NotCVE - vendor:"Microfocus" product:"Service Management Automation" version:"2018.05"

5 results (0.076 seconds)

CVSS: 8.8EPSS: 80%CPEs: 36EXPL: 0

CVE-2020-11853 – Arbitrary code execution vulnerability on multiple Micro Focus products

https://notcve.org/view.php?id=CVE-2020-11853

Arbitrary code execution vulnerability affecting multiple Micro Focus products. 1.) Operation Bridge Manager affecting version: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, versions 10.6x and 10.1x and older versions. 2.) Application Performance Management affecting versions : 9.51, 9.50 and 9.40 with uCMDB 10.33 CUP 3 3.) Data Center Automation affected version 2019.11 4.) Operations Bridge (containerized) affecting versions: 2019.11, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05, 2018.02, 2017.11 5.) • http://packetstormsecurity.com/files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.html http://packetstormsecurity.com/files/161366/Micro-Focus-Operations-Bridge-Manager-Remote-Code-Execution.html https://softwaresupport.softwaregrp.com/doc/KM03747657 https://softwaresupport.softwaregrp.com/doc/KM03747658 https://softwaresupport.softwaregrp.com/doc/KM03747854 https://softwaresupport.softwaregrp.com/doc/KM03747948 https://softwaresupport.softwaregrp.com/doc/KM03747949 https://softwaresupport.softwaregrp.com/doc/KM03747950 https://soft •

CVSS: 10.0EPSS: 3%CPEs: 8EXPL: 0

CVE-2020-11844 – Incorrect Authorization vulnerability in the Micro Focus Container Deployment Foundation affecting multiple products.

https://notcve.org/view.php?id=CVE-2020-11844

Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight Interset. version 6.0.0. - ArcSight ESM (when ArcSight Fusion 1.0 is installed). version 7.2.1. - Service Management Automation (SMA). versions 2018.05 to 2020.02 - Operation Bridge Suite (Containerized). Versions 2018.05 to 2020.02. - Network Operation Management. versions 2017.11 to 2019.11. - Data Center Automation Containerized. versions 2018.05 to 2019.11 - Identity Intelligence. versions 1.1.0 and 1.1.1. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation. La vulnerabilidad de la autorización incorrecta en el componente Micro Focus Container Deployment Foundation afecta a los productos: Hybrid Cloud Management. desde la versión 2018.05 hasta 2019.11. - ArcSight Investigate. versiones 2.4.0, 3.0.0 y 3.1.0. - ArcSight Transformation Hub. versiones 3.0.0, 3.1.0, 3.2.0. - ArcSight Interset. versión 6.0.0. - ArcSight ESM (cuando se instala ArcSight Fusion 1.0). versión 7.2.1. - Service Management Automation (SMA). desde la versión 2018.05 hasta 2020.02 - Operation Bridge Suite (Containerized). desde la versión 2018.05 hasta 2020.02. - Network Operation Management. desde la versión 2017.11 hasta 2019.11. - Data Center Automation Containerized. desde la versión 2018.05 hasta 2019.11. • https://softwaresupport.softwaregrp.com/doc/KM03645628 https://softwaresupport.softwaregrp.com/doc/KM03645629 https://softwaresupport.softwaregrp.com/doc/KM03645630 https://softwaresupport.softwaregrp.com/doc/KM03645631 https://softwaresupport.softwaregrp.com/doc/KM03645636 https://softwaresupport.softwaregrp.com/doc/KM03645642 https://support.microfocus.com/kb/doc.php?id=7024637 • CWE-863: Incorrect Authorization •

CVSS: 9.3EPSS: 0%CPEs: 43EXPL: 21

CVE-2019-5736 – runc < 1.0-rc6 (Docker < 18.09.2) - Container Breakout

https://notcve.org/view.php?id=CVE-2019-5736

runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe. runc, hasta la versión 1.0-rc6, tal y como se emplea en Docker, en versiones anteriores a la 18.09.2 y otros productos, permite que los atacantes sobrescriban el binario del host runc (y, así, obtengan acceso root al host) aprovechando la capacidad para ejecutar un comando como root con uno de estos tipos de contenedores: (1) un nuevo contenedor con una imagen controlada por el atacante o (2) un contenedor existente, para el cual el atacante contaba previamente con acceso de escritura, que puede adjuntarse con docker exec. Esto ocurre debido a la gestión incorrecta del descriptor de archivos; esto está relacionado con /proc/self/exe. A flaw was found in the way runc handled system file descriptors when running containers. A malicious container could use this flaw to overwrite contents of the runc binary and consequently run arbitrary commands on the container host system. • https://github.com/Frichetten/CVE-2019-5736-PoC https://www.exploit-db.com/exploits/46369 https://www.exploit-db.com/exploits/46359 https://github.com/twistlock/RunC-CVE-2019-5736 https://github.com/jas502n/CVE-2019-5736 https://github.com/RyanNgWH/CVE-2019-5736-POC https://github.com/zyriuse75/CVE-2019-5736-PoC https://github.com/likescam/CVE-2019-5736 https://github.com/geropl/CVE-2019-5736 https://github.com/si1ent-le/CVE-2019-5736 https://github.com/ • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-672: Operation on a Resource after Expiration or Release •

CVSS: 9.8EPSS: 4%CPEs: 22EXPL: 0

CVE-2018-6498 – Micro Focus Container Deployment Foundation (CDF), Remote Code Execution

https://notcve.org/view.php?id=CVE-2018-6498

CVSS: 9.8EPSS: 6%CPEs: 26EXPL: 0

CVE-2018-6499

https://notcve.org/view.php?id=CVE-2018-6499

Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05, Service Virtualization (SV) with floating licenses using Any version using APLS older than 10.7, Unified Functional Testing (UFT) with floating licenses using Any version using APLS older than 10.7, Network Virtualization (NV) with floating licenses using Any version using APLS older than 10.7 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution. Ejecución remota de código en los siguientes productos: Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05; Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05; Data Center Automation Containerized Suite 2017.01 hasta la versión 2018.05; Service Management Automation Suite 2017.11, 2018.02, 2018.05; Service Virtualization (SV) con licencias flotantes en cualquier versión que emplea APLS anteriores a 10.7; Unified Functional Testing (UFT) con licencias flotantes en cualquier versión que emplea APLS anteriores a 10.7; Network Virtualization (NV) con licencias flotantes en cualquier versión que emplea APLS anteriores a 10.7 y Network Operations Management (NOM) Suite CDF 2017.11, 2018.02y 2018.05 permitirá la ejecución remota de código. • https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632?lang=en&cc=us&hpappid=206728_SSO_PRO https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236648 https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667 https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669 https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236722 https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236726 • CWE-94: Improper Control of Generation of Code ('Code Injection') •