HPE ArcSight ESM and ArcSight ESM Express SQL Injection Vulnerability

HPE ArcSight ESM Enterprise Security Manager and ESM Express are both enterprise security management software with event correlation and security analysis capabilities from Hewlett Packard Enterprise HPE. The software collects, correlates and reports on enterprise-wide security events in real tim...

CVE-2017-14357: Improper Neutralization of Input During Web Page Generation

A Reflected and Stored Cross-Site Scripting XSS vulnerability in HP ArcSight ESM and HP ArcSight ESM Express, in any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. This vulnerability could be exploited remotely to allow Reflected and Stored Cross-Site Scripting XSS...

CVE-2017-13991: Exposure of Sensitive Information to an Unauthorized Actor

An information leakage vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows disclosure of product license features...

CVE-2017-13988: Undefined Security Weakness

An improper access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows unauthorized users to alter the maximum size of storage groups and enable/disable the setting for the 'follow schedule' function...

CVE-2017-13986: Improper Neutralization of Input During Web Page Generation

A reflected Cross-Site ScriptingXSS vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows for unintended information when a specific URL is sent to the system...

CVE-2017-13990: Exposure of Sensitive Information to an Unauthorized Actor

An information leakage vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows disclosure of Apache Tomcat application server version...

CVE-2017-13990

Summary: CVE-2017-13990 describes an information-disclosure vulnerability in HP ArcSight ESM/ESM Express (ArcSight) where any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1 can disclose the Apache Tomcat application server version. Affected products/versions: ArcSight ESM and ArcSight ESM ...

CVE-2017-13988

Affected product: ArcSight ESM and ArcSight ESM Express. Vulnerable versions: any 6.x prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. Root cause / impact: improper access control lets unauthorized users alter the maximum size of storage groups and enable/disable the follow schedule function. Exploitab...

CVE-2016-1992

HPE ArcSight ESM before 6.8c, and ArcSight ESM Express before 6.9.1, allows remote authenticated users to obtain sensitive information via unspecified vectors...

CVE-2016-1991

HPE ArcSight ESM 5.x before 5.6, 6.0, 6.5.x before 6.5C SP1 Patch 2, and 6.8c before P1, and ArcSight ESM Express before 6.9.1, allows remote authenticated users to conduct unspecified "file download" attacks via unknown vectors...