Improper access control

An insufficient access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows an unauthorized user to download log files...

Improper access control

An improper access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows unauthorized users to retrieve or modify storage information...

Information disclosure

An information leakage vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows disclosure of product license features...

Cross site scripting

A reflected Cross-Site ScriptingXSS vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows for unintended information when a specific URL is sent to the system...

CVE-2017-13989: Undefined Security Weakness

An improper access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows unauthorized users to retrieve or modify storage information...

CVE-2017-13991: Exposure of Sensitive Information to an Unauthorized Actor

An information leakage vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows disclosure of product license features...

CVE-2017-13988: Undefined Security Weakness

An improper access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows unauthorized users to alter the maximum size of storage groups and enable/disable the setting for the 'follow schedule' function...

CVE-2017-13986: Improper Neutralization of Input During Web Page Generation

A reflected Cross-Site ScriptingXSS vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows for unintended information when a specific URL is sent to the system...

CVE-2017-13990: Exposure of Sensitive Information to an Unauthorized Actor

An information leakage vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows disclosure of Apache Tomcat application server version...

CVE-2017-13987: Undefined Security Weakness

An insufficient access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows an unauthorized user to download log files...

CVE-2017-13990

An information leakage vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows disclosure of Apache Tomcat application server version...

CVE-2017-13990

Summary: CVE-2017-13990 describes an information-disclosure vulnerability in HP ArcSight ESM/ESM Express (ArcSight) where any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1 can disclose the Apache Tomcat application server version. Affected products/versions: ArcSight ESM and ArcSight ESM ...

CVE-2017-13987

An insufficient access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows an unauthorized user to download log files...

CVE-2017-13991

The CVE-2017-13991 entry concerns an information-disclosure vulnerability in HP ArcSight ESM and ArcSight ESM Express. Affected are any 6.x versions prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, where an attacker could disclose product license features. The Connected documents reference the same iss...

CVE-2017-13987

Summary: CVE-2017-13987 concerns HP ArcSight ESM/ESM Express. The vulnerability is an insufficient access control that allows an unauthorized user to download log files. This affects any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. Affected product/limitation: ArcSight ESM and ArcSight ...

CVE-2017-13986

A reflected Cross-Site ScriptingXSS vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows for unintended information when a specific URL is sent to the system...

CVE-2017-13988

Affected product: ArcSight ESM and ArcSight ESM Express. Vulnerable versions: any 6.x prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. Root cause / impact: improper access control lets unauthorized users alter the maximum size of storage groups and enable/disable the follow schedule function. Exploitab...

CVE-2017-13986

CVE-2017-13986 is a reflected Cross-Site Scripting (XSS) vulnerability in ArcSight ESM and ArcSight ESM Express . Affected are any 6.x versions prior to 6.9.1c Patch 4 or 6.11.0 Patch 1 . The issue arises from handling a crafted URL, enabling unintended information exposure. According to NVD, the...

CVE-2017-13989

CVE-2017-13989 describes an improper access control vulnerability in HP ArcSight ESM and ArcSight ESM Express. Affected products are ArcSight ESM/Express versions prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. The issue allows unauthorized users to retrieve or modify storage information due to inadeq...

CVE-2017-13989

An improper access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows unauthorized users to retrieve or modify storage information...