CVE-2017-7423

The CVE-2017-7423 issue affects Micro Focus Enterprise Developer and Enterprise Server (2.3, including 2.3 Update 1 before Hotfix 8 and 2.3 Update 2 before Hotfix 9) where the esfadmingui component is vulnerable to Cross-Site Request Forgery (CSRF, CWE-352). An unauthenticated remote attacker can...

CVE-2017-7422

The CVE-2017-7422 entry concerns Micro Focus Enterprise Developer and Enterprise Server (ESM/ESMAN) with the esfadmingui component. It documents reflected and stored Cross-Site Scripting (XSS, CWE-79) vulnerabilities in esfadmingui affecting version 2.3, including 2.3 Update 1 before Hotfix 8 and...

CVE-2017-7424

A Path Traversal CWE-22 vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote authenticated users to download arbitrary files from a system running the product, if this component is...

CVE-2017-7424

CVE-2017-7424 is a Path Traversal (CWE-22) vulnerability in esfadmingui of Micro Focus Enterprise Developer and Enterprise Server . It affects version 2.3, specifically 2.3 Update 1 before Hotfix 8 and 2.3 Update 2 before Hotfix 9 . The flaw enables remote authenticated users to download arbitrar...

CVE-2017-7423

A Cross-Site Request Forgery CWE-352 vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to forge requests, if this component is configured. This includes...

HP/HPE/Micro Focus Universal CMDB RCE Vulnerability (HPESBGN03758)

HP/HPE/Micro Focus Universal CMDB is prone to a remote code execution RCE vulnerability. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later Thi...

Micro Focus Vibe Directory Traversal Vulnerability

Micro Focus Vibe aggregates what users need to do their jobs.Vibe supports seamless and secure access.The Vibe mobile app securely stores login credentials for one or more Vibe sites, so users can easily and quickly connect to Vibe sites. A directory traversal vulnerability exists in Micro Focus...

Path traversal

An absolute path traversal vulnerability CWE-36 in Micro Focus Vibe 4.0.2 and earlier allows a remote authenticated attacker to download arbitrary files from the server by submitting a specially crafted request to the viewFile endpoint. Note that the attack can be performed without authentication...

CVE-2017-7433

An absolute path traversal vulnerability CWE-36 in Micro Focus Vibe 4.0.2 and earlier allows a remote authenticated attacker to download arbitrary files from the server by submitting a specially crafted request to the viewFile endpoint. Note that the attack can be performed without authentication...

CVE-2017-7433

An absolute path traversal vulnerability CWE-36 in Micro Focus Vibe 4.0.2 and earlier allows a remote authenticated attacker to download arbitrary files from the server by submitting a specially crafted request to the viewFile endpoint. Note that the attack can be performed without authentication...

CVE-2017-7433

An absolute path traversal vulnerability CWE-36 in Micro Focus Vibe 4.0.2 and earlier allows a remote authenticated attacker to download arbitrary files from the server by submitting a specially crafted request to the viewFile endpoint. Note that the attack can be performed without authentication...

CVE-2017-7433

CVE-2017-7433 affects Micro Focus Vibe 4.0.2 and earlier, with an absolute path traversal in the viewFile endpoint. The vulnerability permits a remote attacker to download arbitrary files from the server; authentication may not be required if Guest access is enabled (Guest access is disabled by d...

NetIQ Sentinel Java Object Deserialization RCE

The remote Novell NetIQ Sentinel server is affected by a remote code execution vulnerability due to unsafe deserialize calls of unauthenticated Java objects to the BeanShell library. An unauthenticated, remote attacker can exploit this, by sending a specially crafted serialized Java object via th...

Micro Focus / HP Network Automation Detection (HTTP)

HTTP based detection of Micro Focus / HP Network Automation. Copyright C 2016 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

Directory traversal

Administrative Server in Micro Focus Host Access Management and Security Server MSS and Reflection for the Web RWeb and Reflection Security Gateway RSG and Reflection ZFE ZFE allows remote unauthenticated attackers to read arbitrary files via a specially crafted URL that allows limited directory...

CVE-2016-5765

Administrative Server in Micro Focus Host Access Management and Security Server MSS and Reflection for the Web RWeb and Reflection Security Gateway RSG and Reflection ZFE ZFE allows remote unauthenticated attackers to read arbitrary files via a specially crafted URL that allows limited directory...

CVE-2016-5765

The CVE-2016-5765 entry describes a remote, unauthenticated directory-traversal information-disclosure in Micro Focus MSS and related products (RWeb, RSG, ZFE, and older components). Affected: MSS 12.3 before 12.3.326, MSS 12.2 before 12.2.342; RSG 12.1 before 12.1.362; RWeb 12.3 before 12.3.312,...

CVE-2016-5765

Administrative Server in Micro Focus Host Access Management and Security Server MSS and Reflection for the Web RWeb and Reflection Security Gateway RSG and Reflection ZFE ZFE allows remote unauthenticated attackers to read arbitrary files via a specially crafted URL that allows limited directory...

CVE-2016-9176

Stack buffer overflow in the send.exe and receive.exe components of Micro Focus Rumba 9.4 and earlier could be used by local attackers or attackers able to inject arguments to these binaries to execute code...

Stack overflow

Stack buffer overflow in the send.exe and receive.exe components of Micro Focus Rumba 9.4 and earlier could be used by local attackers or attackers able to inject arguments to these binaries to execute code...