HPE ArcSight ESM and ArcSight ESM Express SQL Injection Vulnerability

HPE ArcSight ESM Enterprise Security Manager and ESM Express are both enterprise security management software with event correlation and security analysis capabilities from Hewlett Packard Enterprise HPE. The software collects, correlates and reports on enterprise-wide security events in real tim...

CVE-2017-14357: Improper Neutralization of Input During Web Page Generation

A Reflected and Stored Cross-Site Scripting XSS vulnerability in HP ArcSight ESM and HP ArcSight ESM Express, in any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. This vulnerability could be exploited remotely to allow Reflected and Stored Cross-Site Scripting XSS...

PT-2017-13414

Name of the Vulnerable Software and Affected Versions HP ArcSight ESM versions prior to 6.9.1c Patch 4 HP ArcSight ESM versions prior to 6.11.0 Patch 1 HP ArcSight ESM Express versions prior to 6.9.1c Patch 4 HP ArcSight ESM Express versions prior to 6.11.0 Patch 1 Description The issue is an SQL...

PT-2017-13416

Name of the Vulnerable Software and Affected Versions HP ArcSight ESM versions prior to 6.9.1c Patch 4 HP ArcSight ESM versions prior to 6.11.0 Patch 1 HP ArcSight ESM Express versions prior to 6.9.1c Patch 4 HP ArcSight ESM Express versions prior to 6.11.0 Patch 1 Description A URL redirection t...

PT-2017-13415

Name of the Vulnerable Software and Affected Versions HP ArcSight ESM versions prior to 6.9.1c Patch 4 HP ArcSight ESM versions prior to 6.11.0 Patch 1 HP ArcSight ESM Express versions prior to 6.9.1c Patch 4 HP ArcSight ESM Express versions prior to 6.11.0 Patch 1 Description A Reflected and...

CVE-2017-13990: Exposure of Sensitive Information to an Unauthorized Actor

An information leakage vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows disclosure of Apache Tomcat application server version...

CVE-2017-13988: Undefined Security Weakness

An improper access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows unauthorized users to alter the maximum size of storage groups and enable/disable the setting for the 'follow schedule' function...

CVE-2017-13986: Improper Neutralization of Input During Web Page Generation

A reflected Cross-Site ScriptingXSS vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows for unintended information when a specific URL is sent to the system...

CVE-2017-13991: Exposure of Sensitive Information to an Unauthorized Actor

An information leakage vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows disclosure of product license features...

CVE-2017-13988

Affected product: ArcSight ESM and ArcSight ESM Express. Vulnerable versions: any 6.x prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. Root cause / impact: improper access control lets unauthorized users alter the maximum size of storage groups and enable/disable the follow schedule function. Exploitab...

CVE-2017-13990

Summary: CVE-2017-13990 describes an information-disclosure vulnerability in HP ArcSight ESM/ESM Express (ArcSight) where any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1 can disclose the Apache Tomcat application server version. Affected products/versions: ArcSight ESM and ArcSight ESM ...

PT-2017-13182

Name of the Vulnerable Software and Affected Versions ArcSight ESM versions prior to 6.9.1c Patch 4 ArcSight ESM versions prior to 6.11.0 Patch 1 ArcSight ESM Express versions prior to 6.9.1c Patch 4 ArcSight ESM Express versions prior to 6.11.0 Patch 1 Description The issue is related to imprope...

PT-2017-13185

Name of the Vulnerable Software and Affected Versions ArcSight ESM versions prior to 6.9.1c Patch 4 ArcSight ESM versions prior to 6.11.0 Patch 1 ArcSight ESM Express versions prior to 6.9.1c Patch 4 ArcSight ESM Express versions prior to 6.11.0 Patch 1 Description An information leakage issue...

PT-2017-13183

Name of the Vulnerable Software and Affected Versions ArcSight ESM versions prior to 6.9.1c Patch 4 ArcSight ESM versions prior to 6.11.0 Patch 1 ArcSight ESM Express versions prior to 6.9.1c Patch 4 ArcSight ESM Express versions prior to 6.11.0 Patch 1 Description The issue is related to imprope...

PT-2017-13184

Name of the Vulnerable Software and Affected Versions ArcSight ESM versions prior to 6.9.1c Patch 4 ArcSight ESM versions prior to 6.11.0 Patch 1 ArcSight ESM Express versions prior to 6.9.1c Patch 4 ArcSight ESM Express versions prior to 6.11.0 Patch 1 Description An information leakage issue...

PT-2017-13181

Name of the Vulnerable Software and Affected Versions ArcSight ESM versions prior to 6.9.1c Patch 4 ArcSight ESM versions prior to 6.11.0 Patch 1 ArcSight ESM Express versions prior to 6.9.1c Patch 4 ArcSight ESM Express versions prior to 6.11.0 Patch 1 Description The issue is related to...

PT-2017-13180

Name of the Vulnerable Software and Affected Versions ArcSight ESM versions prior to 6.9.1c Patch 4 ArcSight ESM versions prior to 6.11.0 Patch 1 ArcSight ESM Express versions prior to 6.9.1c Patch 4 ArcSight ESM Express versions prior to 6.11.0 Patch 1 Description A reflected Cross-Site...

CVE-2016-1992

HPE ArcSight ESM before 6.8c, and ArcSight ESM Express before 6.9.1, allows remote authenticated users to obtain sensitive information via unspecified vectors...

CVE-2016-1991

HPE ArcSight ESM 5.x before 5.6, 6.0, 6.5.x before 6.5C SP1 Patch 2, and 6.8c before P1, and ArcSight ESM Express before 6.9.1, allows remote authenticated users to conduct unspecified "file download" attacks via unknown vectors...