PT-2017-16374

Name of the Vulnerable Software and Affected Versions Micro Focus Enterprise Developer and Enterprise Server versions prior to 2.3 Update 1 Hotfix 8 Micro Focus Enterprise Developer and Enterprise Server version 2.3 Update 2 before Hotfix 9 Description A Cross-Site Request Forgery issue in the...

PT-2017-17727

Name of the Vulnerable Software and Affected Versions Micro Focus Enterprise Developer and Enterprise Server versions 2.3 through 2.3 Update 2 before Hotfix 9 Description The issue concerns reflected and stored Cross-Site Scripting XSS vulnerabilities in the esfadmingui component. This allows...

PT-2017-17728

Name of the Vulnerable Software and Affected Versions Micro Focus Enterprise Developer and Enterprise Server versions 2.3 through 2.3 Update 2 before Hotfix 9 Description A Cross-Site Request Forgery issue allows remote unauthenticated attackers to forge requests, potentially creating new...

PT-2017-17729

Name of the Vulnerable Software and Affected Versions Micro Focus Enterprise Developer and Enterprise Server versions 2.3 through 2.3 Update 2 before Hotfix 9 Description A Path Traversal issue allows remote authenticated users to download arbitrary files from a system running the product, given...

CVE-2017-7424: Improper Limitation of a Pathname to a Restricted Directory

A Path Traversal CWE-22 vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote authenticated users to download arbitrary files from a system running the product, if this component is...

CVE-2017-7423: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CWE-352 vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to forge requests, if this component is configured. This includes...

CVE-2017-5187: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CWE-352 vulnerability in Directory Server aka Enterprise Server Administration web UI in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to...

CVE-2017-7421: Improper Neutralization of Input During Web Page Generation

Reflected and stored Cross-Site Scripting XSS, CWE-79 vulnerabilities in Directory Server aka Enterprise Server Administration web UI and ESMAC aka Enterprise Server Monitor and Control in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2....

PT-2017-17725

Name of the Vulnerable Software and Affected Versions Micro Focus Enterprise Developer and Enterprise Server versions prior to 2.3 Update 2 Hotfix 9 Micro Focus Enterprise Developer and Enterprise Server version 2.3 Micro Focus Enterprise Developer and Enterprise Server version 2.3 Update 1 throu...

HP/HPE/Micro Focus Universal CMDB RCE Vulnerability (HPESBGN03758)

HP/HPE/Micro Focus Universal CMDB is prone to a remote code execution RCE vulnerability. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later Thi...

Micro Focus Vibe Directory Traversal Vulnerability

Micro Focus Vibe aggregates what users need to do their jobs.Vibe supports seamless and secure access.The Vibe mobile app securely stores login credentials for one or more Vibe sites, so users can easily and quickly connect to Vibe sites. A directory traversal vulnerability exists in Micro Focus...

Path traversal

An absolute path traversal vulnerability CWE-36 in Micro Focus Vibe 4.0.2 and earlier allows a remote authenticated attacker to download arbitrary files from the server by submitting a specially crafted request to the viewFile endpoint. Note that the attack can be performed without authentication...

CVE-2017-7433

An absolute path traversal vulnerability CWE-36 in Micro Focus Vibe 4.0.2 and earlier allows a remote authenticated attacker to download arbitrary files from the server by submitting a specially crafted request to the viewFile endpoint. Note that the attack can be performed without authentication...

CVE-2017-7433

An absolute path traversal vulnerability CWE-36 in Micro Focus Vibe 4.0.2 and earlier allows a remote authenticated attacker to download arbitrary files from the server by submitting a specially crafted request to the viewFile endpoint. Note that the attack can be performed without authentication...

CVE-2017-7433

CVE-2017-7433 affects Micro Focus Vibe 4.0.2 and earlier, with an absolute path traversal in the viewFile endpoint. The vulnerability permits a remote attacker to download arbitrary files from the server; authentication may not be required if Guest access is enabled (Guest access is disabled by d...

CVE-2017-7433

An absolute path traversal vulnerability CWE-36 in Micro Focus Vibe 4.0.2 and earlier allows a remote authenticated attacker to download arbitrary files from the server by submitting a specially crafted request to the viewFile endpoint. Note that the attack can be performed without authentication...

CVE-2017-7433: Improper Limitation of a Pathname to a Restricted Directory

An absolute path traversal vulnerability CWE-36 in Micro Focus Vibe 4.0.2 and earlier allows a remote authenticated attacker to download arbitrary files from the server by submitting a specially crafted request to the viewFile endpoint. Note that the attack can be performed without authentication...

PT-2017-17735

Name of the Vulnerable Software and Affected Versions Micro Focus Vibe versions 4.0.2 and earlier Description The issue allows a remote authenticated attacker to download arbitrary files from the server by submitting a specially crafted request to the "viewFile" endpoint. If Guest access is...

NetIQ Sentinel Java Object Deserialization RCE

The remote Novell NetIQ Sentinel server is affected by a remote code execution vulnerability due to unsafe deserialize calls of unauthenticated Java objects to the BeanShell library. An unauthenticated, remote attacker can exploit this, by sending a specially crafted serialized Java object via th...

Micro Focus / HP Network Automation Detection (HTTP)

HTTP based detection of Micro Focus / HP Network Automation. Copyright C 2016 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...