216
CVEs
46
Critical
70
High
2
KEV
28
PoC
114
Unpatched C/H
4.2%
Patch Rate
4.5%
Avg EPSS
Severity Breakdown
CRITICAL
46
HIGH
70
MEDIUM
97
LOW
3
Monthly CVE Trend
Affected Products (30)
Service Manager
16
Access Manager
14
Enterprise Developer
12
Imanager
12
Enterprise Server
12
Arcsight Logger
10
Application Automation Tools
9
Edirectory
8
Arcsight Management Center
8
Open Redirect
7
Operations Bridge
6
Operations Bridge Manager
6
Arcsight Enterprise Security Manager
6
Solutions Business Manager
6
Filr
6
Netiq Advanced Authentication
5
Application Performance Management
5
Netiq Access Manager
5
Operations Agent
5
Operation Bridge Reporter
4
Sentinel
4
Verastream Host Integrator
4
Fortify Software Security Center
4
Rumba
3
Data Center Automation
3
Visibroker
3
Service Management Automation
3
Content Manager
3
Secure Messaging Gateway
3
Hybrid Cloud Management
3
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2012-0432 | Stack-based buffer overflow in the Novell NCP implementation in NetIQ eDirectory 8.8.7.x before 8.8.7.2 allows remote attackers to have an unspecified impact via unknown vectors. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 85.2%. | CRITICAL | 10.0 | 85.2% | 170 |
PoC
No patch
|
| CVE-2012-5932 | Eval injection vulnerability in the ldapagnt_eval function in ldapagnt.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 allows remote attackers to execute arbitrary Perl code. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 49.8%. | CRITICAL | 10.0 | 49.8% | 135 |
PoC
No patch
|
| CVE-2016-1606 | Multiple stack-based buffer overflows in COM objects in Micro Focus Rumba 9.4.x before 9.4 HF 13960 allow remote attackers to execute arbitrary code via (1) the NetworkName property value to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 56.7%. | CRITICAL | 9.8 | 56.7% | 126 |
PoC
No patch
|
| CVE-2016-5228 | Stack-based buffer overflow in the PlayMacro function in ObjectXMacro.ObjectXMacro in WdMacCtl.ocx in Micro Focus Rumba 9.x before 9.3 HF 11997 and 9.4.x before 9.4 HF 12815 allows remote attackers. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 51.2%. | CRITICAL | 9.8 | 51.2% | 120 |
PoC
No patch
|
| CVE-2015-6946 | Multiple stack-based buffer overflows in the Reprise License Manager service in Borland AccuRev allow remote attackers to execute arbitrary code via the (1) akey or (2) actserver parameter to the. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 37.1%. | CRITICAL | 9.3 | 37.1% | 104 |
PoC
No patch
|
| CVE-2018-12464 | A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthenticated remote attacker to execute arbitrary SQL statements. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 80.5% | 84 |
PoC
No patch
|
| CVE-2020-11857 | An Authorization Bypass vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 15.8% | 84 |
PoC
No patch
|
| CVE-2020-11854 | Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) vulnerability in Micro Focus products products Operation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 74.2% | 84 |
PoC
No patch
|
| CVE-2021-22502 | Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 96.7% | 84 |
KEV
PoC
No patch
|
| CVE-2020-11853 | Arbitrary code execution vulnerability affecting multiple Micro Focus products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available. | HIGH | 8.8 | 77.0% | 79 |
PoC
No patch
|
| CVE-2019-11660 | Privileges manipulation in Micro Focus Data Protector, versions 10.00, 10.01, 10.02, 10.03, 10.04, 10.10, 10.20, 10.30, 10.40. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.8 | 7.8% | 74 |
PoC
No patch
|
| CVE-2020-11855 | An Authorization Bypass vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available. | HIGH | 7.8 | 1.3% | 74 |
PoC
No patch
|
| CVE-2020-11858 | Code execution with escalated privileges vulnerability in Micro Focus products Operation Bridge Manager and Operation Bridge (containerized). Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available. | HIGH | 7.8 | 2.7% | 74 |
PoC
No patch
|
| CVE-2016-5764 | Micro Focus Rumba FTP 4.X client buffer overflow makes it possible to corrupt the stack and allow arbitrary code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 9.2% | 73 |
PoC
No patch
|
| CVE-2018-12465 | An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway (SMG) allows a remote attacker authenticated as a privileged user to execute. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.2 | 79.0% | 71 |
PoC
No patch
|