upload vulnerability in unauthenticated session found in OpenText™ iManager 3.2.6.0200. The vulnerability could allow ant attacker to upload a file withou… |
CVE-2024-3487 | Low | 3.5 | 2024-05-15 | Broken Authentication vulnerability discovered in OpenText™ iManager 3.2.6.0200. This vulnerability allows an attacker to manipulate certain parameters to bypa… |
CVE-2024-3486 | High | 7.8 | 2024-05-15 | XML External Entity injection vulnerability found in OpenText™ iManager 3.2.6.0200. This could lead to information disclosure and remote code execution. |
CVE-2024-3485 | Medium | 5.3 | 2024-05-15 | Server Side Request Forgery vulnerability has been discovered in OpenText™ iManager 3.2.6.0200. This could lead to senstive information disclosure. |
CVE-2024-3484 | Medium | 5.7 | 2024-05-15 | Path Traversal found in OpenText™ iManager 3.2.6.0200. This can lead to privilege escalation or file disclosure. |
CVE-2024-3483 | High | 7.8 | 2024-05-15 | Remote Code Execution has been discovered in OpenText™ iManager 3.2.6.0200. The vulnerability can trigger command injection and insecure deserialization issues… |
CVE-2024-0622 | High | 8.8 | 2024-02-15 | Local privilege escalation vulnerability affects OpenText Operations Agent product versions 12.15 and 12.20-12.25 when installed on Non-Windows platforms. The… |
CVE-2020-25835 | Medium | 5.9 | 2023-12-09 | A potential vulnerability has been identified in Micro Focus ArcSight Management Center. The vulnerability could be remotely exploited resulting in stored Cros… |
CVE-2023-32268 | High | 7.2 | 2023-12-06 | Exposure of Proxy Administrator Credentials An authenticated administrator equivalent Filr user can access the credentials of proxy administrators. |
CVE-2023-5913 | High | 8.2 | 2023-11-08 | Incorrect Privilege Assignment vulnerability in opentext Fortify ScanCentral DAST. The vulnerability could be exploited to gain elevated privileges.This issue… |
CVE-2023-4964 | High | 8.2 | 2023-10-30 | Potential open redirect vulnerability in opentext Service Management Automation X (SMAX) versions 2020.05, 2020.08, 2020.11, 2021.02, 2021.05, 2021.08, 2021.1… |
CVE-2023-4501 | Critical | 9.8 | 2023-09-12 | User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enter… |
CVE-2023-32267 | Medium | 6.4 | 2023-08-11 | A potential vulnerability has been identified in OpenText / Micro Focus ArcSight Management Center. The vulnerability could be remotely exploited. |
CVE-2023-32265 | High | 7.1 | 2023-07-20 | A potential security vulnerability has been identified in the Enterprise Server Common Web Administration (ESCWA) component used in Enterprise Server, Enterpr… |
CVE-2023-32263 | Low | 2.6 | 2023-07-19 | A potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability could be exploited to retrieve a login ce… |
CVE-2023-32262 | Medium | 4.3 | 2023-07-19 | A potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability allows attackers with Item/Configure perm… |
CVE-2023-32261 | Medium | 4.2 | 2023-07-19 | A potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability allows attackers with Overall/Read permis… |
CVE-2023-24470 | Critical | 9.1 | 2023-06-13 | Potential XML External Entity Injection in ArcSight Logger versions prior to 7.3.0. |
CVE-2023-24469 | Medium | 6.1 | 2023-06-13 | Potential Cross-Site Scripting in ArcSight Logger versions prior to 7.3.0 |
CVE-2023-24468 | Critical | 9.8 | 2023-03-15 | Broken access control in Advanced Authentication versions prior to 6.4.1.1 and 6.3.7.2 |
CVE-2022-38757 | High | 7.2 | 2022-12-23 | A vulnerability has been identified in Micro Focus ZENworks 2020 Update 3a and prior versions. This vulnerability allows administrators with rights to perform… |
CVE-2022-38756 | Medium | 4.3 | 2022-12-16 | A vulnerability has been identified in Micro Focus GroupWise Web in versions prior to 18.4.2. The GW Web component makes a request to the Post Office Agent tha… |
CVE-2022-38754 | High | 8.0 | 2022-12-08 | A potential vulnerability has been identified in Micro Focus Operations Bridge - Containerized. The vulnerability could be exploited by a malicious authenticat… |
CVE-2022-38753 | Medium | 6.3 | 2022-11-28 | This update resolves a multi-factor authentication bypass attack |
CVE-2022-38755 | Medium | 5.3 | 2022-11-21 | A vulnerability has been identified in Micro Focus Filr in versions prior to 4.3.1.1. The vulnerability could be exploited to allow a remote unauthenticated at… |
CVE-2022-26331 | Medium | 6.1 | 2022-08-31 | Potential vulnerabilities have been identified in Micro Focus ArcSight Logger. The vulnerabilities could be remotely exploited resulting in Information Disclos… |
CVE-2022-26330 | Medium | 6.5 | 2022-08-31 | Potential vulnerabilities have been identified in Micro Focus ArcSight Logger. The vulnerabilities could be remotely exploited resulting in Information Disclos… |
CVE-2021-22531 | Medium | 6.1 | 2022-05-12 | A bug exist in the input parameter of Access Manager that allows supply of invalid character to trigger cross-site scripting vulnerability. This affects NetIQ… |
CVE-2022-26326 | Medium | 4.0 | 2022-05-02 | Potential open redirection vulnerability when URL is crafted in specific format in NetIQ Access Manager prior to 5.0.2 |
CVE-2022-26325 | Low | 2.9 | 2022-05-02 | Reflected Cross Site Scripting (XSS) vulnerability in NetIQ Access Manager prior to 5.0.2 |
CVE-2021-38125 | Critical | 9.8 | 2022-04-11 | Unauthenticated remote code execution in Micro Focus Operations Bridge containerized, affecting versions 2021.05, 2021.08, and newer versions of Micro Focus Op… |
CVE-2021-38130 | Medium | 6.5 | 2022-02-04 | A potential Information leakage vulnerability has been identified in versions of Micro Focus Voltage SecureMail Mail Relay prior to 7.3.0.1. The vulnerability… |
CVE-2021-38129 | Low | 3.3 | 2022-01-25 | Escalation of privileges vulnerability in Micro Focus in Micro Focus Operations Agent, affecting versions 12.x up to and including 12.21. The vulnerability cou… |
CVE-2021-38127 | Medium | 6.1 | 2022-01-14 | Potential vulnerabilities have been identified in Micro Focus ArcSight Enterprise Security Manager, affecting versions 7.4.x and 7.5.x. The vulnerabilities cou… |
CVE-2021-38126 | Medium | 6.1 | 2022-01-14 | Potential vulnerabilities have been identified in Micro Focus ArcSight Enterprise Security Manager, affecting versions 7.4.x and 7.5.x. The vulnerabilities cou… |
CVE-2021-38124 | Critical | 9.8 | 2021-09-28 | Remote Code Execution vulnerability in Micro Focus ArcSight Enterprise Security Manager (ESM) product, affecting versions 7.0.2 through 7.5. The vulnerability… |
CVE-2021-22535 | Medium | 4.9 | 2021-09-28 | Unauthorized information security disclosure vulnerability on Micro Focus Directory and Resource Administrator (DRA) product, affecting all DRA versions prior… |
CVE-2021-22528 | High | 8.0 | 2021-09-13 | Reflected Cross Site Scripting (XSS) vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4 |
CVE-2021-22527 | Medium | 6.0 | 2021-09-13 | Information leakage vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4 |
CVE-2021-22526 | Medium | 4.9 | 2021-09-13 | Open Redirection vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4 |
CVE-2021-22524 | Medium | 5.4 | 2021-09-13 | Injection attack caused the denial of service vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4 |
CVE-2021-38123 | Medium | 6.1 | 2021-09-07 | Open Redirect vulnerability in Micro Focus Network Automation, affecting Network Automation versions 10.4x, 10.5x, 2018.05, 2018.11, 2019.05, 2020.02, 2020.08… |
CVE-2021-22525 | Medium | 5.5 | 2021-09-02 | This release addresses a potential information leakage vulnerability in NetIQ Access Manager versions prior to 5.0.1 |
CVE-2021-22517 | High | 8.8 | 2021-08-05 | A potential unauthorized privilege escalation vulnerability has been identified in Micro Focus Data Protector. The vulnerability affects versions 10.10, 10.20… |
CVE-2021-22521 | Medium | 6.7 | 2021-07-30 | A privileged escalation vulnerability has been identified in Micro Focus ZENworks Configuration Management, affecting version 2020 Update 1 and all prior versi… |
CVE-2021-22523 | High | 7.6 | 2021-07-22 | XML External Entity vulnerability in Micro Focus Verastream Host Integrator, affecting version 7.8 Update 1 and earlier versions. The vulnerability could allow… |
CVE-2021-22522 | High | 7.1 | 2021-07-22 | Reflected Cross-Site Scripting vulnerability in Micro Focus Verastream Host Integrator, affecting version version 7.8 Update 1 and earlier versions. The vulner… |
CVE-2021-22515 | Medium | 4.8 | 2021-07-12 | Multi-Factor Authentication (MFA) functionality can be bypassed, allowing the use of single factor authentication in NetIQ Advanced Authentication versions pri… |
CVE-2021-22516 | High | 7.5 | 2021-06-04 | Insertion of Sensitive Information into Log File vulnerability in Micro Focus Secure API Manager (SAPIM) product, affecting version 2.0.0. The vulnerability co… |
CVE-2021-22519 | Critical | 9.8 | 2021-05-28 | Execute arbitrary code vulnerability in Micro Focus SiteScope product, affecting versions 11.40,11.41 , 2018.05(11.50), 2018.08(11.51), 2018.11(11.60), 2019.02… |
CVE-2021-22514 | Critical | 9.8 | 2021-04-28 | An arbitrary code execution vulnerability exists in Micro Focus Application Performance Management, affecting versions 9.40, 9.50 and 9.51. The vulnerability c… |
CVE-2021-22505 | Critical | 9.8 | 2021-04-13 | Escalation of privileges vulnerability in Micro Focus Operations Agent, affects versions 12.0x, 12.10, 12.11, 12.12, 12.14 and 12.15. The vulnerability could b… |
CVE-2021-22497 | Low | 3.8 | 2021-04-12 | Advanced Authentication versions prior to 6.3 SP4 have a potential broken authentication due to improper session management issue. |
CVE-2021-22513 | Medium | 6.5 | 2021-04-08 | Missing Authorization vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier vers… |
CVE-2021-22512 | Medium | 6.5 | 2021-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and… |
CVE-2021-22511 | Medium | 6.5 | 2021-04-08 | Improper Certificate Validation vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and ea… |