CVSS: 8.8EPSS: 0%CPEs: 8EXPL: 0CVE-2017-5187
https://notcve.org/view.php?id=CVE-2017-5187
A Cross-Site Request Forgery (CWE-352) vulnerability in Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to view and alter (CWE-275) configuration information and inject OS commands (CWE-78) via forged requests. Una vulnerabilidad de tipo Cross-Site Request Forgery (CWE-352) en Directory Server (también llamado Enterprise Server Administration web UI) en Micro Focus Enterprise Developer y Enterprise Server 2.3 y anteriores, 2.3 Update 1 en versiones anteriores a Hotfix 8, y 2.3 Update 2 en versiones anteriores a Hotfix 9 permite que atacantes remotos sin autenticar vean y alteren (CWE-275) la información de configuración e inyecten comandos del sistema operativo (CWE-78) mediante peticiones falsificadas. • https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0CVE-2017-7421
https://notcve.org/view.php?id=CVE-2017-7421
Reflected and stored Cross-Site Scripting (XSS, CWE-79) vulnerabilities in Directory Server (aka Enterprise Server Administration web UI) and ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allow remote authenticated attackers to bypass protection mechanisms (CWE-693) and other security features. Las vulnerabilidades de cross-Site Scripting (XSS) reflejado y stored en Directory Server (también llamado Enterprise Server Administration web UI) y ESMAC (también llamado Enterprise Server Monitor and Control) en Micro Focus Enterprise Developer y Enterprise Server 2.3 y anteriores, 2.3 Update 1 en versiones anteriores a Hotfix 8, y 2.3 Update 2 en versiones anteriores a Hotfix 9 permiten que atacantes remotos autenticados omitan los mecanismos de protección (CWE-693) y otras características de seguridad. • https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •