Vulnerabilities

TI-2019-13657 CVE-2019-18943 · GHSA-j7h4-p7f6-r3rm

XML External Entity processing

LOW 36

Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to XML External Entity Processing (XXE) on certain operations.

CVSS 3.1HIGH 8.0 Adjacent network Low privileges No interaction EPSS 0.00613 Published 2021-02-26 Fixed in 11.7.1 CWE-611

TI-2019-13656 CVE-2019-18942 · GHSA-qxxr-xxwm-9w7g

Stored cross site scripting in Micro Focus Solutions Business Manager

LOW 25

Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to stored XSS.

CVSS 3.1MEDIUM 5.5 Adjacent network Low privileges No interaction EPSS 0.00316 Published 2021-02-26 Fixed in 11.7.1 CWE-79

TI-2019-13658 CVE-2019-18944 · GHSA-3f89-5qh9-mvf8

Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to reflected XSS.

LOW 22

Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to reflected XSS.

CVSS 3.1MEDIUM 4.9 Adjacent network Low privileges User interaction EPSS 0.00316 Published 2021-02-26 Fixed in 11.7.1 CWE-80

TI-2019-13659 CVE-2019-18945 · GHSA-6j89-3rxh-pr77

Privilege escalation in Micro Focus Solutions Business Manager

LOW 36

Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to privilege escalation vulnerability.

CVSS 3.1HIGH 8.0 Adjacent network Low privileges No interaction EPSS 0.00551 Published 2021-02-26 Fixed in 11.7.1 CWE-264

TI-2019-13661 CVE-2019-18947 · GHSA-98w3-q668-fx6q

Information disclosure in Micro Focus Solutions Business Manager

LOW 17

Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to information disclosure.

CVSS 3.1LOW 3.5 Adjacent network Low privileges No interaction EPSS 0.00341 Published 2021-02-26 Fixed in 11.7.1 CWE-200

TI-2019-13660 CVE-2019-18946 · GHSA-chmw-mgxc-gvfx

Session fixation

LOW 22

Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to session fixation.

CVSS 3.1MEDIUM 4.8 Adjacent network Low privileges User interaction EPSS 0.00264 Published 2021-02-26 Fixed in 11.7.1 CWE-384

TI-2019-02599 CVE-2019-3477 · GHSA-m5p7-7h63-f228

Micro Focus Solution Business Manager versions prior to 11.4.2 is susceptible to open redirect.

LOW 28

Micro Focus Solution Business Manager versions prior to 11.4.2 is susceptible to open redirect.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00648 Published 2019-06-07 Fixed in 11.4.2 CWE-601

TI-2018-13924 CVE-2018-19643 · GHSA-vhm7-r4r5-569m

Solutions Business Manager (SBM) Information Leakage issue in version prior to 11.5

LOW 34

Information leakage issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00797 Published 2019-03-27 Fixed in 11.5 CWE-200

TI-2018-13925 CVE-2018-19644 · GHSA-cf75-j5m4-47j5

Solutions Business Manager (SBM) reflected cross site script issue in version prior to 11.5

LOW 28

Reflected cross site script issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00512 Published 2019-03-27 Fixed in 11.5 CWE-79

TI-2018-13923 CVE-2018-19642 · GHSA-fjr9-qmvw-r3jx

Solutions Business Manager (SBM) Denial of Service issue in version prior to 11.5

LOW 34

Denial of service issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00697 Published 2019-03-27 Fixed in 11.5 CWE-20

TI-2018-13922 CVE-2018-19641 · GHSA-8ghf-x63g-5453

Solutions Business Manager (SBM) Unauthenticated remote code execution issue in version prior to 11.5

MEDIUM 45

Unauthenticated remote code execution issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01499 Published 2019-03-27 Fixed in 11.5 CWE-94

TI-2018-13926 CVE-2018-19645 · GHSA-34x9-j9c6-9r2j

Solutions Business Manager (SBM) Authentication Bypass Issue in Version prior to 11.5

MEDIUM 45

An Authentication Bypass issue exists in Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01416 Published 2019-02-12 Fixed in 11.5 CWE-287

TI-2018-05538 CVE-2018-7682 · GHSA-vpmf-xxf3-wr92

Sensitive information in log files in Micro Focus Solutions Business Manager 11.4

LOW 30

Micro Focus Solutions Business Manager versions prior to 11.4 allows a user to invoke SBM RESTful services across domains.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0084 Published 2018-06-22 No fix listed CWE-532

TI-2018-05539 CVE-2018-7683 · GHSA-3qg9-5cr6-vjmf

Sensitive information in log files in Micro Focus Solutions Business Manager 11.4

LOW 35

Micro Focus Solutions Business Manager versions prior to 11.4 might reveal certain sensitive information in server log files.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01111 Published 2018-06-21 No fix listed CWE-532

TI-2018-05537 CVE-2018-7681 · GHSA-6rp2-j9vc-wc3q

Cross-site scripting in Micro Focus Solutions Business Manager 11.4

LOW 23

Micro Focus Solutions Business Manager versions prior to 11.4 allows JavaScript to be embedded in URLs placed in "Favorites" folder.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00512 Published 2018-06-21 No fix listed CWE-79

TI-2018-05536 CVE-2018-7680 · GHSA-vcw8-q59x-29g2

Micro Focus Solutions Business Manager versions prior to 11.4 can reflect back HTTP header values.

LOW 28

Micro Focus Solutions Business Manager versions prior to 11.4 can reflect back HTTP header values.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00647 Published 2018-06-21 No fix listed CWE-79

TI-2018-05535 CVE-2018-7679 · GHSA-q696-7rwm-g645

Improper input validation in Micro Focus Solutions Business Manager 11.4

MEDIUM 47

Micro Focus Solutions Business Manager versions prior to 11.4 when ASP.NET is configured with execute permission on the virtual directories and does not validate the contents of user avatar images, could lead to remote c…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02314 Published 2018-06-21 No fix listed CWE-20

Vulnerabilities

Filters