Micro Focus vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Micro Focus flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2021-22506 Micro Focus Access Manager Information LeakageExploited since Nov 3, 2021 · CVSS 7.5
• CVE-2021-22502 Micro Focus Operation Bridge Report (OBR) Remote Code ExecutionExploited since Nov 3, 2021 · CVSS 9.8

Latest high and critical flaws

• CVE-2023-32265 A potential security vulnerability has been identified in the Enterprise Server Common Web Administration (ESCWA) component used in Enterprise Server, EnterpriHigh 7.1 · Jul 20, 2023
• CVE-2022-38758 Cross-site Scripting (XSS) vulnerability in NetIQ iManager prior to version 3.2.6 allows attacker to execute malicious scripts on the user's browser.High 7.2 · Jan 26, 2023
• CVE-2022-38757 A vulnerability has been identified in Micro Focus ZENworks 2020 Update 3a and prior versions.High 7.2 · Dec 23, 2022
• CVE-2022-38754 A potential vulnerability has been identified in Micro Focus Operations Bridge - Containerized.High 8 · Dec 8, 2022
• CVE-2021-22528 Reflected Cross Site Scripting (XSS) vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4High 8 · Sep 13, 2021
• CVE-2021-22506 Micro Focus Access Manager Information LeakageExploited · High 7.5 · Mar 26, 2021
• CVE-2019-18945 Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to privilege escalation vulnerability.High 7.3 · Feb 25, 2021
• CVE-2021-22502 Micro Focus Operation Bridge Report (OBR) Remote Code ExecutionExploited · Critical 9.8 · Feb 8, 2021
• CVE-2020-11851 Arbitrary code execution vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1.Critical 9.8 · Nov 16, 2020
• CVE-2020-11858 Code execution with escalated privileges vulnerability in Micro Focus products Operation Bridge Manager and Operation Bridge (containerized).High 7.8 · Oct 27, 2020
• CVE-2020-11854 Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) vulnerability in MicCritical 9.8 · Oct 27, 2020
• CVE-2020-11853 Arbitrary code execution vulnerability affecting multiple Micro Focus products.High 8.8 · Oct 22, 2020
• CVE-2020-11844 Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management.Critical 10 · May 29, 2020
• CVE-2020-9521 An SQL injection vulnerability was discovered in Micro Focus Service Manager Automation (SMA), affecting versions 2019.08, 2019.05, 2019.02, 2018.08, 2018.05, 2High 8.8 · Mar 26, 2020
• CVE-2019-11657 Cross-Site Request Forgery vulnerability in all Micro Focus ArcSight Logger affecting all product versions below version 7.0.High 8.8 · Dec 17, 2019
• CVE-2019-17087 Unauthorized file download vulnerability in all supported versions of Micro Focus AcuToWeb.High 7.5 · Dec 11, 2019
• CVE-2019-11661 Allow changes to some table by non-SysAdmin in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.High 8.3 · Sep 18, 2019
• CVE-2019-11665 Data exposure in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62.High 7.5 · Sep 17, 2019
• CVE-2019-11666 Insecure deserialization of untrusted data in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.6High 8.8 · Sep 17, 2019
• CVE-2019-11667 Unauthorized access to contact information in Micro Focus Service Manager, versions 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62.High 7.5 · Sep 17, 2019
• CVE-2019-11669 Modifiable read only check box In Micro Focus Service Manager, versions 9.60p1, 9.61, 9.62.High 7.5 · Sep 10, 2019
• CVE-2019-11654 Path traversal vulnerability in Micro Focus Verastream Host Integrator (VHI), versions 7.7 SP2 and earlier, The vulnerability allows remote unauthenticated attaHigh 7.5 · Aug 23, 2019
• CVE-2019-11652 A potential authorization bypass issue was found in Micro Focus Self Service Password Reset (SSPR) versions prior to: 4.4.0.3, 4.3.0.6, and 4.2.0.6.Critical 9.8 · Aug 14, 2019
• CVE-2019-11648 An information leakage exists in Micro Focus NetIQ Self Service Password Reset Software all versions prior to version 4.4.High 7.5 · Jun 24, 2019
• CVE-2019-3493 A potential security vulnerability has been identified in Micro Focus Network Automation Software 9.20, 9.21, 10.00, 10.10, 10.20, 10.30, 10.40, 10.50, 2018.05,High 8.8 · Apr 29, 2019