Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
30 results
Jun 11, 2024Stored Cross-Site Scripting (XSS) vulnerabilities have been identified in OpenText ArcSight Logger.CVE-2024-4190 · Other software · OpenText · reported by security@opentext.comHigh 8.4
Stored Cross-Site Scripting (XSS) vulnerabilities have been identified in OpenText ArcSight Logger. The vulnerabilities could be remotely exploited.
- Product
- ArcSight Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.microfocus.comportal.microfocus.com
Jun 13, 2023Potential XML External Entity Injection in ArcSight Logger versions prior to 7.3.0.CVE-2023-24470 · Other software · Microfocus · reported by security@opentext.comCritical 9.1
Potential XML External Entity Injection in ArcSight Logger versions prior to 7.3.0.
- Product
- Arcsight Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.microfocus.commicrofocus.com
Jun 13, 2023Potential Cross-Site Scripting in ArcSight Logger versions prior to 7.3.0CVE-2023-24469 · Other software · Microfocus · reported by security@opentext.comMedium 6.1
Potential Cross-Site Scripting in ArcSight Logger versions prior to 7.3.0
- Product
- Arcsight Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.microfocus.commicrofocus.com
Aug 31, 2022Potential vulnerabilities have been identified in Micro Focus ArcSight Logger.CVE-2022-26331 · Other software · Micro Focus · reported by security@opentext.comMedium 6.1
Potential vulnerabilities have been identified in Micro Focus ArcSight Logger. The vulnerabilities could be remotely exploited resulting in Information Disclosure, or Self Cross-Site Scripting (XSS). This issue affects: Micro Focus ArcSight Logger versions prior to v7.2.2 version and prior versions.
- Product
- Micro Focus ArcSight Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.microfocus.commicrofocus.com
Aug 31, 2022Potential vulnerabilities have been identified in Micro Focus ArcSight Logger.CVE-2022-26330 · Other software · Micro Focus · reported by security@opentext.comMedium 6.5
Potential vulnerabilities have been identified in Micro Focus ArcSight Logger. The vulnerabilities could be remotely exploited resulting in Information Disclosure, or Self Cross-Site Scripting (XSS). This issue affects: Micro Focus ArcSight Logger versions prior to v7.2.2 version and prior versions.
- Product
- Micro Focus ArcSight Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.microfocus.commicrofocus.com
Nov 16, 2020Arbitrary code execution vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1.CVE-2020-11851 · Other software · Micro Focus · reported by security@opentext.comCritical 9.8
Arbitrary code execution vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1. The vulnerability could be remotely exploited resulting in the execution of arbitrary code.
- Product
- ArcSight Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.microfocus.comcommunity.microfocus.com
Nov 16, 2020Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting version 7.1.CVE-2020-25834 · Other software · Micro Focus · reported by security@opentext.comMedium 5.4
Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting version 7.1. The vulnerability could be remotely exploited resulting in Cross-Site Scripting (XSS).
- Product
- ArcSight Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.microfocus.comcybereagle.io
Nov 16, 2020Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1.CVE-2020-11860 · Other software · Micro Focus · reported by security@opentext.comMedium 6.1
Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1. The vulnerability could be remotely exploited resulting in Cross-Site Scripting (XSS)
- Product
- ArcSight Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.microfocus.comcommunity.microfocus.com
Jun 12, 2020Cross Site Scripting (XSS) vulnerability in Micro Focus ArcSight Logger product, affecting all version from 6.6.1 up to version 7.0.1.CVE-2020-11839 · Other software · Microfocus · reported by security@opentext.comMedium 6.1
Cross Site Scripting (XSS) vulnerability in Micro Focus ArcSight Logger product, affecting all version from 6.6.1 up to version 7.0.1. The vulnerabilities could be remotely exploited resulting in Cross-Site Scripting (XSS) or information disclosure.
- Product
- Arcsight Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsoftwaresupport.softwaregrp.comsoftwaresupport.softwaregrp.com
Dec 17, 2019Cross-Site Request Forgery vulnerability in all Micro Focus ArcSight Logger affecting all product versions below version 7.0.CVE-2019-11657 · Other software · Micro Focus International · reported by security@opentext.comHigh 8.8
Cross-Site Request Forgery vulnerability in all Micro Focus ArcSight Logger affecting all product versions below version 7.0. The vulnerability could be exploited to perform CSRF attack.
- Product
- ArcSight Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.microfocus.comcommunity.microfocus.com
Oct 4, 2019Stored XSS vulnerability in Micro Focus ArcSight Logger, affects versions prior to Logger 6.7.1 HotFix 6.7.1.8262.0.CVE-2019-11656 · Other software · HP · reported by security@opentext.comMedium 5.4
Stored XSS vulnerability in Micro Focus ArcSight Logger, affects versions prior to Logger 6.7.1 HotFix 6.7.1.8262.0. This vulnerability could allow Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
- Product
- Arcsight Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.microfocus.comcommunity.microfocus.com
Oct 4, 2019Unrestricted file upload vulnerability in Micro Focus ArcSight Logger, version 6.7.0 and later.CVE-2019-11655 · Other software · HP · reported by security@opentext.comHigh 8.8
Unrestricted file upload vulnerability in Micro Focus ArcSight Logger, version 6.7.0 and later. This vulnerability could allow Unrestricted Upload of File with Dangerous type.
- Product
- Arcsight Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.microfocus.comcommunity.microfocus.com
Jul 24, 2019Mitigates a stored cross site scripting issue in ArcSight Logger versions prior to 6.7.1CVE-2019-3485 · Other software · Micro Focus · reported by security@opentext.comMedium 4.6
Mitigates a stored cross site scripting issue in ArcSight Logger versions prior to 6.7.1
- Product
- ArcSight Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comcommunity.microfocus.com
Mar 25, 2019Mitigates a remote code execution issue in ArcSight Logger versions prior to 6.7.CVE-2019-3484 · Other software · HP · reported by security@opentext.comHigh 7.8
Mitigates a remote code execution issue in ArcSight Logger versions prior to 6.7.
- Product
- Arcsight Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsoftwaresupport.softwaregrp.comsoftwaresupport.softwaregrp.com
Mar 25, 2019Mitigates a potential information leakage issue in ArcSight Logger versions prior to 6.7.CVE-2019-3483 · Other software · HP · reported by security@opentext.comMedium 6.5
Mitigates a potential information leakage issue in ArcSight Logger versions prior to 6.7.
- Product
- Arcsight Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsoftwaresupport.softwaregrp.comsoftwaresupport.softwaregrp.com
Mar 25, 2019Mitigates a directory traversal issue in ArcSight Logger versions prior to 6.7.CVE-2019-3482 · Other software · HP · reported by security@opentext.comMedium 6.5
Mitigates a directory traversal issue in ArcSight Logger versions prior to 6.7.
- Product
- Arcsight Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsoftwaresupport.softwaregrp.comsoftwaresupport.softwaregrp.com
Mar 25, 2019Mitigates a XML External Entity Parsing issue in ArcSight Logger versions prior to 6.7.CVE-2019-3481 · Other software · HP · reported by security@opentext.comHigh 7.1
Mitigates a XML External Entity Parsing issue in ArcSight Logger versions prior to 6.7.
- Product
- Arcsight Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsoftwaresupport.softwaregrp.comsoftwaresupport.softwaregrp.com
Mar 25, 2019Mitigates a stored/reflected XSS issue in ArcSight Logger versions prior to 6.7.CVE-2019-3480 · Other software · HP · reported by security@opentext.comMedium 6.1
Mitigates a stored/reflected XSS issue in ArcSight Logger versions prior to 6.7.
- Product
- Arcsight Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsoftwaresupport.softwaregrp.comsoftwaresupport.softwaregrp.com
Mar 25, 2019Mitigates a potential remote code execution issue in ArcSight Logger versions prior to 6.7.CVE-2019-3479 · Other software · HP · reported by security@opentext.comCritical 9.8
Mitigates a potential remote code execution issue in ArcSight Logger versions prior to 6.7.
- Product
- Arcsight Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsoftwaresupport.softwaregrp.comsoftwaresupport.softwaregrp.com
Jan 16, 2016HPE ArcSight Logger before 6.1P1 allows remote authenticated users to execute arbitrary code via unspecified input to the (1) Intellicus or (2) client-certificaCVE-2015-6864 · Other software · HP · reported by MITREMedium 6.3
HPE ArcSight Logger before 6.1P1 allows remote authenticated users to execute arbitrary code via unspecified input to the (1) Intellicus or (2) client-certificate upload component.
- Product
- Arcsight Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordh20566.www2.hpe.comh20566.www2.hpe.com
Jan 16, 2016HPE ArcSight Logger before 6.1P1 allows remote attackers to execute arbitrary code via unspecified input to the (1) Intellicus or (2) client-certificate upload CVE-2015-6863 · Other software · HP · reported by MITREHigh 7.3
HPE ArcSight Logger before 6.1P1 allows remote attackers to execute arbitrary code via unspecified input to the (1) Intellicus or (2) client-certificate upload component.
- Product
- Arcsight Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordh20566.www2.hpe.comh20566.www2.hpe.com
Nov 11, 2015Multiple cross-site scripting (XSS) vulnerabilities in HP ArcSight Management Center before 2.1 and ArcSight Logger before 6.1 allow remote attackers to inject CVE-2015-5441 · Other software · HP · reported by hp-security-alert@hp.comMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in HP ArcSight Management Center before 2.1 and ArcSight Logger before 6.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Archsight Management Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2015HP ArcSight Logger 6.0.0.7307.1, ArcSight Command Center 6.8.0.1896.0, and ArcSight Connector Appliance 6.4.0.6881.3 use the root account to execute files ownedCVE-2015-6030 · Other software · HP · reported by cret@cert.orgHigh 7.2
HP ArcSight Logger 6.0.0.7307.1, ArcSight Command Center 6.8.0.1896.0, and ArcSight Connector Appliance 6.4.0.6881.3 use the root account to execute files owned by the arcsight user, which might allow local users to gain privileges by leveraging arcsight account access.
- Product
- Arcsight Connector Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgsecuritytracker.com
Nov 3, 2015HP ArcSight Logger before 6.0 P2 does not limit attempts to authenticate to the SOAP interface, which makes it easier for remote attackers to obtain access via CVE-2015-6029 · Other software · HP · reported by cret@cert.orgMedium 5
HP ArcSight Logger before 6.0 P2 does not limit attempts to authenticate to the SOAP interface, which makes it easier for remote attackers to obtain access via a brute-force approach.
- Product
- Arcsight Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgsecurityfocus.com
Sep 16, 2015HP ArcSight Logger before 6.0 P2 allows remote authenticated users to bypass the intended authorization policy via unspecified vectors.CVE-2015-2136 · Other software · HP · reported by hp-security-alert@hp.comMedium 4
HP ArcSight Logger before 6.0 P2 allows remote authenticated users to bypass the intended authorization policy via unspecified vectors.
- Product
- Arcsight Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordh20564.www2.hpe.comh20564.www2.hpe.com
Mar 13, 2015Multiple unspecified vulnerabilities in HP ArcSight Logger before 6.0P1 have unknown impact and remote authenticated attack vectors.CVE-2014-7884 · Other software · HP · reported by hp-security-alert@hp.comHigh 9
Multiple unspecified vulnerabilities in HP ArcSight Logger before 6.0P1 have unknown impact and remote authenticated attack vectors.
- Product
- Arcsight Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgsecuritytracker.com
Feb 16, 2013Unspecified vulnerability in HP ArcSight Connector Appliance 6.3 and earlier and ArcSight Logger 5.2 and earlier allows remote authenticated users to execute arCVE-2012-5199 · Other software · HP · reported by hp-security-alert@hp.comMedium 6.8
Unspecified vulnerability in HP ArcSight Connector Appliance 6.3 and earlier and ArcSight Logger 5.2 and earlier allows remote authenticated users to execute arbitrary code via unknown vectors.
- Product
- Arcsight Connector Appliance Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordh20565.www2.hp.comh20565.www2.hp.com
Feb 16, 2013Unspecified vulnerability in HP ArcSight Connector Appliance before 6.3 and ArcSight Logger 5.2 and earlier allows remote attackers to obtain sensitive informatCVE-2012-5198 · Other software · HP · reported by hp-security-alert@hp.comMedium 5
Unspecified vulnerability in HP ArcSight Connector Appliance before 6.3 and ArcSight Logger 5.2 and earlier allows remote attackers to obtain sensitive information via unknown vectors.
- Product
- Arcsight Connector Appliance Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordh20565.www2.hp.comkb.cert.org
Feb 16, 2013Unspecified vulnerability in HP ArcSight Connector Appliance 6.3 and earlier and ArcSight Logger 5.2 and earlier allows remote authenticated users to obtain senCVE-2012-3286 · Other software · HP · reported by hp-security-alert@hp.comMedium 6.5
Unspecified vulnerability in HP ArcSight Connector Appliance 6.3 and earlier and ArcSight Logger 5.2 and earlier allows remote authenticated users to obtain sensitive information, modify data, or cause a denial of service via unknown vectors.
- Product
- Arcsight Connector Appliance Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordh20565.www2.hp.comkb.cert.org
Aug 8, 2012Cross-site scripting (XSS) vulnerability in the import functionality in HP ArcSight Connector appliance 6.2.0.6244.0 and ArcSight Logger appliance 5.2.0.6288.0 CVE-2012-2960 · Other software · HP · reported by cret@cert.orgMedium 4.3
Cross-site scripting (XSS) vulnerability in the import functionality in HP ArcSight Connector appliance 6.2.0.6244.0 and ArcSight Logger appliance 5.2.0.6288.0 allows remote attackers to inject arbitrary web script or HTML via a crafted file.
- Product
- Arcsight Connector Appliance Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordh20565.www2.hp.comkb.cert.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.