PT-2018-18206

Name of the Vulnerable Software and Affected Versions Micro Focus Solutions Business Manager versions prior to 11.4 Description The issue allows HTTP header values to be reflected back, which can be used to manipulate user sessions or conduct further attacks. Recommendations For versions prior to...

PT-2018-18205

Name of the Vulnerable Software and Affected Versions Micro Focus Solutions Business Manager versions prior to 11.4 Description The issue arises when ASP.NET is configured with execute permission on the virtual directories and does not validate the contents of user avatar images, which could lead...

PT-2018-18207

Name of the Vulnerable Software and Affected Versions Micro Focus Solutions Business Manager versions prior to 11.4 Description The issue allows JavaScript to be embedded in URLs placed in the "Favorites" folder. If a user has certain administrative privileges, this can impact other users in the...

PT-2018-18209

Name of the Vulnerable Software and Affected Versions Micro Focus Solutions Business Manager versions prior to 11.4 Description The issue might cause certain sensitive information to be revealed in server log files. Recommendations For versions prior to 11.4, update to version 11.4 or later to...

Cross site scripting

Cross-Site Scripting XSS in Micro Focus Universal CMDB, version 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, 10.33, 11.0, CMS, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1 and Micro Focus UCMDB Browser, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1. This vulnerability could be remotely exploited to...

CVE-2018-6495

Cross-Site Scripting XSS in Micro Focus Universal CMDB, version 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, 10.33, 11.0, CMS, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1 and Micro Focus UCMDB Browser, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1. This vulnerability could be remotely exploited to...

CVE-2018-6495

Cross-Site Scripting XSS in Micro Focus Universal CMDB, version 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, 10.33, 11.0, CMS, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1 and Micro Focus UCMDB Browser, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1. This vulnerability could be remotely exploited to...

CVE-2018-6495

The CVE-2018-6495 entry describes a Cross-Site Scripting (XSS) vulnerability in Micro Focus Universal CMDB (versions 10.20–10.33, 11.0), CMS (4.10–4.15.1), and UCMDB Browser (4.10–4.15.1). The flaw is exploitable remotely to inject script or HTML. Connected documents corroborate product scope and...

CVE-2018-6495 MFSBGN03808 rev.1 - Micro Focus UCMDB, Cross-Site Scripting

Cross-Site Scripting XSS in Micro Focus Universal CMDB, version 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, 10.33, 11.0, CMS, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1 and Micro Focus UCMDB Browser, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1. This vulnerability could be remotely exploited to...

CVE-2018-6495: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS in Micro Focus Universal CMDB, version 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, 10.33, 11.0, CMS, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1 and Micro Focus UCMDB Browser, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1. This vulnerability could be remotely exploited to...

Micro Focus Client for OES Buffer Overflow Vulnerability

Micro Focus Client for OES is a suite of server client software from Micro Focus UK. The software supports the transfer or authorization of files in platforms such as Windows Server. A buffer overflow vulnerability exists in the ncfsd.sys file in versions prior to Micro Focus Client for OES 2 SP4...

Micro Focus Client for Open Enterprise Server Buffer Overflow Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Micro Focus Client for Open Enterprise Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw...

CVE-2018-7687

The Micro Focus Client for OES before version 2 SP4 IR8a has a vulnerability that could allow a local attacker to elevate privileges via a buffer overflow in ncfsd.sys...

Buffer overflow

The Micro Focus Client for OES before version 2 SP4 IR8a has a vulnerability that could allow a local attacker to elevate privileges via a buffer overflow in ncfsd.sys...

CVE-2018-7687

The Micro Focus Client for OES before version 2 SP4 IR8a has a vulnerability that could allow a local attacker to elevate privileges via a buffer overflow in ncfsd.sys...

CVE-2018-7687

The CVE-2018-7687 entry concerns Micro Focus Client for Open Enterprise Server (OES) before version 2 SP4 IR8a, where a vulnerability in ncfsd.sys enables local privilege escalation via a buffer overflow. Public sources detail that exploitation requires prior low-priv code execution and abuses im...

CVE-2018-7687 Client for OES Elevation of Privilege via Buffer Overflow

The Micro Focus Client for OES before version 2 SP4 IR8a has a vulnerability that could allow a local attacker to elevate privileges via a buffer overflow in ncfsd.sys...

CVE-2018-7687: Improper Restriction of Operations within the Bounds of a Memory Buffer

The Micro Focus Client for OES before version 2 SP4 IR8a has a vulnerability that could allow a local attacker to elevate privileges via a buffer overflow in ncfsd.sys...

PT-2018-18212

Name of the Vulnerable Software and Affected Versions Micro Focus Client for OES versions prior to 2 SP4 IR8a Description The issue is related to a buffer overflow in ncfsd.sys, which could allow a local attacker to elevate privileges. Recommendations For versions prior to 2 SP4 IR8a, update to...

Privilege escalation

Local Escalation of Privilege vulnerability to Micro Focus Universal CMDB, versions 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, 10.33, 11.00. The vulnerability could be remotely exploited to Local Escalation of Privilege...