Micro Focus

Records129All Threatist records

Exploited (KEV)2In CISA KEV

CVSS critical29CVSS 9.0–10.0

CVSS high44CVSS 7.0–8.9

Exploited now

Micro Focus records in CISA KEV

TI-2021-05471 Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability CRITICAL 100KEV 2021-11-03 TI-2021-05475 Micro Focus Access Manager Information Leakage Vulnerability CRITICAL 90KEV 2021-11-03

Components

Products in the NVD configurations · select one to filter the records

Vibe 1 record LOW

Records

129 records

TI-2021-05471 CVE-2021-22502 · GHSA-9f78-r2f6-597q

OS command injection in Operation Bridge Reporter.

CRITICAL 100KEV

Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.9674 Published 2021-02-08 No fix listed CWE-78

TI-2021-05475 CVE-2021-22506 · GHSA-c5q3-mm7r-f42w

Advance configuration exposing Information Leakage vulnerability in Micro Focus Access…

CRITICAL 90KEV

Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all versions prior to version 5.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.25695 Published 2021-03-26 No fix listed

TI-2018-08950 CVE-2018-12464 · GHSA-qx98-cwxc-vrv6

Unauthenticated SQL injection in Micro Focus Secure Messaging Gateway

HIGH 83

A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthenticated remote attacker to execute arbitrary SQL statements against the database…

CVSS 3.0CRITICAL 10.0 Network No auth No interaction EPSS 0.80672 Published 2018-06-29 Fixed in 471 CWE-89

TI-2020-09524 CVE-2020-11854 · GHSA-g58f-4539-9qhg

Hard-coded credentials in Micro Focus Application Performance Management

HIGH 81

Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) vulnerability in Micro Focus products products Operation Bridge Manager, Operati…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.74449 Published 2020-10-27 No fix listed CWE-798

TI-2018-08951 CVE-2018-12465 · GHSA-ch8c-p3pw-fg7f

Remote Code Execution in Micro Focus Secure Messaging Gateway

HIGH 79

An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway (SMG) allows a remote attacker authenticated as a privileged user to execute arbitrary OS commands on the…

CVSS 3.0CRITICAL 9.1 Network High privileges No interaction EPSS 0.80021 Published 2018-06-29 Fixed in 471 CWE-77

TI-2020-09523 CVE-2020-11853 · GHSA-w38w-pq32-vgxm

Arbitrary code execution vulnerability on multiple Micro Focus products

HIGH 77

Arbitrary code execution vulnerability affecting multiple Micro Focus products.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.7699 Published 2020-10-22 No fix listed

TI-2017-10842 CVE-2017-14803 · GHSA-w8wj-w6xx-2wp8

In NetIQ Access Manager 4.3 and 4.4, a bug exists in Identity Server when accessing a…

HIGH 67

In NetIQ Access Manager 4.3 and 4.4, a bug exists in Identity Server when accessing a basic SSO connector and downloading the BasicSSO connector plugins on IE11 where an attacker can execute arbitrary code on the system.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.34593 Published 2018-01-20 No fix listed

TI-2018-08949 CVE-2018-12463 · GHSA-3qx8-hg75-rq29

MFSBGN03811 rev.1 - Fortify Software Security Center (SSC), Multiple vulnerabilities

MEDIUM 57

An XML external entity (XXE) vulnerability in Fortify Software Security Center (SSC), version 17.1, 17.2, 18.1 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) att…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.13849 Published 2018-07-12 No fix listed CWE-611

TI-2017-06485 CVE-2017-8994 · GHSA-vr6q-6hw7-2592

Improper input validation in Micro Focus HPE Operations Orchestration

MEDIUM 54

A input validation vulnerability in HPE Operations Orchestration product all versions prior to 10.80, allows for the execution of code remotely.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.0984 Published 2017-10-10 Fixed in 10.80 CWE-20

TI-2022-18266 CVE-2022-38756 · GHSA-664m-3r2m-mxpx

CVE-2022-38756 vulnerability in GW Web prior to 18.4.2

MEDIUM 53

A vulnerability has been identified in Micro Focus GroupWise Web in versions prior to 18.4.2.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00885 Published 2022-12-16 Fixed in 18.4.2 CWE-532

TI-2017-10467 CVE-2017-14350 · GHSA-mr2j-x367-gmvc

Missing authentication in Micro Focus HPE Application Performance Management

MEDIUM 52

A potential security vulnerability has been identified in HPE Application Performance Management (BSM) Platform versions 9.26, 9.30, 9.40.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.06958 Published 2017-09-29 No fix listed CWE-306

TI-2018-04780 CVE-2018-6498 · GHSA-f2fq-rhr2-2j8m

Micro Focus Container Deployment Foundation (CDF), Remote Code Execution

MEDIUM 48

Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Cont…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03125 Published 2018-08-30 No fix listed CWE-94

TI-2020-09521 CVE-2020-11851 · GHSA-5xg8-q2v8-w6f8

Code injection in Micro Focus ArcSight Logger

MEDIUM 47

Arbitrary code execution vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02948 Published 2020-11-17 No fix listed CWE-94

TI-2020-09514 CVE-2020-11844 · GHSA-99j9-w4cp-4529

Incorrect Authorization vulnerability in the Micro Focus Container Deployment Foundation affecting multiple products.

MEDIUM 47

Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.02057 Published 2020-05-29 Fixed in 2019.11, next of 1.1.1 CWE-863

TI-2018-05535 CVE-2018-7679 · GHSA-q696-7rwm-g645

Improper input validation in Micro Focus Solutions Business Manager 11.4

MEDIUM 47

Micro Focus Solutions Business Manager versions prior to 11.4 when ASP.NET is configured with execute permission on the virtual directories and does not validate the contents of user avatar images, could lead to remote c…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02314 Published 2018-06-21 No fix listed CWE-20

TI-2018-04781 CVE-2018-6499 · GHSA-9gm2-7mpc-rwc6

Code injection in Micro Focus Network Operations Management Suite CDF

MEDIUM 47

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02397 Published 2018-08-30 No fix listed CWE-94

TI-2017-05072 CVE-2017-7420 · GHSA-mh7j-5vww-cqrw

Improper authentication in Micro Focus Enterprise Developer, Micro Focus Enterprise Server

MEDIUM 47

An Authentication Bypass (CWE-287) vulnerability in ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Updat…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02444 Published 2017-08-21 No fix listed CWE-287

TI-2016-07505 CVE-2016-9176 · GHSA-hx97-fgxc-2h4w

Memory corruption in Micro Focus Rumba 9.4

MEDIUM 47

Stack buffer overflow in the send.exe and receive.exe components of Micro Focus Rumba 9.4 and earlier could be used by local attackers or attackers able to inject arguments to these binaries to execute code.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.0276 Published 2016-11-04 No fix listed CWE-119

TI-2011-00396 CVE-2011-0469 · GHSA-ghhh-97cc-m8qx

Code injection in openSUSE when running some source services used in the open build service 2.1 before March 11 2011.

MEDIUM 47

Code injection in openSUSE when running some source services used in the open build service 2.1 before March 11 2011.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02406 Published 2017-08-17 No fix listed CWE-94

TI-2019-08721 CVE-2019-11652 · GHSA-2rwx-x77g-rp72

A potential authorization bypass issue was found in Micro Focus Self Service Password…

MEDIUM 46

A potential authorization bypass issue was found in Micro Focus Self Service Password Reset (SSPR) versions prior to: 4.4.0.3, 4.3.0.6, and 4.2.0.6.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02116 Published 2019-08-14 Fixed in 4.4.0.3, 4.3.0.6 +1

TI-2018-04770 CVE-2018-6488 · GHSA-chfm-fw34-93f8

MFSBGN03798 rev.1 - Micro Focus Universal CMDB, Apache Struts Instance

MEDIUM 46

Arbitrary Code Execution vulnerability in Micro Focus Universal CMDB, version 4.10, 4.11, 4.12.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.0181 Published 2018-02-22 No fix listed CWE-94

TI-2018-04769 CVE-2018-6487 · GHSA-48r9-726w-jrh5

MFSBGN03799 rev.1 - Micro Focus UCMDB, Remote Disclosure of Information

MEDIUM 46

Remote Disclosure of Information in Micro Focus Universal CMDB Foundation Software, version numbers 10.10, 10.11, 10.20, 10.21, 10.22, 10.30, 10.31, 4.10, 4.11.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01867 Published 2018-02-20 No fix listed CWE-200

TI-2017-10473 CVE-2017-14356 · GHSA-cghv-7f9h-5rhg

SQL injection in Micro Focus HP ArcSight ESM

MEDIUM 46

An SQL Injection vulnerability in HP ArcSight ESM and HP ArcSight ESM Express, in any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01815 Published 2017-10-31 No fix listed CWE-89

TI-2018-13922 CVE-2018-19641 · GHSA-8ghf-x63g-5453

Solutions Business Manager (SBM) Unauthenticated remote code execution issue in version prior to 11.5

MEDIUM 45

Unauthenticated remote code execution issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01499 Published 2019-03-27 Fixed in 11.5 CWE-94

TI-2018-01243 CVE-2018-1343 · GHSA-322r-r98c-pph2

PAM exposure enabling unauthenticated access to remote host

MEDIUM 45

PAM exposure enabling unauthenticated access to remote host

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01362 Published 2018-03-06 No fix listed CWE-287

Open these records in search →