Opentext
242 CVEs across 107 Opentext products. Browse Opentext vulnerabilities, severities, and proof-of-concept exploits.
Opentext products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-11878 | Medium | 6.1 | 2026-06-24 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText Access Manager allows Cross-Site Scripting (XSS)… |
CVE-2026-11877 | High | 7.5 | 2026-06-24 | An unauthorized user can modify configuration through API calls that affects the OpenText Access Manager. This issue affects Access Manager before 5.1.3. |
CVE-2026-2123 | High | 7.8 | 2026-03-31 | A security audit identified a privilege escalation vulnerability in Operations Agent(<=OA 12.29) on Windows. Under specific conditions Operations Agent may run… |
CVE-2024-11604 | | 2026-03-27 | Insertion of Sensitive Information into Log File vulnerability in the SCIM Driver module in OpenText IDM Driver and Extensions on Windows, Linux, 64 bit allows… | |
CVE-2025-13478 | | 2026-03-27 | Cache misconfiguration vulnerability in OpenText Identity Manager on Windows, Linux allows remote authenticated users to obtain another user's session data via… | |
CVE-2026-3278 | Medium | 6.1 | 2026-03-18 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText™ ZENworks Service Desk allows Cross-Site Scripti… |
CVE-2025-12455 | High | 7.5 | 2026-03-13 | Observable response discrepancy vulnerability in OpenText™ Vertica allows Password Brute Forcing. The vulnerability could lead to Password Brute Forcing in V… |
CVE-2025-12454 | Medium | 6.1 | 2026-03-13 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText™ Vertica allows Reflected XSS. The vulnerabilit… |
CVE-2025-12453 | Medium | 6.1 | 2026-03-13 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText™ Vertica allows Reflected XSS. The vulnerabilit… |
CVE-2026-3266 | Critical | 9.8 | 2026-03-03 | Missing Authorization vulnerability in OpenText™ Filr allows Authentication Bypass. The vulnerability could allow unauthenticated users to get XSRF token and d… |
CVE-2025-9120 | | 2026-02-24 | Improper Control of Generation of Code ('Code Injection') vulnerability in OpenText™ Carbonite Safe Server Backup allows Code Injection. The vulnerability co… | |
CVE-2026-1658 | Medium | 5.3 | 2026-02-19 | User Interface (UI) Misrepresentation of Critical Information vulnerability in OpenText™ Directory Services allows Cache Poisoning. The vulnerability could b… |
CVE-2025-9208 | Medium | 5.4 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Web Site Management Server allows Stored… |
CVE-2025-8055 | Medium | 5.3 | 2026-02-19 | Server-Side Request Forgery (SSRF) vulnerability in OpenText™ XM Fax allows Server Side Request Forgery. The vulnerability could allow an attacker to perf… |
CVE-2025-8054 | High | 7.5 | 2026-02-19 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText™ XM Fax allows Path Traversal. The vulnerability cou… |
CVE-2025-13672 | Medium | 5.4 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Web Site Management Server allows Reflec… |
CVE-2025-13671 | Medium | 6.5 | 2026-02-19 | Cross-Site Request Forgery (CSRF) vulnerability in OpenText™ Web Site Management Server allows Cross Site Request Forgery. The vulnerability could make a user… |
CVE-2025-15579 | | 2026-02-18 | Deserialization of Untrusted Data vulnerability in OpenText™ Directory Services allows Object Injection. The vulnerability could lead to remote code executio… | |
CVE-2024-9432 | | 2026-01-30 | Cleartext Storage of Sensitive Information vulnerability in OpenText™ Vertica allows Retrieve Embedded Sensitive Data. The vulnerability could read Vertica… | |
CVE-2025-11884 | | 2025-11-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in opentext uCMDB allows Stored XSS. The vulnerabilit… | |
CVE-2025-8050 | Medium | 6.5 | 2025-10-21 | External Control of File Name or Path vulnerability in opentext Flipper allows Path Traversal. The vulnerability could allow a user to access files hosted on… |
CVE-2025-8053 | Critical | 9.1 | 2025-10-20 | Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Access Control Security Levels. The vulne… |
CVE-2025-8052 | High | 8.8 | 2025-10-20 | SQL Injection vulnerability in opentext Flipper allows SQL Injection. The vulnerability could allow a low privilege user to interact with the database in uni… |
CVE-2025-8051 | Medium | 6.5 | 2025-10-20 | Path Traversal vulnerability in opentext Flipper allows Absolute Path Traversal. The vulnerability could allow a user to access files hosted on the server. … |
CVE-2025-8049 | High | 8.8 | 2025-10-20 | Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Access Control Security Levels. The vulne… |
CVE-2025-8048 | Medium | 6.5 | 2025-10-20 | External Control of File Name or Path vulnerability in opentext Flipper allows Path Traversal. The vulnerability could allow a user to submit a stored local fi… |
CVE-2025-8716 | | 2025-09-11 | In Content Management versions 20.4- 25.3 authenticated attackers may exploit a complex cache poisoning technique to download unprotected files from the server… | |
CVE-2025-5808 | | 2025-08-29 | Improper Input Validation vulnerability in OpenText Self Service Password Reset allows Authentication Bypass.This issue affects Self Service Password Reset fro… | |
CVE-2025-3478 | | 2025-08-25 | A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText Enterprise Security Manager. The vulnerability could be remotely exploited. | |
CVE-2025-8997 | | 2025-08-25 | An Information Exposure vulnerability has been identified in OpenText Enterprise Security Manager. The vulnerability could be remotely exploited. | |
CVE-2025-8616 | | 2025-08-06 | A weakness identified in OpenText Advanced Authentication where a Malicious browser plugin can record and replay the user authentication process to bypass Auth… | |
CVE-2024-7650 | | 2025-07-10 | Improper Control of Generation of Code ('Code Injection') vulnerability in OpenText™ Directory Services allows Remote Code Inclusion. The vulnerability could a… | |
CVE-2025-0885 | | 2025-07-03 | Incorrect Authorization vulnerability in OpenText™ GroupWise allows Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability could… | |
CVE-2025-2236 | | 2025-05-27 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in OpenText Advanced Authentication allows Information Elicitation. Th… | |
CVE-2024-10865 | | 2025-05-14 | Improper Input validation leads to XSS or Cross-site Scripting vulnerability in OpenText Advanced Authentication. This issue affects Advanced Authentication ve… | |
CVE-2024-10864 | | 2025-05-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in OpenText Advanced Authentication. This issue affects Adva… | |
CVE-2025-3476 | | 2025-05-07 | Incorrect Authorization vulnerability in OpenText™ Operations Bridge Manager. The vulnerability could allows privilege escalation by authenticated users.This i… | |
CVE-2025-3272 | | 2025-05-07 | Incorrect Authorization vulnerability in OpenText™ Operations Bridge Manager. The vulnerability could allow authenticated users to change their password with… | |
CVE-2024-12706 | | 2025-04-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in OpenText™ Digital Asset Management. T he vulnerability c… | |
CVE-2024-12543 | | 2025-04-21 | User Enumeration and Data Integrity in Barcode functionality in OpenText Content Management versions 24.3-25.1on Windows and Linux allows a malicous authentica… | |
CVE-2025-2517 | | 2025-04-21 | Reference to Expired Domain Vulnerability in OpenText™ ArcSight Enterprise Security Manager. | |
CVE-2024-12863 | | 2025-04-21 | Stored XSS in Discussions in OpenText Content Management CE 20.2 to 25.1 on Windows and Linux allows authenticated malicious users to inject code into the syst… | |
CVE-2024-12862 | | 2025-04-21 | Incorrect Authorization vulnerability in the OpenText Content Server REST API on Windows, Linux allows users without the appropriate permissions to remove exte… | |
CVE-2024-12530 | | 2025-04-17 | Uncontrolled Search Path Element vulnerability in OpenText Secure Content Manager on Windows allows DLL Side-Loading.This issue affects Secure Content Manager… | |
CVE-2022-26323 | | 2025-04-17 | Incorrect Use of Privileged APIs vulnerability in OpenText™ Operations Bridge Manager, OpenText™ Operations Bridge Suite (Containerized), OpenText™ UCMDB ( Cla… | |
CVE-2025-0884 | | 2025-03-12 | Unquoted Search Path or Element vulnerability in OpenText™ Service Manager. The vulnerability could allow a user to gain SYSTEM privileges through Privilege… | |
CVE-2025-0883 | | 2025-03-12 | Improper Neutralization of Script in an Error Message Web Page vulnerability in OpenText™ Service Manager. The vulnerability could reveal sensitive informati… | |
CVE-2024-12799 | | 2025-03-05 | Insufficiently Protected Credentials vulnerability in OpenText Identity Manager Advanced Edition on Windows, Linux, 64 bit allows Privilege Abuse. This vulnera… | |
CVE-2024-8125 | | 2025-02-04 | Improper Validation of Specified Type of Input vulnerability in OpenText™ Content Management (Extended ECM) allows Parameter Injection. A bad actor with the… | |
CVE-2024-7085 | | 2025-01-15 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Solutions Business Manager (SBM) allows… | |
CVE-2024-12111 | High | 8.0 | 2024-12-19 | In a specific scenario a LDAP user can abuse the authentication process using injection attack in OpenText Privileged Access Manager that allows authentication… |
CVE-2021-22501 | | 2024-12-19 | Improper Restriction of XML External Entity Reference vulnerability in OpenText™ Operations Bridge Manager allows Input Data Manipulation. The vulnerability… | |
CVE-2019-17082 | | 2024-11-26 | Insufficiently Protected Credentials vulnerability in OpenText™ AccuRev allows Authentication Bypass. When installed on a Linux or Solaris system the vulnerab… | |
CVE-2024-10863 | | 2024-11-22 | : Insufficient Logging vulnerability in OpenText Secure Content Manager on Windows allows Audit Log Manipulation.This issue affects Secure Content Manager: fro… | |
CVE-2023-24467 | High | 8.8 | 2024-11-22 | Possible Command Injection in iManager GET parameter has been discovered in OpenText™ iManager 3.2.6.0000. |
CVE-2023-24466 | High | 7.5 | 2024-11-22 | Possible XML External Entity Injection in iManager GET parameter has been discovered in OpenText™ iManager 3.2.6.0200. |
CVE-2022-26324 | High | 7.6 | 2024-11-22 | Possible XSS in iManager URL for access Component has been discovered in OpenText™ iManager 3.2.6.0000. |
CVE-2021-38135 | High | 8.6 | 2024-11-22 | Possible External Service Interaction attack in iManager has been discovered in OpenText™ iManager 3.2.6.0000. |
CVE-2021-38134 | Medium | 6.1 | 2024-11-22 | Possible XSS in iManager URL for access Component has been discovered in OpenText™ iManager 3.2.5.0000. |
CVE-2021-38119 | Medium | 6.1 | 2024-11-22 | Possible Reflected Cross-Site Scripting (XSS) Vulnerability in iManager has been discovered in OpenText™ iManager 3.2.4.0000. |
CVE-2021-38118 | Medium | 5.5 | 2024-11-22 | Possible improper input validation Vulnerability in iManager has been discovered in OpenText™ iManager 3.2.4.0000. |
CVE-2021-38117 | High | 8.8 | 2024-11-22 | Possible Command injection Vulnerability in iManager has been discovered in OpenText™ iManager 3.2.4.0000. |
CVE-2021-38116 | High | 8.8 | 2024-11-22 | Possible Elevation of Privilege Vulnerability in iManager has been discovered in OpenText™ iManager. This impacts all versions before 3.2.5 |
CVE-2024-10923 | | 2024-11-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ ALM Octane Management allows Stored XSS… | |
CVE-2024-9841 | Medium | 6.1 | 2024-11-08 | A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in OpenText ArcSight Management Center and ArcSight Platform. The vulnerability could… |
CVE-2020-11859 | High | 7.6 | 2024-11-06 | Improper Input Validation vulnerability in OpenText iManager allows Cross-Site Scripting (XSS). This issue affects iManager before 3.2.3 |
CVE-2024-5532 | Medium | 4.8 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Operations Agent. The XSS vulnerabilit… |
CVE-2024-4692 | Low | 2.4 | 2024-10-16 | Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Acc… |
CVE-2024-4690 | High | 8.0 | 2024-10-16 | Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText A… |
CVE-2024-4211 | Low | 2.4 | 2024-10-16 | Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Acc… |
CVE-2024-4189 | High | 8.0 | 2024-10-16 | Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText A… |
CVE-2024-4184 | High | 8.0 | 2024-10-16 | Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText A… |
CVE-2023-32266 | | 2024-10-16 | Untrusted Search Path vulnerability in OpenText™ Application Lifecycle Management (ALM),Quality Center allows Code Inclusion. The vulnerability allows a user t… | |
CVE-2024-6360 | Critical | 9.8 | 2024-10-02 | Incorrect Permission Assignment for Critical Resource vulnerability in OpenText™ Vertica could allow Privilege Abuse and result in unauthorized access or privi… |
CVE-2022-26322 | Medium | 4.9 | 2024-09-12 | Possible Insertion of Sensitive Information into Log File Vulnerability in Identity Manager has been discovered in OpenText™ Identity Manager REST Driver. Th… |
CVE-2021-38133 | High | 7.4 | 2024-09-12 | Possible External Service Interaction attack in eDirectory has been discovered in OpenText™ eDirectory. This impact all version before 9.2.6.0000. |
CVE-2021-38132 | Medium | 5.3 | 2024-09-12 | Possible External Service Interaction attack in eDirectory has been discovered in OpenText™ eDirectory. This impact all version before 9.2.6.0000. |
CVE-2021-38131 | Medium | 5.4 | 2024-09-12 | Possible Cross-Site Scripting (XSS) Vulnerability in eDirectory has been discovered in OpenText™ eDirectory 9.2.5.0000. |
CVE-2021-22533 | Medium | 6.5 | 2024-09-12 | Possible Insertion of Sensitive Information into Log File Vulnerability in eDirectory has been discovered in OpenText™ eDirectory 9.2.4.0000. |
CVE-2021-22532 | High | 7.6 | 2024-09-12 | Possible NLDAP Denial of Service attack Vulnerability in eDirectory has been discovered in OpenText™ eDirectory before 9.2.4.0000. |
CVE-2021-22518 | Medium | 5.8 | 2024-09-12 | A vulnerability identified in OpenText™ Identity Manager AzureAD Driver that allows logging of sensitive information into log file. This impacts all versions… |
CVE-2021-22503 | Medium | 5.4 | 2024-09-12 | Possible Improper Neutralization of Input During Web Page Generation Vulnerability in eDirectory has been discovered in OpenText™ eDirectory 9.2.3.0000. |
CVE-2024-4556 | Medium | 5.7 | 2024-08-28 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText NetIQ Access Manager allows access the sensitive infor… |
CVE-2024-4555 | High | 7.7 | 2024-08-28 | Improper Privilege Management vulnerability in OpenText NetIQ Access Manager allows user account impersonation in specific scenario. This issue affects NetIQ A… |
CVE-2024-4554 | High | 7.3 | 2024-08-28 | Improper Input Validation vulnerability in OpenText NetIQ Access Manager leads to Cross-Site Scripting (XSS) attack. This issue affects Access Manager before 5… |
CVE-2021-38122 | Medium | 6.2 | 2024-08-28 | A Cross-Site Scripting vulnerable identified in NetIQ Advance Authentication that impacts the server functionality and disclose sensitive information. This iss… |
CVE-2021-38121 | High | 8.3 | 2024-08-28 | Insufficient or weak TLS protocol version identified in Advance authentication client server communication when specific service is accessed between devices. … |
CVE-2021-38120 | Medium | 5.1 | 2024-08-28 | A vulnerability identified in Advance Authentication that allows bash command Injection in administrative controlled functionality of backup due to improper ha… |
CVE-2021-22530 | High | 8.2 | 2024-08-28 | A vulnerability identified in NetIQ Advance Authentication that doesn't enforce account lockout when brute force attack is performed on API based login. This i… |
CVE-2021-22529 | Medium | 6.3 | 2024-08-28 | A vulnerability identified in NetIQ Advance Authentication that leaks sensitive server information. This issue affects NetIQ Advance Authentication version bef… |
CVE-2021-22509 | High | 8.1 | 2024-08-28 | A vulnerability identified in storing and reusing information in Advance Authentication. This issue can lead to leakage of sensitive data to unauthorized user… |
CVE-2024-7428 | | 2024-08-23 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in OpenText™ Network Node Manager i (NNMi) allows URL Redirector Abuse.This issue affects Net… | |
CVE-2024-7427 | | 2024-08-23 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Network Node Manager i (NNMi) could allo… | |
CVE-2023-7260 | High | 7.5 | 2024-08-22 | Path Traversal vulnerability discovered in OpenText™ CX-E Voice, affecting all version through 22.4. The vulnerability could allow arbitrarily access files o… |
CVE-2022-26328 | | 2024-08-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText Performance Center on Windows allows Cros… | |
CVE-2022-26327 | | 2024-08-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in OpenText Performance Center on Windows allows Retrieve Embedded Sensitive Data.This… | |
CVE-2020-11847 | High | 8.2 | 2024-08-21 | SSH authenticated user when access the PAM server can execute an OS command to gain the full system access using bash. This issue affects Privileged Access Man… |
CVE-2020-11846 | High | 8.7 | 2024-08-21 | A vulnerability found in OpenText Privileged Access Manager that issues a token. on successful issuance of the token, a cookie gets set that allows unrestricte… |
CVE-2020-11850 | High | 7.3 | 2024-08-21 | Improper Input Validation vulnerability in OpenText Self Service Password Reset allows Cross-Site Scripting (XSS). This issue affects Self Service Password Res… |
CVE-2023-7249 | Critical | 9.8 | 2024-08-12 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText OpenText Directory Services allows Path Traversal.This… |