Overview 111 matches · 7 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 8 public PoC · 0 EPSS ≥ 0.5
111matches
7in Waratek scope6.3%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
8public PoC7.2%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
7
6.3%
Outside Waratek scope
0
0.0%
Not applicable
104
93.7%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
111
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
8
7.2%
Proof of concept only
1
0.9%
Forecast only
0
0.0%
No public exploit
102
91.9%
split by
peak 17 / year
20011
Not applicable1
Medium1
not blocked1
Working exploit published1
20020
20030
20040
20050
20060
20070
20080
20091
Not applicable1
Medium1
not blocked1
No public exploit1
20100
20110
20125
Not applicable5
Medium5
not blocked5
Working exploit published2
No public exploit3
20131
Not applicable1
Medium1
not blocked1
No public exploit1
20146
Not applicable6
Medium6
not blocked6
Working exploit published2
No public exploit4
20151
Not applicable1
Medium1
not blocked1
No public exploit1
20162
Not applicable2
Medium2
not blocked2
No public exploit2
20176
Not applicable6
Medium6
not blocked6
No public exploit6
201815
Not applicable15
Medium15
not blocked15
Working exploit published2
No public exploit13
201915
Not applicable15
Medium15
not blocked15
Working exploit published1
No public exploit14
202016
Not applicable16
Medium16
not blocked16
No public exploit16
202117
No exploit published4
Not applicable13
Medium17
not blocked17
No public exploit17
202210
Not applicable10
Medium10
not blocked10
Proof of concept only1
No public exploit9
20235
No exploit published3
Not applicable2
Medium5
not blocked5
No public exploit5
20249
Not applicable9
Medium9
not blocked9
No public exploit9
20250
20261
Not applicable1
Medium1
not blocked1
No public exploit1
200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-11877 | Medium | 2026-06-24 | Not applicable | No public exploit | An unauthorized user can modify configuration through API calls that affects the OpenText Access Manager. This issue affects Access Manager before 5.1.3. |
| CVE-2021-38134 | Medium | 2024-11-22 | Not applicable | No public exploit | Possible XSS in iManager URL for access Component has been discovered in OpenText™ iManager 3.2.5.0000. |
| CVE-2021-38119 | Medium | 2024-11-22 | Not applicable | No public exploit | Possible Reflected Cross-Site Scripting (XSS) Vulnerability in iManager has been discovered in OpenText™ iManager 3.2.4.0000. |
| CVE-2024-4690 | Medium | 2024-10-16 | Not applicable | No public exploit | Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below. |
| CVE-2024-4189 | Medium | 2024-10-16 | Not applicable | No public exploit | Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below. |
| CVE-2024-4184 | Medium | 2024-10-16 | Not applicable | No public exploit | Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below. |
| CVE-2024-6360 | Medium | 2024-10-02 | Not applicable | No public exploit | Incorrect Permission Assignment for Critical Resource vulnerability in OpenText™ Vertica could allow Privilege Abuse and result in unauthorized access or privileges to Vertica agent apikey. This issue affects Vertica: from 10.0 through 10.X, from 11.0 through 11.X, from 12.0 through 12.X, from 23.0 through 23.X, from 24.0 through 24.X. |
| CVE-2021-38131 | Medium | 2024-09-12 | Not applicable | No public exploit | Possible Cross-Site Scripting (XSS) Vulnerability in eDirectory has been discovered in OpenText™ eDirectory 9.2.5.0000. |
| CVE-2021-22503 | Medium | 2024-09-12 | Not applicable | No public exploit | Possible Improper Neutralization of Input During Web Page Generation Vulnerability in eDirectory has been discovered in OpenText™ eDirectory 9.2.3.0000. |
| CVE-2021-22529 | Medium | 2024-08-28 | Not applicable | No public exploit | A vulnerability identified in NetIQ Advance Authentication that leaks sensitive server information. This issue affects NetIQ Advance Authentication version before 6.3.5.1 |
| CVE-2020-25835 | Medium | 2023-12-09 | Not applicable | No public exploit | A potential vulnerability has been identified in Micro Focus ArcSight Management Center. The vulnerability could be remotely exploited resulting in stored Cross-Site Scripting (XSS). |
| CVE-2023-32263 | Medium | 2023-07-19 | No exploit published | No public exploit | A potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability could be exploited to retrieve a login certificate if an authenticated user is duped into using an attacker-controlled Dimensions CM server. This vulnerability only applies when the Jenkins plugin is configured to use login certificate credentials. https://www.jenkins.io/security/advisory/2023-06-14/ |
| CVE-2023-32262 | Medium | 2023-07-19 | No exploit published | No public exploit | A potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability allows attackers with Item/Configure permission to access and capture credentials they are not entitled to. See the following Jenkins security advisory for details: * https://www.jenkins.io/security/advisory/2023-06-14/ https://www.jenkins.io/security/advisory/2023-06-14/ |
| CVE-2023-32261 | Medium | 2023-07-19 | No exploit published | No public exploit | A potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. See the following Jenkins security advisory for details: * https://www.jenkins.io/security/advisory/2023-06-14/ https://www.jenkins.io/security/advisory/2023-06-14/ |
| CVE-2023-24469 | Medium | 2023-06-13 | Not applicable | No public exploit | Potential Cross-Site Scripting in ArcSight Logger versions prior to 7.3.0 |
| CVE-2022-38756 | Medium | 2022-12-16 | Not applicable | Proof of concept only | A vulnerability has been identified in Micro Focus GroupWise Web in versions prior to 18.4.2. The GW Web component makes a request to the Post Office Agent that contains sensitive information in the query parameters that could be logged by any intervening HTTP proxies. |
| CVE-2022-38753 | Medium | 2022-11-28 | Not applicable | No public exploit | This update resolves a multi-factor authentication bypass attack |
| CVE-2022-38755 | Medium | 2022-11-21 | Not applicable | No public exploit | A vulnerability has been identified in Micro Focus Filr in versions prior to 4.3.1.1. The vulnerability could be exploited to allow a remote unauthenticated attacker to enumerate valid users of the system. Remote unauthenticated user enumeration. This issue affects: Micro Focus Filr versions prior to 4.3.1.1. |
| CVE-2022-26331 | Medium | 2022-08-31 | Not applicable | No public exploit | Potential vulnerabilities have been identified in Micro Focus ArcSight Logger. The vulnerabilities could be remotely exploited resulting in Information Disclosure, or Self Cross-Site Scripting (XSS). This issue affects: Micro Focus ArcSight Logger versions prior to v7.2.2 version and prior versions. |
| CVE-2021-22531 | Medium | 2022-05-12 | Not applicable | No public exploit | A bug exist in the input parameter of Access Manager that allows supply of invalid character to trigger cross-site scripting vulnerability. This affects NetIQ Access Manager 4.5 and 5.0 |
| CVE-2022-26326 | Medium | 2022-05-02 | Not applicable | No public exploit | Potential open redirection vulnerability when URL is crafted in specific format in NetIQ Access Manager prior to 5.0.2 |
| CVE-2022-26325 | Medium | 2022-05-02 | Not applicable | No public exploit | Reflected Cross Site Scripting (XSS) vulnerability in NetIQ Access Manager prior to 5.0.2 |
| CVE-2021-38130 | Medium | 2022-02-04 | Not applicable | No public exploit | A potential Information leakage vulnerability has been identified in versions of Micro Focus Voltage SecureMail Mail Relay prior to 7.3.0.1. The vulnerability could be exploited to create an information leakage attack. |
| CVE-2021-38127 | Medium | 2022-01-14 | Not applicable | No public exploit | Potential vulnerabilities have been identified in Micro Focus ArcSight Enterprise Security Manager, affecting versions 7.4.x and 7.5.x. The vulnerabilities could be remotely exploited resulting in Cross-Site Scripting (XSS). |
| CVE-2021-38126 | Medium | 2022-01-14 | Not applicable | No public exploit | Potential vulnerabilities have been identified in Micro Focus ArcSight Enterprise Security Manager, affecting versions 7.4.x and 7.5.x. The vulnerabilities could be remotely exploited resulting in Cross-Site Scripting (XSS). |
| CVE-2021-22535 | Medium | 2021-09-28 | Not applicable | No public exploit | Unauthorized information security disclosure vulnerability on Micro Focus Directory and Resource Administrator (DRA) product, affecting all DRA versions prior to 10.1 Patch 1. The vulnerability could lead to unauthorized information disclosure. |
| CVE-2021-22526 | Medium | 2021-09-13 | Not applicable | No public exploit | Open Redirection vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4 |
| CVE-2021-22524 | Medium | 2021-09-13 | Not applicable | No public exploit | Injection attack caused the denial of service vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4 |
| CVE-2021-38123 | Medium | 2021-09-07 | Not applicable | No public exploit | Open Redirect vulnerability in Micro Focus Network Automation, affecting Network Automation versions 10.4x, 10.5x, 2018.05, 2018.11, 2019.05, 2020.02, 2020.08, 2020.11, 2021.05. The vulnerability could allow redirect users to malicious websites after authentication. |
| CVE-2021-22525 | Medium | 2021-09-02 | Not applicable | No public exploit | This release addresses a potential information leakage vulnerability in NetIQ Access Manager versions prior to 5.0.1 |
| CVE-2021-22521 | Medium | 2021-07-30 | Not applicable | No public exploit | A privileged escalation vulnerability has been identified in Micro Focus ZENworks Configuration Management, affecting version 2020 Update 1 and all prior versions. The vulnerability could be exploited to gain unauthorized system privileges. |
| CVE-2021-22515 | Medium | 2021-07-12 | Not applicable | No public exploit | Multi-Factor Authentication (MFA) functionality can be bypassed, allowing the use of single factor authentication in NetIQ Advanced Authentication versions prior to 6.3 SP4 Patch 1. |
| CVE-2021-22513 | Medium | 2021-04-08 | No exploit published | No public exploit | Missing Authorization vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow access without permission checks. |
| CVE-2021-22512 | Medium | 2021-04-08 | No exploit published | No public exploit | Cross-Site Request Forgery (CSRF) vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow form validation without permission checks. |
| CVE-2021-22511 | Medium | 2021-04-08 | No exploit published | No public exploit | Improper Certificate Validation vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow unconditionally disabling of SSL/TLS certificates. |
| CVE-2021-22510 | Medium | 2021-04-08 | No exploit published | No public exploit | Reflected XSS vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects all version 6.7 and earlier versions. |
| CVE-2020-25840 | Medium | 2021-03-26 | Not applicable | No public exploit | Cross-Site scripting vulnerability in Micro Focus Access Manager product, affects all version prior to version 5.0. The vulnerability could cause configuration destruction. |
| CVE-2019-18946 | Medium | 2021-02-26 | Not applicable | No public exploit | Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to session fixation. |
| CVE-2019-18944 | Medium | 2021-02-26 | Not applicable | No public exploit | Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to reflected XSS. |
| CVE-2019-18942 | Medium | 2021-02-26 | Not applicable | No public exploit | Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to stored XSS. The application reflects previously stored user input without encoding. |
| CVE-2021-22500 | Medium | 2021-02-06 | Not applicable | No public exploit | Cross Site Request Forgery vulnerability in Micro Focus Application Performance Management product, affecting versions 9.40, 9.50 and 9.51. The vulnerability could be exploited by attacker to trick the users into executing actions of the attacker's choosing. |
| CVE-2021-22499 | Medium | 2021-02-06 | Not applicable | No public exploit | Persistent Cross-Site scripting vulnerability in Micro Focus Application Performance Management product, affecting versions 9.40, 9.50 and 9.51. The vulnerability could allow persistent XSS attack. |
| CVE-2020-25838 | Medium | 2020-12-11 | Not applicable | No public exploit | Unauthorized disclosure of sensitive information vulnerability in Micro Focus Filr product. Affecting all 3.x and 4.x versions. The vulnerability could be exploited to disclose unauthorized sensitive information. |
| CVE-2020-25834 | Medium | 2020-11-17 | Not applicable | No public exploit | Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting version 7.1. The vulnerability could be remotely exploited resulting in Cross-Site Scripting (XSS). |
| CVE-2020-25833 | Medium | 2020-11-17 | Not applicable | No public exploit | Persistent cross-Site Scripting vulnerability on Micro Focus IDOL product, affecting all version prior to version 12.7. The vulnerability could be exploited to perform Persistent XSS attack. |
| CVE-2020-25832 | Medium | 2020-11-17 | Not applicable | No public exploit | Reflected Cross Site scripting vulnerability on Micro Focus Filr product, affecting version 4.2.1. The vulnerability could be exploited to perform Reflected XSS attack. |
| CVE-2020-11860 | Medium | 2020-11-17 | Not applicable | No public exploit | Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1. The vulnerability could be remotely exploited resulting in Cross-Site Scripting (XSS) |
| CVE-2020-9522 | Medium | 2020-06-16 | Not applicable | No public exploit | Cross Site Scripting (XSS) vulnerability in Micro Focus ArcSight Enterprise Security Manager (ESM) product, Affecting versions 7.0.x, 7.2 and 7.2.1 . The vulnerabilities could be remotely exploited resulting in Cross-Site Scripting (XSS) or information disclosure. |
| CVE-2020-11841 | Medium | 2020-06-16 | Not applicable | No public exploit | Unauthorized information disclosure vulnerability in Micro Focus ArcSight Management Center product, Affecting versions 2.6.1, 2.7.x, 2.8.x, 2.9.x prior to 2.9.4. The vulnerabilities could be remotely exploited resulting unauthorized information disclosure. |
| CVE-2020-11840 | Medium | 2020-06-16 | Not applicable | No public exploit | Unauthorized information disclosure vulnerability in Micro Focus ArcSight Management Center product, Affecting versions 2.6.1, 2.7.x, 2.8.x, 2.9.x prior to 2.9.4. The vulnerabilities could be remotely exploited resulting unauthorized information disclosure. |
| CVE-2020-11838 | Medium | 2020-06-16 | Not applicable | No public exploit | Cross Site Scripting (XSS) vulnerability in Micro Focus ArcSight Management Center product, Affecting versions 2.6.1, 2.7.x, 2.8.x, 2.9.x prior to 2.9.4. The vulnerabilities could be remotely exploited resulting in Cross-Site Scripting (XSS) or information disclosure. |
| CVE-2020-11839 | Medium | 2020-06-12 | Not applicable | No public exploit | Cross Site Scripting (XSS) vulnerability in Micro Focus ArcSight Logger product, affecting all version from 6.6.1 up to version 7.0.1. The vulnerabilities could be remotely exploited resulting in Cross-Site Scripting (XSS) or information disclosure. |
| CVE-2020-11845 | Medium | 2020-05-19 | Not applicable | No public exploit | Cross Site Scripting vulnerability in Micro Focus Service Manager product. Affecting versions 9.50, 9.51, 9.52, 9.60, 9.61, 9.62, 9.63. The vulnerability could be exploited to allow remote attackers to inject arbitrary web script or HTML. |
| CVE-2020-9524 | Medium | 2020-05-18 | Not applicable | No public exploit | Cross Site scripting vulnerability on Micro Focus Enterprise Server and Enterprise developer, affecting all versions prior to version 5.0 Patch Update 8. The vulnerability could allow an attacker to trigger administrative actions when an administrator viewed malicious data left by the attacker (stored XSS) or followed a malicious link (reflected XSS). |
| CVE-2020-9520 | Medium | 2020-03-25 | Not applicable | No public exploit | A stored XSS vulnerability was discovered in Micro Focus Vibe, affecting all Vibe version prior to 4.0.7. The vulnerability could allows a remote attacker to craft and store malicious content into Vibe such that when the content is viewed by another user of the system, attacker controlled JavaScript will execute in the security context of the target user’s browser. |
| CVE-2020-9519 | Medium | 2020-03-16 | Not applicable | No public exploit | HTTP methods reveled in Web services vulnerability in Micro Focus Service manager (server), affecting versions 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62, 9.63. The vulnerability could be exploited to allow exposure of configuration data. |
| CVE-2020-9518 | Medium | 2020-03-16 | Not applicable | No public exploit | Login filter can access configuration files vulnerability in Micro Focus Service Manager (Web Tier), affecting versions 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerability could be exploited to allow unauthorized access to configuration data. |
| CVE-2020-9517 | Medium | 2020-03-09 | Not applicable | No public exploit | There is an improper restriction of rendered UI layers or frames vulnerability in Micro Focus Service Manager Release Control versions 9.50 and 9.60. The vulnerability may result in the ability of malicious users to perform UI redress attacks. |
| CVE-2019-17085 | Medium | 2019-11-18 | Not applicable | No public exploit | XXE attack vulnerability on Micro Focus Operations Agent, affected version 12.0, 12.01, 12.02, 12.03, 12.04, 12.05, 12.06, 12.10, 12.11. The vulnerability could be exploited to do an XXE attack on Operations Agent. |
| CVE-2019-11674 | Medium | 2019-10-22 | Not applicable | No public exploit | Man-in-the-middle vulnerability in Micro Focus Self Service Password Reset, affecting all versions prior to 4.4.0.4. The vulnerability could exploit invalid certificate validation and may result in a man-in-the-middle attack. |
| CVE-2019-11651 | Medium | 2019-10-02 | Not applicable | No public exploit | Reflected XSS on Micro Focus Enterprise Developer and Enterprise Server, all versions prior to version 3.0 Patch Update 20, version 4.0 Patch Update 12, and version 5.0 Patch Update 2. The vulnerability could be exploited to redirect a user to a malicious page or forge certain types of web requests. |
| CVE-2019-11664 | Medium | 2019-09-18 | Not applicable | No public exploit | Clear text password in browser in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerability could be exploited to allow sensitive data exposure. |
| CVE-2019-11663 | Medium | 2019-09-18 | Not applicable | No public exploit | Clear text credentials are used to access managers app in Tomcat in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerability could be exploited to allow sensitive data exposure. |
| CVE-2019-11662 | Medium | 2019-09-18 | Not applicable | No public exploit | Class and method names in error message in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. This vulnerability could be exploited in some special cases to allow information exposure through an error message. |
| CVE-2019-11658 | Medium | 2019-08-30 | Not applicable | No public exploit | Information exposure in Micro Focus Content Manager, versions 9.1, 9.2 and 9.3. This vulnerability when configured to use an Oracle database, allows valid system users to gain access to a limited subset of records they would not normally be able to access when the system is in an undisclosed abnormal state. |
| CVE-2019-11653 | Medium | 2019-08-07 | Not applicable | No public exploit | Remote Access Control Bypass in Micro Focus Content Manager. versions 9.1, 9.2, 9.3. The vulnerability could be exploited to manipulate data stored during another user’s CheckIn request. |
| CVE-2019-11650 | Medium | 2019-07-10 | Not applicable | No public exploit | A potential Man in the Middle attack (MITM) was found in NetIQ Advanced Authentication Framework versions prior to 6.0. |
| CVE-2019-11647 | Medium | 2019-06-24 | Not applicable | No public exploit | A potential XSS exists in Self Service Password Reset, in Micro Focus NetIQ Software all versions prior to version 4.4. The vulnerability could be exploited to enable an XSS attack. |
| CVE-2019-11649 | Medium | 2019-06-19 | Not applicable | No public exploit | Cross-Site Scripting vulnerability in Micro Focus Fortify Software Security Center Server, versions 17.2, 18.1, 18.2, has been identified in Micro Focus Software Security Center. The vulnerability could be exploited to execute JavaScript code in user’s browser. The vulnerability could be exploited to execute JavaScript code in user’s browser. |
| CVE-2019-3477 | Medium | 2019-06-07 | Not applicable | No public exploit | Micro Focus Solution Business Manager versions prior to 11.4.2 is susceptible to open redirect. |
| CVE-2019-3490 | Medium | 2019-05-02 | Not applicable | No public exploit | A DOM based XSS vulnerability has been identified in the Netstorage component of Open Enterprise Server (OES) allowing a remote attacker to execute javascript in the victims browser by tricking the victim into clicking on a specially crafted link. This affects OES versions OES2015SP1, OES2018, and OES2018SP1. Older versions may be affected but were not tested as they are out of support. |
| CVE-2018-19644 | Medium | 2019-03-27 | Not applicable | No public exploit | Reflected cross site script issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5. |
| CVE-2019-3474 | Medium | 2019-02-20 | Not applicable | Working exploit published | A path traversal vulnerability in the web application component of Micro Focus Filr 3.x allows a remote attacker authenticated as a low privilege user to download arbitrary files from the Filr server. This vulnerability affects all versions of Filr 3.x prior to Security Update 6. |
| CVE-2018-7691 | Medium | 2018-12-13 | Not applicable | Working exploit published | A potential Remote Unauthorized Access in Micro Focus Fortify Software Security Center (SSC), versions 17.10, 17.20, 18.10 this exploitation could allow Remote Unauthorized Access |
| CVE-2018-7690 | Medium | 2018-12-13 | Not applicable | Working exploit published | A potential Remote Unauthorized Access in Micro Focus Fortify Software Security Center (SSC), versions 17.10, 17.20, 18.10 this exploitation could allow Remote Unauthorized Access |
| CVE-2018-17952 | Medium | 2018-12-12 | Not applicable | No public exploit | Cross site scripting vulnerability in eDirectory prior to 9.1 SP2 |
| CVE-2018-17949 | Medium | 2018-12-12 | Not applicable | No public exploit | Cross site scripting vulnerability in iManager prior to 3.1 SP2. |
| CVE-2018-17948 | Medium | 2018-11-20 | Not applicable | No public exploit | An open redirect vulnerability exists in the Access Manager Identity Provider prior to 4.4 SP3. |
| CVE-2018-12480 | Medium | 2018-11-15 | Not applicable | No public exploit | Mitigates an XSS issue in NetIQ Access Manager versions prior to 4.4 SP3. |
| CVE-2018-18591 | Medium | 2018-11-13 | Not applicable | No public exploit | A potential unauthorized disclosure of data vulnerability has been identified in Micro Focus Service Manager versions: 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51. The vulnerability could be exploited to release unauthorized disclosure of data. |
| CVE-2018-7692 | Medium | 2018-08-09 | Not applicable | No public exploit | Unvalidated redirect vulnerability in in NetIQ eDirectory before 9.1.1 HF1. |
| CVE-2018-7682 | Medium | 2018-06-22 | Not applicable | No public exploit | Micro Focus Solutions Business Manager versions prior to 11.4 allows a user to invoke SBM RESTful services across domains. |
| CVE-2018-7681 | Medium | 2018-06-21 | Not applicable | No public exploit | Micro Focus Solutions Business Manager versions prior to 11.4 allows JavaScript to be embedded in URLs placed in "Favorites" folder. If the user has certain administrative privileges then this vulnerability can impact other users in the system. |
| CVE-2018-7680 | Medium | 2018-06-21 | Not applicable | No public exploit | Micro Focus Solutions Business Manager versions prior to 11.4 can reflect back HTTP header values. |
| CVE-2018-6495 | Medium | 2018-05-23 | Not applicable | No public exploit | Cross-Site Scripting (XSS) in Micro Focus Universal CMDB, version 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, 10.33, 11.0, CMS, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1 and Micro Focus UCMDB Browser, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1. This vulnerability could be remotely exploited to allow Cross-Site Scripting (XSS). |
| CVE-2018-6494 | Medium | 2018-05-22 | Not applicable | No public exploit | Remote SQL Injection against the HP Service Manager Software Web Tier, version 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, may lead to unauthorized disclosure of data. |
| CVE-2018-7675 | Medium | 2018-03-07 | Not applicable | No public exploit | In NetIQ Sentinel before 8.1.x, a Sentinel user is logged into the Sentinel Web Interface. After performing some tasks within Sentinel the user does not log out but does go idle for a period of time. This in turn causes the interface to timeout so that it requires the user to re-authenticate. If another user is passing by and decides to login, their credentials are accepted. While The user does not inherit any of the other users privileges, they are able to view the previous screen. In this case it is possible that the user can see another users events or configuration information for whatever view is currently showing. |
| CVE-2017-8993 | Medium | 2018-02-15 | Not applicable | No public exploit | A Remote Cross-Site Scripting vulnerability in HPE Project and Portfolio Management (PPM) version v9.30, v9.31, v9.32, v9.40 was found. |
| CVE-2017-14363 | Medium | 2017-12-21 | Not applicable | No public exploit | Cross-Site Scripting (XSS) vulnerability has been identified in Micro Focus Operations Manager i, versions 10.60, 10.61, 10.62. The vulnerability could be remotely exploited to allow Cross-Site Scripting (XSS). |
| CVE-2017-9273 | Medium | 2017-10-06 | Not applicable | No public exploit | The Bi-directional driver in IDM 4.5 before 4.0.3.0 could be susceptible to unauthorized log configuration changes. |
| CVE-2017-7424 | Medium | 2017-08-21 | Not applicable | No public exploit | A Path Traversal (CWE-22) vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote authenticated users to download arbitrary files from a system running the product, if this component is configured. Note esfadmingui is not enabled by default. |
| CVE-2017-7422 | Medium | 2017-08-21 | Not applicable | No public exploit | Reflected and stored Cross-Site Scripting (XSS, CWE-79) vulnerabilities in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allow remote authenticated attackers to bypass protection mechanisms (CWE-693) and other security features, if this component is configured. Note esfadmingui is not enabled by default. |
| CVE-2017-7421 | Medium | 2017-08-21 | Not applicable | No public exploit | Reflected and stored Cross-Site Scripting (XSS, CWE-79) vulnerabilities in Directory Server (aka Enterprise Server Administration web UI) and ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allow remote authenticated attackers to bypass protection mechanisms (CWE-693) and other security features. |
| CVE-2017-5184 | Medium | 2017-03-30 | Not applicable | No public exploit | A vulnerability was discovered in NetIQ Sentinel Server 8.0 before 8.0.1 that may allow leakage of information (account enumeration). |
| CVE-2016-5765 | Medium | 2016-11-29 | Not applicable | No public exploit | Administrative Server in Micro Focus Host Access Management and Security Server (MSS) and Reflection for the Web (RWeb) and Reflection Security Gateway (RSG) and Reflection ZFE (ZFE) allows remote unauthenticated attackers to read arbitrary files via a specially crafted URL that allows limited directory traversal. Applies to MSS 12.3 before 12.3.326 and MSS 12.2 before 12.2.342 and RSG 12.1 before 12.1.362 and RWeb 12.3 before 12.3.312 and RWeb 12.2 before 12.2.342 and RWeb 12.1 before 12.1.362 and ZFE 2.0.1 before 2.0.1.18 and ZFE 2.0.0 before 2.0.0.52 and ZFE 1.4.0 before 1.4.0.14. |
| CVE-2016-1599 | Medium | 2016-03-24 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in NetIQ Self Service Password Reset (SSPR) 2.x and 3.x before 3.3.1 HF2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. |
| CVE-2015-0795 | Medium | 2015-07-18 | Not applicable | No public exploit | Multiple stack-based buffer overflows in the SafeShellExecute method in the NetIQExecObject.NetIQExec.1 ActiveX control in NetIQExec.dll in NetIQ Security Solutions for iSeries 8.1 allow remote attackers to execute arbitrary code via long arguments, aka ZDI-CAN-2699. |
| CVE-2014-9412 | Medium | 2014-12-23 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.1 allow remote attackers to inject arbitrary web script or HTML via (1) an arbitrary parameter to roma/jsp/debug/debug.jsp or (2) an arbitrary parameter in a debug.DumpAll action to nps/servlet/webacc, a different issue than CVE-2014-5216. |
| CVE-2014-5217 | Medium | 2014-12-23 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Access Manager (NAM) 4.x before 4.1 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via an fw.SetPassword action. |
| CVE-2014-5216 | Medium | 2014-12-23 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allow remote attackers to inject arbitrary web script or HTML via (1) the location parameter in a dev.Empty action to nps/servlet/webacc, (2) the error parameter to nidp/jsp/x509err.jsp, (3) the lang parameter to sslvpn/applet_agent.jsp, or (4) the secureLoggingServersA parameter to roma/system/cntl, a different issue than CVE-2014-9412. |