CVE-2015-5441

Multiple cross-site scripting XSS vulnerabilities in HP ArcSight Management Center before 2.1 and ArcSight Logger before 6.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in HP ArcSight Management Center before 2.1 and ArcSight Logger before 6.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-5441

CVE-2015-5441 concerns stored XSS in HP ArcSight Management Center before 2.1 and ArcSight Logger before 6.1 (CWE-79). Multiple connected sources (e.g., JVN entries and CNVD/NVD mirrors) describe that an arbitrary script may be executed in a user’s browser due to unsafe handling of input. Affecte...

CVE-2015-5441

Multiple cross-site scripting XSS vulnerabilities in HP ArcSight Management Center before 2.1 and ArcSight Logger before 6.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-6030

HP ArcSight Logger 6.0.0.7307.1, ArcSight Command Center 6.8.0.1896.0, and ArcSight Connector Appliance 6.4.0.6881.3 use the root account to execute files owned by the arcsight user, which might allow local users to gain privileges by leveraging arcsight account access...

CVE-2015-6029

HP ArcSight Logger before 6.0 P2 does not limit attempts to authenticate to the SOAP interface, which makes it easier for remote attackers to obtain access via a brute-force approach...

CVE-2015-2903

The CWSAPI SOAP service in HP ArcSight SmartConnectors before 7.1.6 has a hardcoded password, which makes it easier for remote attackers to obtain administrative access by leveraging knowledge of this password...

Command injection

HP ArcSight Logger 6.0.0.7307.1, ArcSight Command Center 6.8.0.1896.0, and ArcSight Connector Appliance 6.4.0.6881.3 use the root account to execute files owned by the arcsight user, which might allow local users to gain privileges by leveraging arcsight account access...

CVE-2015-2902

HP ArcSight SmartConnectors before 7.1.6 do not verify X.509 certificates from Logger devices, which allows man-in-the-middle attackers to spoof devices and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

HP ArcSight Logger before 6.0 P2 does not limit attempts to authenticate to the SOAP interface, which makes it easier for remote attackers to obtain access via a brute-force approach...

Hardcoded credentials

The CWSAPI SOAP service in HP ArcSight SmartConnectors before 7.1.6 has a hardcoded password, which makes it easier for remote attackers to obtain administrative access by leveraging knowledge of this password...

Information disclosure

HP ArcSight SmartConnectors before 7.1.6 do not verify X.509 certificates from Logger devices, which allows man-in-the-middle attackers to spoof devices and obtain sensitive information via a crafted certificate...

CVE-2015-2902

HP ArcSight SmartConnectors before version 7.1.6 fail to verify X.509 certificates from Logger devices, enabling a man-in-the-middle attacker to spoof devices and read SSL-protected log traffic via a crafted certificate. This vulnerability affects ArcSight SmartConnectors prior to 7.1.6 and has a...

CVE-2015-2903

The CWSAPI SOAP service in HP ArcSight SmartConnectors before 7.1.6 has a hardcoded password, which makes it easier for remote attackers to obtain administrative access by leveraging knowledge of this password...

CVE-2015-2903

The CVE-2015-2903 issue affects HP ArcSight SmartConnectors, specifically the CWSAPI SOAP service, prior to version 7.1.6. The root cause is a hardcoded password used by the CWSAPI SOAP service, which can allow a remote attacker to obtain administrative access if the password is known. Impact des...

CVE-2015-6030

HP ArcSight products (ArcSight Logger 6.0.0.7307.1, ArcSight Command Center 6.8.0.1896.0, ArcSight Connector Appliance 6.4.0.6881.3) are affected by CVE-2015-6030. The root account is used to execute files owned by the arcsight user, which may allow local users who have arcsight credentials to ga...

CVE-2015-6030

HP ArcSight Logger 6.0.0.7307.1, ArcSight Command Center 6.8.0.1896.0, and ArcSight Connector Appliance 6.4.0.6881.3 use the root account to execute files owned by the arcsight user, which might allow local users to gain privileges by leveraging arcsight account access...

CVE-2015-2902

HP ArcSight SmartConnectors before 7.1.6 do not verify X.509 certificates from Logger devices, which allows man-in-the-middle attackers to spoof devices and obtain sensitive information via a crafted certificate...

CVE-2015-6029

HP ArcSight Logger before 6.0 P2 is vulnerable to CVE-2015-6029: the SOAP interface does not limit authentication attempts, enabling remote brute-force access. The HP Security Bulletin (HPSBGN03429) confirms the impact and provides remediation: update to ArcSight Logger v6.0 P2 or later (6.0 P2, ...

CVE-2015-6029

HP ArcSight Logger before 6.0 P2 does not limit attempts to authenticate to the SOAP interface, which makes it easier for remote attackers to obtain access via a brute-force approach...