Micro Focus vulnerabilities
We track 12 vulnerabilities in Micro Focus products across 15 products. 12 are rated high or critical, and none are known to be exploited. The most recent was published on October 16, 2024.
Latest Micro Focus vulnerabilities
- 8.0 High severity
OpenText Application Automation Tools: Improper Restriction of XML External Entity Reference
Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below.
- 8.0 High severity
OpenText Application Automation Tools: Improper Restriction of XML External Entity Reference
Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below.
- 8.0 High severity
OpenText Application Automation Tools: Improper Restriction of XML External Entity Reference
Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below.
- 9.8 Critical severity
iManager: Improper Restriction of XML External Entity Reference
XML External Entity injection vulnerability found in OpenText™ iManager 3.2.6.0200. This could lead to remote code execution by parsing untrusted XML payload
- 9.8 Critical severity
iManager: Unrestricted Upload of File with Dangerous Type
File Upload vulnerability in unauthenticated session found in OpenText™ iManager 3.2.6.0200. The vulnerability could allow ant attacker to upload a file without authentication.
- 9.8 Critical severity
iManager: Improper Authentication
Broken Authentication vulnerability discovered in OpenText™ iManager 3.2.6.0200. This vulnerability allows an attacker to manipulate certain parameters to bypass authentication.
- 9.8 Critical severity
iManager: Improper Neutralization of Special Elements used in a Command
Remote Code Execution has been discovered in OpenText™ iManager 3.2.6.0200. The vulnerability can trigger command injection and insecure deserialization issues.
- 8.7 High severity
ArcSight Management Center: Improper Neutralization of Input During Web Page Generation
A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText ArcSight Management Center and ArcSight Platform. The vulnerability could be remotely exploited.
- 7.4 High severity
ZENworks Configuration Management (ZCM): Incorrect Authorization
Incorrect Authorization vulnerability in OpenText™ ZENworks Configuration Management (ZCM) allows Unauthorized Use of Device Resources.This issue affects ZENworks Configuration Management (ZCM) versions: 2020 update 3, 23.3, and 23.4.
- 7.8 High severity
Operations Agent: Improper Privilege Management
Local privilege escalation vulnerability affects OpenText Operations Agent product versions 12.15 and 12.20-12.25 when installed on Non-Windows platforms. The vulnerability could allow local privilege escalation.
- 9.8 Critical severity
Visual COBOL, COBOL Server, Enterprise…: Improper Authentication
User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server (including product variants such as Enterprise Test Server), versions 7.0 patch updates
- 7.2 High severity
ZENworks Configuration Management (ZCM): Improper Privilege Management
A vulnerability has been identified in Micro Focus ZENworks 2020 Update 3a and prior versions. This vulnerability allows administrators with rights to perform actions (e.g., install a bundle) on a set of managed devices, to be able to exercise these rights on