Code injection

Micro Focus Solutions Business Manager versions prior to 11.4 allows JavaScript to be embedded in URLs placed in "Favorites" folder. If the user has certain administrative privileges then this vulnerability can impact other users in the system...

CVE-2018-7679

Micro Focus Solutions Business Manager versions prior to 11.4 when ASP.NET is configured with execute permission on the virtual directories and does not validate the contents of user avatar images, could lead to remote code execution...

CVE-2018-7683

Micro Focus Solutions Business Manager versions prior to 11.4 might reveal certain sensitive information in server log files...

CVE-2018-7679

CVE-2018-7679 is a remote code execution vulnerability in Micro Focus SBM. Connected CNVD/NVD entries describe SBM versions prior to 11.4 where ASP.NET is configured with execute permission on virtual directories and user avatar images are not validated, enabling an attacker to run arbitrary code...

CVE-2018-7680

The CVE-2018-7680 entry concerns Micro Focus Solutions Business Manager versions prior to 11.4, where the product can reflect back HTTP header values. This is supported by NVD data (reflect back HTTP header values) and CNVD/PRION/other entries referencing SBM pre-11.4. The connected documents do ...

CVE-2018-7680

Micro Focus Solutions Business Manager versions prior to 11.4 can reflect back HTTP header values...

CVE-2018-7681

Micro Focus Solutions Business Manager (SBM) prior to version 11.4 is affected by a cross-site scripting (XSS) vulnerability that allows JavaScript to be embedded in URLs placed in the Favorites folder. The issue can impact other users when an administrator with sufficient privileges interacts wi...

CVE-2018-7681

Micro Focus Solutions Business Manager versions prior to 11.4 allows JavaScript to be embedded in URLs placed in "Favorites" folder. If the user has certain administrative privileges then this vulnerability can impact other users in the system...

CVE-2018-7683

Micro Focus Solutions Business Manager versions prior to 11.4 might reveal certain sensitive information in server log files...

CVE-2018-7683

CVE-2018-7683 affects Micro Focus Solutions Business Manager (SBM) prior to version 11.4, with an information disclosure exposing sensitive data via server log files. Multiple connected sources corroborate the same impact, referencing SBM before 11.4. The root cause, vulnerable component details,...

CVE-2018-7679

Micro Focus Solutions Business Manager versions prior to 11.4 when ASP.NET is configured with execute permission on the virtual directories and does not validate the contents of user avatar images, could lead to remote code execution...

CVE-2018-6495

Cross-Site Scripting XSS in Micro Focus Universal CMDB, version 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, 10.33, 11.0, CMS, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1 and Micro Focus UCMDB Browser, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1. This vulnerability could be remotely exploited to...

Cross site scripting

Cross-Site Scripting XSS in Micro Focus Universal CMDB, version 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, 10.33, 11.0, CMS, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1 and Micro Focus UCMDB Browser, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1. This vulnerability could be remotely exploited to...

CVE-2018-6495

Cross-Site Scripting XSS in Micro Focus Universal CMDB, version 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, 10.33, 11.0, CMS, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1 and Micro Focus UCMDB Browser, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1. This vulnerability could be remotely exploited to...

CVE-2018-6495

The CVE-2018-6495 entry describes a Cross-Site Scripting (XSS) vulnerability in Micro Focus Universal CMDB (versions 10.20–10.33, 11.0), CMS (4.10–4.15.1), and UCMDB Browser (4.10–4.15.1). The flaw is exploitable remotely to inject script or HTML. Connected documents corroborate product scope and...

CVE-2018-6495 MFSBGN03808 rev.1 - Micro Focus UCMDB, Cross-Site Scripting

Cross-Site Scripting XSS in Micro Focus Universal CMDB, version 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, 10.33, 11.0, CMS, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1 and Micro Focus UCMDB Browser, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1. This vulnerability could be remotely exploited to...

Micro Focus Client for Open Enterprise Server Buffer Overflow Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Micro Focus Client for Open Enterprise Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw...

Micro Focus Client for OES Buffer Overflow Vulnerability

Micro Focus Client for OES is a suite of server client software from Micro Focus UK. The software supports the transfer or authorization of files in platforms such as Windows Server. A buffer overflow vulnerability exists in the ncfsd.sys file in versions prior to Micro Focus Client for OES 2 SP4...

CVE-2018-7687

The Micro Focus Client for OES before version 2 SP4 IR8a has a vulnerability that could allow a local attacker to elevate privileges via a buffer overflow in ncfsd.sys...

CVE-2018-7687

The Micro Focus Client for OES before version 2 SP4 IR8a has a vulnerability that could allow a local attacker to elevate privileges via a buffer overflow in ncfsd.sys...