RSS   Vulnerabilities for 'Enterprise developer'   RSS

2018-10-12
 
CVE-2018-12469

CWE-476
 
 
Incorrect handling of an invalid value for an HTTP request parameter by Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 Update 2 and earlier, 3.0 before Patch Update 12, and 4.0 before Patch Update 2 causes a null pointer dereference (CWE-476) and subsequent denial of service due to process termination.

 
2017-08-21
 
CVE-2017-7424

 
 
A Path Traversal (CWE-22) vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote authenticated users to download arbitrary files from a system running the product, if this component is configured. Note esfadmingui is not enabled by default.

 
 
CVE-2017-7423

 
 
A Cross-Site Request Forgery (CWE-352) vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to forge requests, if this component is configured. This includes creating new privileged credentials, resulting in privilege elevation (CWE-275). Note esfadmingui is not enabled by default.

 
 
CVE-2017-7422

 
 
Reflected and stored Cross-Site Scripting (XSS, CWE-79) vulnerabilities in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allow remote authenticated attackers to bypass protection mechanisms (CWE-693) and other security features, if this component is configured. Note esfadmingui is not enabled by default.

 
 
CVE-2017-7421

 
 
Reflected and stored Cross-Site Scripting (XSS, CWE-79) vulnerabilities in Directory Server (aka Enterprise Server Administration web UI) and ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allow remote authenticated attackers to bypass protection mechanisms (CWE-693) and other security features.

 
 
CVE-2017-7420

 
 
An Authentication Bypass (CWE-287) vulnerability in ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to view and alter configuration information and alter the state of the running product (CWE-275).

 
 
CVE-2017-5187

 
 
A Cross-Site Request Forgery (CWE-352) vulnerability in Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to view and alter (CWE-275) configuration information and inject OS commands (CWE-78) via forged requests.

 

 >>> Vendor: Microfocus 39 Products
Cobol
Visibroker
Rumba
Rumba ftp
Host access management and security server
Reflection for the web
Reflection security gateway
Reflection zfe
Enterprise server monitor and control
Enterprise server
Enterprise developer
Directory server
Bi-directional driver
Connected backup
Project and portfolio management
Operations manager i
Fortify audit workbench
Fortify software security center
Universal cmdb foundation software
Ucmdb configuration manager
Project and portfolio management center
Cms server
Universal cmdb
Universal cmdb browser
Client
Arcsight enterprise security manager
Data center automation
Hybrid cloud management
Network operations management
Operations bridge
Service management automation
Network virtualization
Service virtualization
Unified functional testing
Netware
Access manager
Service manager
Real user monitoring
Edirectory

Copyright 2019, cxsecurity.com

 

Back to Top