Microfocus
Page 3 of 3 — Microfocus CVEs from a corpus of 273, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-6499 | High | 7.1 | 2018-08-30 | Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized… |
CVE-2018-6498 | High | 8.8 | 2018-08-30 | Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized… |
CVE-2018-7692 | Medium | 6.1 | 2018-08-09 | Unvalidated redirect vulnerability in in NetIQ eDirectory before 9.1.1 HF1. |
CVE-2018-7686 | High | 7.5 | 2018-08-09 | Information leakage vulnerability in NetIQ eDirectory before 9.1.1 HF1 due to shared memory usage. |
CVE-2018-12468 | Critical | 9.1 | 2018-08-01 | A vulnerability in the administration console of Micro Focus GroupWise prior to version 18.0.2 may allow a remote attacker authenticated as an administrator to… |
CVE-2018-12465 | Critical | 9.1 | 2018-06-29 | An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway (SMG) allows a remote attacker authenticated… |
CVE-2018-12464 | Critical | 10.0 | 2018-06-29 | A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthenticated remote atta… |
CVE-2018-7682 | Medium | 6.5 | 2018-06-22 | Micro Focus Solutions Business Manager versions prior to 11.4 allows a user to invoke SBM RESTful services across domains. |
CVE-2018-7683 | High | 7.5 | 2018-06-21 | Micro Focus Solutions Business Manager versions prior to 11.4 might reveal certain sensitive information in server log files. |
CVE-2018-7681 | Medium | 4.8 | 2018-06-21 | Micro Focus Solutions Business Manager versions prior to 11.4 allows JavaScript to be embedded in URLs placed in "Favorites" folder. If the user has certain ad… |
CVE-2018-7680 | Medium | 6.1 | 2018-06-21 | Micro Focus Solutions Business Manager versions prior to 11.4 can reflect back HTTP header values. |
CVE-2018-7679 | Critical | 9.8 | 2018-06-21 | Micro Focus Solutions Business Manager versions prior to 11.4 when ASP.NET is configured with execute permission on the virtual directories and does not valida… |
CVE-2018-6497 | High | 8.8 | 2018-06-16 | Remote Cross-site Request forgery (CSRF) potential has been identified in UCMBD Server version DDM Content Pack V 10.20, 10.21, 10.22, 10.22 CUP7, 10.30, 10.31… |
CVE-2018-6496 | High | 8.8 | 2018-06-16 | Remote Cross-site Request forgery (CSRF) potential has been identified in UCMBD Browser version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15, 4.15.1 which could allow fo… |
CVE-2018-6495 | Medium | 5.4 | 2018-05-23 | Cross-Site Scripting (XSS) in Micro Focus Universal CMDB, version 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, 10.33, 11.0, CMS, version 4.10, 4.11, 4.12, 4.13, 4… |
CVE-2018-6494 | Medium | 5.4 | 2018-05-22 | Remote SQL Injection against the HP Service Manager Software Web Tier, version 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, may lead to unauthor… |
CVE-2018-7687 | High | 7.8 | 2018-05-21 | The Micro Focus Client for OES before version 2 SP4 IR8a has a vulnerability that could allow a local attacker to elevate privileges via a buffer overflow in n… |
CVE-2018-6491 | High | 8.1 | 2018-04-24 | Local Escalation of Privilege vulnerability to Micro Focus Universal CMDB, versions 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, 10.33, 11.00. The vulnerability c… |
CVE-2018-7675 | Low | 2.8 | 2018-03-07 | In NetIQ Sentinel before 8.1.x, a Sentinel user is logged into the Sentinel Web Interface. After performing some tasks within Sentinel the user does not log ou… |
CVE-2017-9285 | Medium | 5.4 | 2018-03-02 | NetIQ eDirectory before 9.0 SP4 did not enforce login restrictions when "ebaclient" was used, allowing unpermitted access to eDirectory services. |
CVE-2017-7429 | High | 8.8 | 2018-03-02 | The certificate upload in NetIQ eDirectory PKI plugin before 8.8.8 Patch 10 Hotfix 1 could be abused to upload JSP code which could be used by authenticated at… |
CVE-2018-6489 | Critical | 9.8 | 2018-02-22 | XML External Entity (XXE) vulnerability in Micro Focus Project and Portfolio Management Center, version 9.32. This vulnerability can be exploited to allow XML… |
CVE-2018-6488 | High | 8.1 | 2018-02-22 | Arbitrary Code Execution vulnerability in Micro Focus Universal CMDB, version 4.10, 4.11, 4.12. This vulnerability could be remotely exploited to allow Arbitra… |
CVE-2018-6487 | Critical | 9.8 | 2018-02-20 | Remote Disclosure of Information in Micro Focus Universal CMDB Foundation Software, version numbers 10.10, 10.11, 10.20, 10.21, 10.22, 10.30, 10.31, 4.10, 4.11… |
CVE-2017-8993 | Medium | 5.4 | 2018-02-15 | A Remote Cross-Site Scripting vulnerability in HPE Project and Portfolio Management (PPM) version v9.30, v9.31, v9.32, v9.40 was found. |
CVE-2018-6486 | High | 7.3 | 2018-02-02 | XML External Entity (XXE) vulnerability in Micro Focus Fortify Audit Workbench (AWB) and Micro Focus Fortify Software Security Center (SSC), versions 16.10, 16… |
CVE-2017-14363 | Medium | 5.9 | 2017-12-21 | Cross-Site Scripting (XSS) vulnerability has been identified in Micro Focus Operations Manager i, versions 10.60, 10.61, 10.62. The vulnerability could be remo… |
CVE-2017-14362 | High | 7.3 | 2017-12-13 | Cross-Site Request Forgery vulnerability in Micro Focus Project and Portfolio Management Center, version 9.32. This vulnerability could be exploited to allow a… |
CVE-2017-14361 | High | 7.4 | 2017-12-13 | Man-In-The-Middle vulnerability in Micro Focus Project and Portfolio Management Center, version 9.32. This vulnerability could be exploited to allow a Man-in-t… |
CVE-2017-14355 | High | 7.8 | 2017-12-05 | A potential security vulnerability has been identified in HPE Connected Backup versions 8.6 and 8.8.6. The vulnerability could be exploited locally to allow es… |
CVE-2017-9273 | Medium | 5.3 | 2017-10-06 | The Bi-directional driver in IDM 4.5 before 4.0.3.0 could be susceptible to unauthorized log configuration changes. |
CVE-2017-9272 | High | 7.5 | 2017-10-06 | The Bi-directional driver in IDM 4.5 before 4.0.3.0 could be susceptible to a denial of service attack. |
CVE-2017-9283 | Critical | 9.8 | 2017-09-21 | An out-of-bounds read (CWE-125) vulnerability exists in Micro Focus VisiBroker 8.5. The feasibility of leveraging this vulnerability for further attacks was no… |
CVE-2017-9282 | Critical | 9.8 | 2017-09-21 | An integer overflow (CWE-190) led to an out-of-bounds write (CWE-787) on a heap-allocated area, leading to heap corruption in Micro Focus VisiBroker 8.5. The f… |
CVE-2017-9281 | High | 7.5 | 2017-09-21 | An integer overflow (CWE-190) potentially causing an out-of-bounds read (CWE-125) vulnerability in Micro Focus VisiBroker 8.5 can lead to a denial of service. |
CVE-2017-7424 | Medium | 6.5 | 2017-08-21 | A Path Traversal (CWE-22) vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Upd… |
CVE-2017-7423 | High | 8.8 | 2017-08-21 | A Cross-Site Request Forgery (CWE-352) vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8… |
CVE-2017-7422 | Medium | 5.4 | 2017-08-21 | Reflected and stored Cross-Site Scripting (XSS, CWE-79) vulnerabilities in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Updat… |
CVE-2017-7421 | Medium | 6.1 | 2017-08-21 | Reflected and stored Cross-Site Scripting (XSS, CWE-79) vulnerabilities in Directory Server (aka Enterprise Server Administration web UI) and ESMAC (aka Enterp… |
CVE-2017-7420 | Critical | 9.8 | 2017-08-21 | An Authentication Bypass (CWE-287) vulnerability in ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server… |
CVE-2017-5187 | High | 8.8 | 2017-08-21 | A Cross-Site Request Forgery (CWE-352) vulnerability in Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and… |
CVE-2017-5185 | High | 7.5 | 2017-03-30 | A vulnerability was discovered in NetIQ Sentinel Server 8.0 before 8.0.1 that may allow remote denial of service. |
CVE-2017-5184 | Medium | 5.3 | 2017-03-30 | A vulnerability was discovered in NetIQ Sentinel Server 8.0 before 8.0.1 that may allow leakage of information (account enumeration). |
CVE-2016-5765 | Medium | 6.5 | 2016-11-29 | Administrative Server in Micro Focus Host Access Management and Security Server (MSS) and Reflection for the Web (RWeb) and Reflection Security Gateway (RSG) a… |
CVE-2016-9176 | Critical | 9.8 | 2016-11-04 | Stack buffer overflow in the send.exe and receive.exe components of Micro Focus Rumba 9.4 and earlier could be used by local attackers or attackers able to inj… |
CVE-2016-5764 | High | 8.8 | 2016-10-27 | Micro Focus Rumba FTP 4.X client buffer overflow makes it possible to corrupt the stack and allow arbitrary code execution. Fixed in: Rumba FTP 4.5 (HF 14668)… |
CVE-2016-5228 | Critical | 9.8 | 2016-07-03 | Stack-based buffer overflow in the PlayMacro function in ObjectXMacro.ObjectXMacro in WdMacCtl.ocx in Micro Focus Rumba 9.x before 9.3 HF 11997 and 9.4.x befor… |
CVE-2016-1606 | Critical | 9.8 | 2016-07-03 | Multiple stack-based buffer overflows in COM objects in Micro Focus Rumba 9.4.x before 9.4 HF 13960 allow remote attackers to execute arbitrary code via (1) th… |
CVE-2016-1599 | Medium | 6.1 | 2016-03-24 | Cross-site scripting (XSS) vulnerability in NetIQ Self Service Password Reset (SSPR) 2.x and 3.x before 3.3.1 HF2 allows remote attackers to inject arbitrary w… |
CVE-2016-1991 | High | 8.0 | 2016-03-16 | HPE ArcSight ESM 5.x before 5.6, 6.0, 6.5.x before 6.5C SP1 Patch 2, and 6.8c before P1, and ArcSight ESM Express before 6.9.1, allows remote authenticated use… |
CVE-2016-1990 | High | 7.8 | 2016-03-16 | HPE ArcSight ESM 5.x before 5.6, 6.0, 6.5.x before 6.5C SP1 Patch 2, and 6.8c before P1, and ArcSight ESM Express before 6.9.1, allows local users to gain priv… |
CVE-2015-6030 | | 2015-11-04 | HP ArcSight Logger 6.0.0.7307.1, ArcSight Command Center 6.8.0.1896.0, and ArcSight Connector Appliance 6.4.0.6881.3 use the root account to execute files owne… | |
CVE-2015-6946 | | 2015-09-15 | Multiple stack-based buffer overflows in the Reprise License Manager service in Borland AccuRev allow remote attackers to execute arbitrary code via the (1) ak… | |
CVE-2015-0795 | | 2015-07-18 | Multiple stack-based buffer overflows in the SafeShellExecute method in the NetIQExecObject.NetIQExec.1 ActiveX control in NetIQExec.dll in NetIQ Security Solu… | |
CVE-2014-7885 | | 2015-03-14 | Multiple unspecified vulnerabilities in HP ArcSight Enterprise Security Manager (ESM) before 6.8c have unknown impact and remote attack vectors. | |
CVE-2014-9412 | | 2014-12-23 | Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.1 allow remote attackers to inject arbitrary web script or HTML… | |
CVE-2014-5217 | | 2014-12-23 | Cross-site request forgery (CSRF) vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Access Manager (NAM) 4.x before 4.1 allows… | |
CVE-2014-5216 | | 2014-12-23 | Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allow remote attackers to inject arbitrary web script or… | |
CVE-2014-5215 | | 2014-12-23 | NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allows remote authenticated administrators to discover service-account passwords via a request to (1) roma/jsp/… | |
CVE-2014-5214 | | 2014-12-23 | nps/servlet/webacc in iManager in the Administration Console server in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allows remote authenticated novlwww user… | |
CVE-2014-0602 | | 2014-07-07 | Directory traversal vulnerability in the DumpToFile method in the NQMcsVarSet ActiveX control in NetIQ Security Manager through 6.5.4 allows remote attackers t… | |
CVE-2014-3460 | | 2014-05-20 | Directory traversal vulnerability in the DumpToFile method in the NQMcsVarSet ActiveX control in Agent Manager in NetIQ Sentinel allows remote attackers to cre… | |
CVE-2013-4815 | | 2013-09-20 | Cross-site scripting (XSS) vulnerability in the web interface in HP ArcSight Enterprise Security Manager (ESM) before 5.5 allows remote attackers to inject arb… | |
CVE-2012-0432 | | 2012-12-25 | Stack-based buffer overflow in the Novell NCP implementation in NetIQ eDirectory 8.8.7.x before 8.8.7.2 allows remote attackers to have an unspecified impact v… | |
CVE-2012-0430 | | 2012-12-25 | Unspecified vulnerability in NetIQ eDirectory 8.8.6.x before 8.8.6.7 and 8.8.7.x before 8.8.7.2 on Windows allows remote attackers to obtain an administrator c… | |
CVE-2012-0429 | | 2012-12-25 | dhost in NetIQ eDirectory 8.8.6.x before 8.8.6.7 and 8.8.7.x before 8.8.7.2 on Windows allows remote authenticated users to cause a denial of service (daemon c… | |
CVE-2012-0428 | | 2012-12-25 | Cross-site scripting (XSS) vulnerability in NetIQ eDirectory 8.8.6.x before 8.8.6.7 and 8.8.7.x before 8.8.7.2 allows remote attackers to inject arbitrary web… | |
CVE-2012-5932 | | 2012-12-24 | Eval injection vulnerability in the ldapagnt_eval function in ldapagnt.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 allows remote… | |
CVE-2012-5931 | | 2012-12-24 | Directory traversal vulnerability in the set_log_config function in regclnt.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 allows re… | |
CVE-2012-5930 | | 2012-12-24 | The pa_modify_accounts function in auth.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 does not require authentication for the modif… | |
CVE-2008-7127 | | 2009-08-31 | osagent.exe in Borland VisiBroker Smart Agent 08.00.00.C1.03 and earlier allows remote attackers to cause a denial of service (crash) via a crafted packet with… | |
CVE-2008-7126 | | 2009-08-31 | Integer overflow in osagent.exe in Borland VisiBroker Smart Agent 08.00.00.C1.03 and earlier allows remote attackers to cause a denial of service (crash) and p… | |
CVE-2001-0208 | | 2001-06-02 | MicroFocus Cobol 4.1, with the AppTrack feature enabled, installs the mfaslmf directory and the nolicense file with insecure permissions, which allows local us… |