Overview 99 matches · 0 in Waratek scope · 0 protected · 3 exploited · 1 CISA KEV · 11 public PoC · 4 EPSS ≥ 0.5
99matches
0in Waratek scope0.0%
0protected0.0%
3exploited3.0%
1CISA KEV1.0%
11public PoC11.1%
4EPSS ≥ 0.54.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
1
1.0%
Not applicable
98
99.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
99
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
3
3.0%
Working exploit published
9
9.1%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
87
87.9%
split by
peak 21 / year
20091
Not applicable1
High1
not blocked1
Working exploit published1
20100
20110
20122
Not applicable2
High2
not blocked2
Exploited1
Working exploit published1
20130
20141
Not applicable1
High1
not blocked1
No public exploit1
20153
Not applicable3
High3
not blocked3
No public exploit3
20163
Not applicable3
High3
not blocked3
Working exploit published1
No public exploit2
20178
Not applicable8
High8
not blocked8
Working exploit published1
No public exploit7
201810
Not applicable10
High10
not blocked10
No public exploit10
201919
Outside Waratek scope1
Not applicable18
High19
not blocked19
Exploited1
Working exploit published2
No public exploit16
202010
Not applicable10
High10
not blocked10
Working exploit published3
No public exploit7
202112
Not applicable12
High12
not blocked12
Exploited1
No public exploit11
20223
Not applicable3
High3
not blocked3
No public exploit3
20234
Not applicable4
High4
not blocked4
No public exploit4
202421
Not applicable21
High21
not blocked21
No public exploit21
20250
20262
Not applicable2
High2
not blocked2
No public exploit2
201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-11878 | High | 2026-06-24 | Not applicable | No public exploit | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText Access Manager allows Cross-Site Scripting (XSS). This issue affects Access Manager: from 5.1 through 5.1.2. |
| CVE-2026-2123 | High | 2026-03-31 | Not applicable | No public exploit | A security audit identified a privilege escalation vulnerability in Operations Agent(<=OA 12.29) on Windows. Under specific conditions Operations Agent may run executables from specific writeable locations.Thanks to Manuel Rickli & Philippe Leiser of Oneconsult AG for reporting this vulnerability |
| CVE-2022-26324 | High | 2024-11-22 | Not applicable | No public exploit | Possible XSS in iManager URL for access Component has been discovered in OpenText™ iManager 3.2.6.0000. |
| CVE-2021-38118 | High | 2024-11-22 | Not applicable | No public exploit | Possible improper input validation Vulnerability in iManager has been discovered in OpenText™ iManager 3.2.4.0000. |
| CVE-2021-38116 | High | 2024-11-22 | Not applicable | No public exploit | Possible Elevation of Privilege Vulnerability in iManager has been discovered in OpenText™ iManager. This impacts all versions before 3.2.5 |
| CVE-2024-9841 | High | 2024-11-08 | Not applicable | No public exploit | A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in OpenText ArcSight Management Center and ArcSight Platform. The vulnerability could be remotely exploited. |
| CVE-2020-11859 | High | 2024-11-06 | Not applicable | No public exploit | Improper Input Validation vulnerability in OpenText iManager allows Cross-Site Scripting (XSS). This issue affects iManager before 3.2.3 |
| CVE-2021-38133 | High | 2024-09-12 | Not applicable | No public exploit | Possible External Service Interaction attack in eDirectory has been discovered in OpenText™ eDirectory. This impact all version before 9.2.6.0000. |
| CVE-2021-22532 | High | 2024-09-12 | Not applicable | No public exploit | Possible NLDAP Denial of Service attack Vulnerability in eDirectory has been discovered in OpenText™ eDirectory before 9.2.4.0000. |
| CVE-2024-4556 | High | 2024-08-28 | Not applicable | No public exploit | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText NetIQ Access Manager allows access the sensitive information. This issue affects NetIQ Access Manager before 5.0.4 and before 5.1. |
| CVE-2024-4555 | High | 2024-08-28 | Not applicable | No public exploit | Improper Privilege Management vulnerability in OpenText NetIQ Access Manager allows user account impersonation in specific scenario. This issue affects NetIQ Access Manager before 5.0.4.1 and before 5.1 |
| CVE-2024-4554 | High | 2024-08-28 | Not applicable | No public exploit | Improper Input Validation vulnerability in OpenText NetIQ Access Manager leads to Cross-Site Scripting (XSS) attack. This issue affects Access Manager before 5.0.4.1 and 5.1. |
| CVE-2021-38122 | High | 2024-08-28 | Not applicable | No public exploit | A Cross-Site Scripting vulnerable identified in NetIQ Advance Authentication that impacts the server functionality and disclose sensitive information. This issue affects NetIQ Advance Authentication before 6.3.5.1 |
| CVE-2021-38121 | High | 2024-08-28 | Not applicable | No public exploit | Insufficient or weak TLS protocol version identified in Advance authentication client server communication when specific service is accessed between devices. This issue affects NetIQ Advance Authentication versions before 6.3.5.1 |
| CVE-2021-38120 | High | 2024-08-28 | Not applicable | No public exploit | A vulnerability identified in Advance Authentication that allows bash command Injection in administrative controlled functionality of backup due to improper handling in provided command parameters. This issue affects NetIQ Advance Authentication version before 6.3.5.1. |
| CVE-2021-22509 | High | 2024-08-28 | Not applicable | No public exploit | A vulnerability identified in storing and reusing information in Advance Authentication. This issue can lead to leakage of sensitive data to unauthorized user. The issue affects NetIQ Advance Authentication before 6.3.5.1 |
| CVE-2020-11850 | High | 2024-08-21 | Not applicable | No public exploit | Improper Input Validation vulnerability in OpenText Self Service Password Reset allows Cross-Site Scripting (XSS). This issue affects Self Service Password Reset before 4.5.0.2 and 4.4.0.6 |
| CVE-2020-11847 | High | 2024-08-21 | Not applicable | No public exploit | SSH authenticated user when access the PAM server can execute an OS command to gain the full system access using bash. This issue affects Privileged Access Manager before 3.7.0.1. |
| CVE-2020-11846 | High | 2024-08-21 | Not applicable | No public exploit | A vulnerability found in OpenText Privileged Access Manager that issues a token. on successful issuance of the token, a cookie gets set that allows unrestricted access to all the application resources. This issue affects Privileged Access Manager before 3.7.0.1. |
| CVE-2024-4429 | High | 2024-05-28 | Not applicable | No public exploit | Cross-Site Request Forgery vulnerability has been discovered in OpenText™ iManager 3.2.6.0200. This could lead to sensitive information disclosure. |
| CVE-2024-3970 | High | 2024-05-15 | Not applicable | No public exploit | Server Side Request Forgery vulnerability has been discovered in OpenText™ iManager 3.2.6.0200. This could lead to senstive information disclosure by directory traversal. |
| CVE-2024-3485 | High | 2024-05-15 | Not applicable | No public exploit | Server Side Request Forgery vulnerability has been discovered in OpenText™ iManager 3.2.6.0200. This could lead to senstive information disclosure. |
| CVE-2024-0622 | High | 2024-02-15 | Not applicable | No public exploit | Local privilege escalation vulnerability affects OpenText Operations Agent product versions 12.15 and 12.20-12.25 when installed on Non-Windows platforms. The vulnerability could allow local privilege escalation. |
| CVE-2023-32268 | High | 2023-12-06 | Not applicable | No public exploit | Exposure of Proxy Administrator Credentials An authenticated administrator equivalent Filr user can access the credentials of proxy administrators. |
| CVE-2023-4964 | High | 2023-10-30 | Not applicable | No public exploit | Potential open redirect vulnerability in opentext Service Management Automation X (SMAX) versions 2020.05, 2020.08, 2020.11, 2021.02, 2021.05, 2021.08, 2021.11, 2022.05, 2022.11 and opentext Asset Management X (AMX) versions 2021.08, 2021.11, 2022.05, 2022.11. The vulnerability could allow attackers to redirect a user to malicious websites. |
| CVE-2023-32267 | High | 2023-08-11 | Not applicable | No public exploit | A potential vulnerability has been identified in OpenText / Micro Focus ArcSight Management Center. The vulnerability could be remotely exploited. |
| CVE-2023-32265 | High | 2023-07-20 | Not applicable | No public exploit | A potential security vulnerability has been identified in the Enterprise Server Common Web Administration (ESCWA) component used in Enterprise Server, Enterprise Test Server, Enterprise Developer, Visual COBOL, and COBOL Server. An attacker would need to be authenticated into ESCWA to attempt to exploit this vulnerability. As described in the hardening guide in the product documentation, other mitigations including restricting network access to ESCWA and restricting users’ permissions in the Micro Focus Directory Server also reduce the exposure to this issue. Given the right conditions this vulnerability could be exploited to expose a service account password. The account corresponding to the exposed credentials usually has limited privileges and, in many cases would only be useful for extracting details of other user accounts and similar information. |
| CVE-2022-38757 | High | 2022-12-23 | Not applicable | No public exploit | A vulnerability has been identified in Micro Focus ZENworks 2020 Update 3a and prior versions. This vulnerability allows administrators with rights to perform actions (e.g., install a bundle) on a set of managed devices, to be able to exercise these rights on managed devices in the ZENworks zone but which are outside the scope of the administrator. This vulnerability does not result in the administrators gaining additional rights on the managed devices, either in the scope or outside the scope of the administrator. |
| CVE-2022-38754 | High | 2022-12-08 | Not applicable | No public exploit | A potential vulnerability has been identified in Micro Focus Operations Bridge - Containerized. The vulnerability could be exploited by a malicious authenticated OBM (Operations Bridge Manager) user to run Java Scripts in the browser context of another OBM user. Please note: The vulnerability is only applicable if the Operations Bridge Manager capability is deployed. A potential vulnerability has been identified in Micro Focus Operations Bridge Manager (OBM). The vulnerability could be exploited by a malicious authenticated OBM user to run Java Scripts in the browser context of another OBM user. This issue affects: Micro Focus Micro Focus Operations Bridge Manager versions prior to 2022.11. Micro Focus Micro Focus Operations Bridge- Containerized versions prior to 2022.11. |
| CVE-2022-26330 | High | 2022-08-31 | Not applicable | No public exploit | Potential vulnerabilities have been identified in Micro Focus ArcSight Logger. The vulnerabilities could be remotely exploited resulting in Information Disclosure, or Self Cross-Site Scripting (XSS). This issue affects: Micro Focus ArcSight Logger versions prior to v7.2.2 version and prior versions. |
| CVE-2021-22528 | High | 2021-09-13 | Not applicable | No public exploit | Reflected Cross Site Scripting (XSS) vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4 |
| CVE-2021-22527 | High | 2021-09-13 | Not applicable | No public exploit | Information leakage vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4 |
| CVE-2021-22517 | High | 2021-08-05 | Not applicable | No public exploit | A potential unauthorized privilege escalation vulnerability has been identified in Micro Focus Data Protector. The vulnerability affects versions 10.10, 10.20, 10.30, 10.40, 10.50, 10.60, 10.70, 10.80, 10.0 and 10.91. A privileged user may potentially misuse this feature and thus allow unintended and unauthorized access of data. |
| CVE-2021-22523 | High | 2021-07-22 | Not applicable | No public exploit | XML External Entity vulnerability in Micro Focus Verastream Host Integrator, affecting version 7.8 Update 1 and earlier versions. The vulnerability could allow the control of web browser and hijacking user sessions. |
| CVE-2021-22522 | High | 2021-07-22 | Not applicable | No public exploit | Reflected Cross-Site Scripting vulnerability in Micro Focus Verastream Host Integrator, affecting version version 7.8 Update 1 and earlier versions. The vulnerability could allow disclosure of confidential data. |
| CVE-2021-22516 | High | 2021-06-04 | Not applicable | No public exploit | Insertion of Sensitive Information into Log File vulnerability in Micro Focus Secure API Manager (SAPIM) product, affecting version 2.0.0. The vulnerability could lead to sensitive information being in a log file. |
| CVE-2021-22497 | High | 2021-04-12 | Not applicable | No public exploit | Advanced Authentication versions prior to 6.3 SP4 have a potential broken authentication due to improper session management issue. |
| CVE-2021-22506 | High | 2021-03-26 | Not applicable | Exploited | Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all versions prior to version 5.0. The vulnerability could cause information leakage. |
| CVE-2021-22496 | High | 2021-03-25 | Not applicable | No public exploit | Authentication Bypass Vulnerability in Micro Focus Access Manager Product, affects all version prior to version 4.5.3.3. The vulnerability could cause information leakage. |
| CVE-2019-18945 | High | 2021-02-26 | Not applicable | No public exploit | Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to privilege escalation vulnerability. |
| CVE-2019-18943 | High | 2021-02-26 | Not applicable | No public exploit | Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to XML External Entity Processing (XXE) on certain operations. |
| CVE-2021-22498 | High | 2021-01-19 | Not applicable | No public exploit | XML External Entity Injection vulnerability in Micro Focus Application Lifecycle Management (Previously known as Quality Center) product. The vulnerability affects versions 12.x, 12.60 Patch 5 and earlier, 15.0.1 Patch 2 and earlier and 15.5. The vulnerability could be exploited to allow an XML External Entity Injection. |
| CVE-2020-25837 | High | 2020-11-05 | Not applicable | No public exploit | Sensitive information disclosure vulnerability in Micro Focus Self Service Password Reset (SSPR) product. The vulnerability affects versions 4.4.0.0 to 4.4.0.6 and 4.5.0.1 and 4.5.0.2. In certain configurations the vulnerability could disclose sensitive information. |
| CVE-2020-11858 | High | 2020-10-27 | Not applicable | Working exploit published | Code execution with escalated privileges vulnerability in Micro Focus products Operation Bridge Manager and Operation Bridge (containerized). The vulneravility affects: 1.) Operation Bridge Manager versions: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions. 2.) Operations Bridge (containerized) versions: 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05. 2018.02 and 2017.11. The vulnerability could allow local attackers to execute code with escalated privileges. |
| CVE-2020-11853 | High | 2020-10-22 | Not applicable | Working exploit published | Arbitrary code execution vulnerability affecting multiple Micro Focus products. 1.) Operation Bridge Manager affecting version: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, versions 10.6x and 10.1x and older versions. 2.) Application Performance Management affecting versions : 9.51, 9.50 and 9.40 with uCMDB 10.33 CUP 3 3.) Data Center Automation affected version 2019.11 4.) Operations Bridge (containerized) affecting versions: 2019.11, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05, 2018.02, 2017.11 5.) Universal CMDB affecting version: 2020.05, 2019.11, 2019.05, 2019.02, 2018.11, 2018.08, 2018.05, 11, 10.33, 10.32, 10.31, 10.30 6.) Hybrid Cloud Management affecting version 2020.05 7.) Service Management Automation affecting version 2020.5 and 2020.02. The vulnerability could allow to execute arbitrary code. |
| CVE-2020-11855 | High | 2020-09-22 | Not applicable | Working exploit published | An Authorization Bypass vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier. The vulnerability could allow local attackers on the OBR host to execute code with escalated privileges. |
| CVE-2020-11861 | High | 2020-09-18 | Not applicable | No public exploit | Unauthorized escalation of local privileges vulnerability on Micro Focus Operation Agent, affecting all versions prior to versions 12.11. The vulnerability could be exploited to escalate the local privileges and gain root access on the system. |
| CVE-2020-11848 | High | 2020-08-19 | Not applicable | No public exploit | Denial of service vulnerability on Micro Focus ArcSight Management Center. Affecting all versions prior to version 2.9.5. The vulnerability could cause the server to become unavailable, causing a denial of service. |
| CVE-2020-11852 | High | 2020-08-07 | Not applicable | No public exploit | DKIM key management page vulnerability on Micro Focus Secure Messaging Gateway (SMG). Affecting all SMG Appliance running releases prior to July 2020. The vulnerability could allow a logged in user with rights to generate DKIM key information to inject system commands into the call to the DKIM system command. |
| CVE-2020-11842 | High | 2020-05-04 | Not applicable | No public exploit | Information disclosure vulnerability in Micro Focus Verastream Host Integrator (VHI) product, affecting versions earlier than 7.8 Update 1 (7.8.49 or 7.8.0.49). The vulnerability allows an unauthenticated attackers to view information they may not have been authorized to view. |
| CVE-2020-9523 | High | 2020-04-17 | Not applicable | No public exploit | Insufficiently protected credentials vulnerability on Micro Focus enterprise developer and enterprise server, affecting all version prior to 4.0 Patch Update 16, and version 5.0 Patch Update 6. The vulnerability could allow an attacker to transmit hashed credentials for the user account running the Micro Focus Directory Server (MFDS) to an arbitrary site, compromising that account's security. |
| CVE-2020-9521 | High | 2020-03-26 | Not applicable | No public exploit | An SQL injection vulnerability was discovered in Micro Focus Service Manager Automation (SMA), affecting versions 2019.08, 2019.05, 2019.02, 2018.08, 2018.05, 2018.02. The vulnerability could allow for the improper neutralization of special elements in SQL commands and may lead to the product being vulnerable to SQL injection. |
| CVE-2019-11657 | High | 2019-12-17 | Not applicable | No public exploit | Cross-Site Request Forgery vulnerability in all Micro Focus ArcSight Logger affecting all product versions below version 7.0. The vulnerability could be exploited to perform CSRF attack. |
| CVE-2019-17087 | High | 2019-12-11 | Not applicable | No public exploit | Unauthorized file download vulnerability in all supported versions of Micro Focus AcuToWeb. The vulnerability could be exploited to enumerate and download files from the filesystem of the system running AcuToWeb, with the privileges of the account AcuToWeb is running under. |
| CVE-2019-11661 | High | 2019-09-18 | Not applicable | No public exploit | Allow changes to some table by non-SysAdmin in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. This vulnerability could be exploited to allow unauthorized access and modification of data. |
| CVE-2019-11667 | High | 2019-09-17 | Not applicable | No public exploit | Unauthorized access to contact information in Micro Focus Service Manager, versions 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerability could be exploited to allow unauthorized access to private data. |
| CVE-2019-11666 | High | 2019-09-17 | Not applicable | No public exploit | Insecure deserialization of untrusted data in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerability could be exploited to allow insecure deserialization of untrusted data. |
| CVE-2019-11665 | High | 2019-09-17 | Not applicable | No public exploit | Data exposure in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerability could be exploited to allow sensitive data exposure. |
| CVE-2019-11660 | High | 2019-09-13 | Not applicable | Working exploit published | Privileges manipulation in Micro Focus Data Protector, versions 10.00, 10.01, 10.02, 10.03, 10.04, 10.10, 10.20, 10.30, 10.40. This vulnerability could be exploited by a low-privileged user to execute a custom binary with higher privileges. |
| CVE-2019-11669 | High | 2019-09-10 | Not applicable | No public exploit | Modifiable read only check box In Micro Focus Service Manager, versions 9.60p1, 9.61, 9.62. This vulnerability could be exploited to allow unauthorized modification of data. |
| CVE-2019-11668 | High | 2019-09-10 | Not applicable | No public exploit | HTTP cookie in Micro Focus Service manager, Versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. And Micro Focus Service Manager Chat Server, versions 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. And Micro Focus Service Manager Chat Service 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. |
| CVE-2019-11654 | High | 2019-08-23 | Not applicable | No public exploit | Path traversal vulnerability in Micro Focus Verastream Host Integrator (VHI), versions 7.7 SP2 and earlier, The vulnerability allows remote unauthenticated attackers to read arbitrary files. |
| CVE-2019-11646 | High | 2019-06-03 | Not applicable | No public exploit | Remote unauthorized command execution and unauthorized disclosure of information in Micro Focus Service Manager, versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61. This vulnerability could allow Remote unauthorized command execution and unauthorized disclosure of information. |
| CVE-2016-1600 | High | 2019-05-09 | Not applicable | No public exploit | The ServiceNow driver in NetIQ Identity Manager versions prior to 4.6 are susceptible to an information disclosure vulnerability. |
| CVE-2019-3493 | High | 2019-04-29 | Not applicable | No public exploit | A potential security vulnerability has been identified in Micro Focus Network Automation Software 9.20, 9.21, 10.00, 10.10, 10.20, 10.30, 10.40, 10.50, 2018.05, 2018.08, 2018.11, and Micro Focus Network Operations Management (NOM) all versions. The vulnerability could be remotely exploited to Remote Code Execution. |
| CVE-2019-3489 | High | 2019-04-01 | Not applicable | No public exploit | An unauthenticated file upload vulnerability has been identified in the Web Client component of Micro Focus Content Manager 9.1, 9.2, and 9.3 when configured to use the ADFS authentication method. The vulnerability could be exploited by an unauthenticated remote attacker to upload content to arbitrary locations on the Content Manager server. |
| CVE-2018-19643 | High | 2019-03-27 | Not applicable | No public exploit | Information leakage issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5. |
| CVE-2018-19642 | High | 2019-03-27 | Not applicable | No public exploit | Denial of service issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5. |
| CVE-2016-9166 | High | 2019-03-21 | Not applicable | No public exploit | NetIQ eDirectory versions prior to 9.0.2, under some circumstances, could be susceptible to downgrade of communication security. |
| CVE-2019-3475 | High | 2019-02-20 | Not applicable | Working exploit published | A local privilege escalation vulnerability in the famtd component of Micro Focus Filr 3.0 allows a local attacker authenticated as a low privilege user to escalate to root. This vulnerability affects all versions of Filr 3.x prior to Security Update 6. |
| CVE-2019-5736 | High | 2019-02-11 | Outside Waratek scope | Exploited | runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe. |
| CVE-2018-17950 | High | 2018-12-12 | Not applicable | No public exploit | Incorrect enforcement of authorization checks in eDirectory prior to 9.1 SP2 |
| CVE-2018-18589 | High | 2018-10-23 | Not applicable | No public exploit | A potential Remote Arbitrary Code Execution vulnerability has been identified in Micro Focus' Real User Monitoring software, versions 9.26IP, 9.30, 9.40 and 9.50. The vulnerability could be exploited to execute arbitrary code. |
| CVE-2018-12469 | High | 2018-10-12 | Not applicable | No public exploit | Incorrect handling of an invalid value for an HTTP request parameter by Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 Update 2 and earlier, 3.0 before Patch Update 12, and 4.0 before Patch Update 2 causes a null pointer dereference (CWE-476) and subsequent denial of service due to process termination. |
| CVE-2018-6504 | High | 2018-09-20 | Not applicable | No public exploit | A potential Cross-Site Request Forgery (CSRF) vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81. This vulnerability could be exploited to allow for Cross-Site Request Forgery (CSRF). |
| CVE-2018-7686 | High | 2018-08-09 | Not applicable | No public exploit | Information leakage vulnerability in NetIQ eDirectory before 9.1.1 HF1 due to shared memory usage. |
| CVE-2018-7683 | High | 2018-06-21 | Not applicable | No public exploit | Micro Focus Solutions Business Manager versions prior to 11.4 might reveal certain sensitive information in server log files. |
| CVE-2018-6497 | High | 2018-06-16 | Not applicable | No public exploit | Remote Cross-site Request forgery (CSRF) potential has been identified in UCMBD Server version DDM Content Pack V 10.20, 10.21, 10.22, 10.22 CUP7, 10.30, 10.31, 10.32, 10.33, 10.33 CUP2, 11.0 and CMS Server version 2018.05 BACKGROUND which could allow for remote unsafe deserialization and cross-site request forgery (CSRF). |
| CVE-2018-6496 | High | 2018-06-16 | Not applicable | No public exploit | Remote Cross-site Request forgery (CSRF) potential has been identified in UCMBD Browser version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15, 4.15.1 which could allow for remote unsafe deserialization and cross-site request forgery (CSRF). |
| CVE-2018-7687 | High | 2018-05-21 | Not applicable | No public exploit | The Micro Focus Client for OES before version 2 SP4 IR8a has a vulnerability that could allow a local attacker to elevate privileges via a buffer overflow in ncfsd.sys. |
| CVE-2017-7429 | High | 2018-03-02 | Not applicable | No public exploit | The certificate upload in NetIQ eDirectory PKI plugin before 8.8.8 Patch 10 Hotfix 1 could be abused to upload JSP code which could be used by authenticated attackers to execute JSP applets on the iManager server. |
| CVE-2017-14362 | High | 2017-12-13 | Not applicable | No public exploit | Cross-Site Request Forgery vulnerability in Micro Focus Project and Portfolio Management Center, version 9.32. This vulnerability could be exploited to allow a Cross-Site Forgery attack. |
| CVE-2017-14361 | High | 2017-12-13 | Not applicable | No public exploit | Man-In-The-Middle vulnerability in Micro Focus Project and Portfolio Management Center, version 9.32. This vulnerability could be exploited to allow a Man-in-the-middle attack. |
| CVE-2017-14355 | High | 2017-12-05 | Not applicable | Working exploit published | A potential security vulnerability has been identified in HPE Connected Backup versions 8.6 and 8.8.6. The vulnerability could be exploited locally to allow escalation of privilege. |
| CVE-2017-9272 | High | 2017-10-06 | Not applicable | No public exploit | The Bi-directional driver in IDM 4.5 before 4.0.3.0 could be susceptible to a denial of service attack. |
| CVE-2017-9281 | High | 2017-09-21 | Not applicable | No public exploit | An integer overflow (CWE-190) potentially causing an out-of-bounds read (CWE-125) vulnerability in Micro Focus VisiBroker 8.5 can lead to a denial of service. |
| CVE-2017-7423 | High | 2017-08-21 | Not applicable | No public exploit | A Cross-Site Request Forgery (CWE-352) vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to forge requests, if this component is configured. This includes creating new privileged credentials, resulting in privilege elevation (CWE-275). Note esfadmingui is not enabled by default. |
| CVE-2017-5187 | High | 2017-08-21 | Not applicable | No public exploit | A Cross-Site Request Forgery (CWE-352) vulnerability in Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to view and alter (CWE-275) configuration information and inject OS commands (CWE-78) via forged requests. |
| CVE-2017-5185 | High | 2017-03-30 | Not applicable | No public exploit | A vulnerability was discovered in NetIQ Sentinel Server 8.0 before 8.0.1 that may allow remote denial of service. |
| CVE-2016-5764 | High | 2016-10-27 | Not applicable | Working exploit published | Micro Focus Rumba FTP 4.X client buffer overflow makes it possible to corrupt the stack and allow arbitrary code execution. Fixed in: Rumba FTP 4.5 (HF 14668). This can only occur if a client connects to a malicious server. |
| CVE-2016-1991 | High | 2016-03-16 | Not applicable | No public exploit | HPE ArcSight ESM 5.x before 5.6, 6.0, 6.5.x before 6.5C SP1 Patch 2, and 6.8c before P1, and ArcSight ESM Express before 6.9.1, allows remote authenticated users to conduct unspecified "file download" attacks via unknown vectors. |
| CVE-2016-1990 | High | 2016-03-16 | Not applicable | No public exploit | HPE ArcSight ESM 5.x before 5.6, 6.0, 6.5.x before 6.5C SP1 Patch 2, and 6.8c before P1, and ArcSight ESM Express before 6.9.1, allows local users to gain privileges for command execution via unspecified vectors. |
| CVE-2015-6030 | High | 2015-11-04 | Not applicable | No public exploit | HP ArcSight Logger 6.0.0.7307.1, ArcSight Command Center 6.8.0.1896.0, and ArcSight Connector Appliance 6.4.0.6881.3 use the root account to execute files owned by the arcsight user, which might allow local users to gain privileges by leveraging arcsight account access. |
| CVE-2015-6946 | High | 2015-09-15 | Not applicable | No public exploit | Multiple stack-based buffer overflows in the Reprise License Manager service in Borland AccuRev allow remote attackers to execute arbitrary code via the (1) akey or (2) actserver parameter to the activate_doit function or (3) licfile parameter to the service_startup_doit functionality. |
| CVE-2014-7885 | High | 2015-03-14 | Not applicable | No public exploit | Multiple unspecified vulnerabilities in HP ArcSight Enterprise Security Manager (ESM) before 6.8c have unknown impact and remote attack vectors. |
| CVE-2014-0602 | High | 2014-07-07 | Not applicable | No public exploit | Directory traversal vulnerability in the DumpToFile method in the NQMcsVarSet ActiveX control in NetIQ Security Manager through 6.5.4 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-3460. |
| CVE-2012-0432 | High | 2012-12-25 | Not applicable | Exploited | Stack-based buffer overflow in the Novell NCP implementation in NetIQ eDirectory 8.8.7.x before 8.8.7.2 allows remote attackers to have an unspecified impact via unknown vectors. |
| CVE-2012-5932 | High | 2012-12-24 | Not applicable | Working exploit published | Eval injection vulnerability in the ldapagnt_eval function in ldapagnt.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 allows remote attackers to execute arbitrary Perl code via a crafted application/x-amf request. |
| CVE-2008-7126 | High | 2009-08-31 | Not applicable | Working exploit published | Integer overflow in osagent.exe in Borland VisiBroker Smart Agent 08.00.00.C1.03 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet with a large string length value to UDP port 14000, which triggers a heap-based buffer overflow. |