CVSS: 6.1EPSS: 0%CPEs: 68EXPL: 0CVE-2019-11651
https://notcve.org/view.php?id=CVE-2019-11651
02 Oct 2019 — Reflected XSS on Micro Focus Enterprise Developer and Enterprise Server, all versions prior to version 3.0 Patch Update 20, version 4.0 Patch Update 12, and version 5.0 Patch Update 2. The vulnerability could be exploited to redirect a user to a malicious page or forge certain types of web requests. Una vulnerabilidad de tipo XSS Reflejado en Micro Focus Enterprise Developer y Enterprise Server, todas las versiones anteriores a la versión 3.0 Patch Update 20, versión 4.0 Patch Update 12 y versión 5.0 Patch ... • https://softwaresupport.softwaregrp.com/doc/KM03532232 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 2CVE-2019-3474 – Path traversal vulnerability in Filr web application
https://notcve.org/view.php?id=CVE-2019-3474
20 Feb 2019 — A path traversal vulnerability in the web application component of Micro Focus Filr 3.x allows a remote attacker authenticated as a low privilege user to download arbitrary files from the Filr server. This vulnerability affects all versions of Filr 3.x prior to Security Update 6. Una vulnerabilidad de salto de directorio en el componente de aplicación web de Micro Focus Filr, en versiones 3.x, permite que un atacante remoto autenticado como usuario con pocos privilegios descargue archivos arbitrarios del se... • https://packetstorm.news/files/id/151803 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 2CVE-2019-3475 – Local privilege escalation in Filr famtd
https://notcve.org/view.php?id=CVE-2019-3475
20 Feb 2019 — A local privilege escalation vulnerability in the famtd component of Micro Focus Filr 3.0 allows a local attacker authenticated as a low privilege user to escalate to root. This vulnerability affects all versions of Filr 3.x prior to Security Update 6. Una vulnerabilidad de escalado de privilegios local en el componente famtd de Micro Focus Filr 3.0 permite que un atacante local autenticado como usuario con bajos privilegios escale a root. Esta vulnerabilidad afecta a todas las versiones 3.x de Filr anterio... • https://packetstorm.news/files/id/151803 • CWE-264: Permissions, Privileges, and Access Controls CWE-269: Improper Privilege Management •
CVSS: 7.5EPSS: 0%CPEs: 12EXPL: 0CVE-2018-12469
https://notcve.org/view.php?id=CVE-2018-12469
12 Oct 2018 — Incorrect handling of an invalid value for an HTTP request parameter by Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 Update 2 and earlier, 3.0 before Patch Update 12, and 4.0 before Patch Update 2 causes a null pointer dereference (CWE-476) and subsequent denial of service due to process termination. La gestión incorrecta de un valor inválido para un parámetro de petición HTTP por parte de Directory Server (también conocido como... • https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29624/enterprise-server-security-fix-october-2018 • CWE-476: NULL Pointer Dereference •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-1917
https://notcve.org/view.php?id=CVE-2016-1917
22 Apr 2016 — Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-1918. Vulnerabilidad de XSS en la Management Console en BlackBerry Enterprise Server (BES) 12 en versiones anteriores a 12.4.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de una URL manipulada, una vulnerabilidad diferen... • http://www.blackberry.com/btsc/KB38118 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-1918
https://notcve.org/view.php?id=CVE-2016-1918
22 Apr 2016 — Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-1917. Vulnerabilidad de XSS en la Management Console en BlackBerry Enterprise Server (BES) 12 en versiones anteriores a 12.4.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de una URL manipulada, una vulnerabilidad diferen... • http://www.blackberry.com/btsc/KB38118 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2016-1916
https://notcve.org/view.php?id=CVE-2016-1916
22 Apr 2016 — Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote authenticated users to inject arbitrary web script or HTML by leveraging basic administrative access to create a crafted policy, leading to improper rendering on a certain Export IT screen. Vulnerabilidad de XSS en la Management Console en BlackBerry Enterprise Server (BES) 12 en versiones anteriores a 12.4.1 permite a usuarios autenticados remotos inyectar secuencias de co... • http://www.blackberry.com/btsc/KB38117 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-3126
https://notcve.org/view.php?id=CVE-2016-3126
22 Apr 2016 — Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. Vulnerabilidad de XSS en la Management Console en BlackBerry Enterprise Server (BES) 12 en versiones anteriores a 12.4.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de una URL manipulada. • http://www.blackberry.com/btsc/KB38119 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 10EXPL: 0CVE-2014-1469
https://notcve.org/view.php?id=CVE-2014-1469
18 Aug 2014 — BlackBerry Enterprise Server 5.x before 5.0.4 MR7 and Enterprise Service 10.x before 10.2.2 log cleartext credentials during exception handling, which allows local users to obtain sensitive information by reading the exception log file. BlackBerry Enterprise Server 5.x anterior a 5.0.4 MR7 y Enterprise Service 10.x anterior a 10.2.2 registran las credenciales en texto plano durante el manejo de excepciones, lo que permite a usuarios locales obtener información sensible mediante la lectura del fichero del re... • http://secunia.com/advisories/60154 • CWE-310: Cryptographic Issues •
CVSS: 5.3EPSS: 0%CPEs: 10EXPL: 0CVE-2014-1467
https://notcve.org/view.php?id=CVE-2014-1467
14 Feb 2014 — BlackBerry Enterprise Service 10 before 10.2.1, Universal Device Service 6, Enterprise Server Express for Domino through 5.0.4, Enterprise Server Express for Exchange through 5.0.4, Enterprise Server for Domino through 5.0.4 MR6, Enterprise Server for Exchange through 5.0.4 MR6, and Enterprise Server for GroupWise through 5.0.4 MR6 log cleartext credentials during exception handling, which might allow context-dependent attackers to obtain sensitive information by reading a log file. BlackBerry Enterprise Se... • http://www.blackberry.com/btsc/KB35647 • CWE-255: Credentials Management Errors •