Microfocus vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2023-24470 Potential XML External Entity Injection in ArcSight Logger versions prior to 7.3.0.Critical 9.1 · Jun 13, 2023
• CVE-2023-24468 Broken access control in Advanced Authentication versions prior to 6.4.1.1 and 6.3.7.2Critical 9.8 · Mar 15, 2023
• CVE-2021-38125 Unauthenticated remote code execution in Micro Focus Operations Bridge containerized, affecting versions 2021.05, 2021.08, and newer versions of Micro Focus OpeCritical 9.8 · Apr 11, 2022
• CVE-2021-38124 Remote Code Execution vulnerability in Micro Focus ArcSight Enterprise Security Manager (ESM) product, affecting versions 7.0.2 through 7.5.Critical 9.8 · Sep 28, 2021
• CVE-2021-22517 A potential unauthorized privilege escalation vulnerability has been identified in Micro Focus Data Protector.High 8.8 · Aug 5, 2021
• CVE-2021-22523 XML External Entity vulnerability in Micro Focus Verastream Host Integrator, affecting version 7.8 Update 1 and earlier versions.High 7.6 · Jul 22, 2021
• CVE-2021-22522 Reflected Cross-Site Scripting vulnerability in Micro Focus Verastream Host Integrator, affecting version version 7.8 Update 1 and earlier versions.High 7.1 · Jul 22, 2021
• CVE-2021-22516 Insertion of Sensitive Information into Log File vulnerability in Micro Focus Secure API Manager (SAPIM) product, affecting version 2.0.0.High 7.5 · Jun 4, 2021
• CVE-2021-22519 Execute arbitrary code vulnerability in Micro Focus SiteScope product, affecting versions 11.40,11.41 , 2018.05(11.50), 2018.08(11.51), 2018.11(11.60), 2019.02(Critical 9.8 · May 28, 2021
• CVE-2021-22514 An arbitrary code execution vulnerability exists in Micro Focus Application Performance Management, affecting versions 9.40, 9.50 and 9.51.Critical 9.8 · Apr 28, 2021
• CVE-2021-22505 Escalation of privileges vulnerability in Micro Focus Operations Agent, affects versions 12.0x, 12.10, 12.11, 12.12, 12.14 and 12.15.Critical 9.8 · Apr 13, 2021
• CVE-2021-22507 Authentication bypass vulnerability in Micro Focus Operations Bridge Manager affects versions 2019.05, 2019.11, 2020.05 and 2020.10.Critical 9.8 · Apr 8, 2021
• CVE-2021-22496 Authentication Bypass Vulnerability in Micro Focus Access Manager Product, affects all version prior to version 4.5.3.3.High 7.5 · Mar 25, 2021
• CVE-2021-22504 Arbitrary code execution vulnerability on Micro Focus Operations Bridge Manager product, affecting versions 10.1x, 10.6x, 2018.05, 2018.11, 2019.05, 2019.11, 20Critical 9.8 · Feb 12, 2021
• CVE-2021-22498 XML External Entity Injection vulnerability in Micro Focus Application Lifecycle Management (Previously known as Quality Center) product.High 8.1 · Jan 19, 2021
• CVE-2020-25839 NetIQ Identity Manager 4.8 prior to version 4.8 SP2 HF1 are affected by an injection vulnerability.Critical 9.8 · Nov 20, 2020
• CVE-2020-25837 Sensitive information disclosure vulnerability in Micro Focus Self Service Password Reset (SSPR) product.High 7.5 · Nov 5, 2020
• CVE-2020-11856 Arbitrary code execution vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier.Critical 9.8 · Sep 22, 2020
• CVE-2020-11857 An Authorization Bypass vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier.Critical 9.8 · Sep 22, 2020
• CVE-2020-11855 An Authorization Bypass vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier.High 7.8 · Sep 22, 2020
• CVE-2020-11861 Unauthorized escalation of local privileges vulnerability on Micro Focus Operation Agent, affecting all versions prior to versions 12.11.High 7.8 · Sep 18, 2020
• CVE-2020-11848 Denial of service vulnerability on Micro Focus ArcSight Management Center.High 7.5 · Aug 19, 2020
• CVE-2020-11852 DKIM key management page vulnerability on Micro Focus Secure Messaging Gateway (SMG).High 8.8 · Aug 7, 2020
• CVE-2020-11842 Information disclosure vulnerability in Micro Focus Verastream Host Integrator (VHI) product, affecting versions earlier than 7.8 Update 1 (7.8.49 or 7.8.0.49).High 7.5 · May 4, 2020
• CVE-2020-9523 Insufficiently protected credentials vulnerability on Micro Focus enterprise developer and enterprise server, affecting all version prior to 4.0 Patch Update 16High 8.8 · Apr 17, 2020