Microfocus vulnerabilities2 known to be exploited.
Microfocus has 270 published vulnerabilities across 127 products in our catalogue. 2 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Imanager, with 22. If you run Microfocus software, patch the exploited flaws first.
The most recent Microfocus flaw added to the known-exploited list is CVE-2021-22502, on 3 November 2021. We keep watching the known-exploited list.
Which Microfocus products have the most vulnerabilities?
Imanager leads with 22 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which Microfocus vulnerabilities are being exploited?
2 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 9.8Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability
Micro Focus Operation Bridge Report (OBR) contains an unspecified vulnerability that allows for remote code execution.
- 7.5Micro Focus Access Manager Information Leakage Vulnerability
Micro Focus Access Manager contains an information leakage vulnerability resulting from a SAML service provider redirection issue when the Assertion Consumer Service URL is used.
Which Microfocus flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 98%CVE-2019-5736High
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command...
- 97%
Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40.
- 81%CVE-2018-12464Critical
A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthenticated remote attacker to execute arbitrary SQL statements against the database.
- 80%CVE-2018-12465High
An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway (SMG) allows a remote attacker authenticated as a privileged user to execute arbitrary OS commands on...
- 74%CVE-2020-11854Critical
Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) vulnerability in Micro Focus products products Operation Bridge Manager,...
- 63%CVE-2012-5932Critical
Eval injection vulnerability in the ldapagnt_eval function in ldapagnt.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 allows remote attackers to execute arbitrary Perl code via a crafted...
- 59%CVE-2012-0432Critical
Stack-based buffer overflow in the Novell NCP implementation in NetIQ eDirectory 8.8.7.x before 8.8.7.2 allows remote attackers to have an unspecified impact via unknown vectors.
- 46%CVE-2016-1606Critical
Multiple stack-based buffer overflows in COM objects in Micro Focus Rumba 9.4.x before 9.4 HF 13960 allow remote attackers to execute arbitrary code via (1) the NetworkName property value to...
- 26%
Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all versions prior to version 5.0.
All Microfocus products we track.
121 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- Imanagerimanager22 vulnerabilities24 versions
- Solutions Business Managersolutions_business_manager17 vulnerabilities20 versions
- Access Manageraccess_manager16 vulnerabilities13 versions
- Edirectoryedirectory16 vulnerabilities44 versions
- Service Managerservice_manager16 vulnerabilities16 versions
- Enterprise Developerenterprise_developer12 vulnerabilities11 versions
- Enterprise Serverenterprise_server12 vulnerabilities11 versions
- Netiq Advanced Authenticationnetiq_advanced_authentication11 vulnerabilities15 versions
- Application Automation Toolsapplication_automation_tools9 vulnerabilities47 versions
- Arcsight Loggerarcsight_logger9 vulnerabilities6 versions
- Arcsight Enterprise Security Managerarcsight_enterprise_security_manager8 vulnerabilities7 versions
- Arcsight Management Centerarcsight_management_center8 vulnerabilities26 versions
- Operations Bridgeoperations_bridge7 vulnerabilities11 versions
- Filrfilr6 vulnerabilities23 versions
- Operations Agentoperations_agent6 vulnerabilities18 versions
- Operations Bridge Manageroperations_bridge_manager6 vulnerabilities18 versions
- Application Performance Managementapplication_performance_management5 vulnerabilities5 versions
- Identity Manageridentity_manager5 vulnerabilities18 versions
- Netiq Access Managernetiq_access_manager5 vulnerabilities3 versions
- Visibrokervisibroker5 vulnerabilities1 version
- FortiFy Software Security Centerfortify_software_security_center4 vulnerabilities7 versions
- Netiq Self Service Password Resetnetiq_self_service_password_reset4 vulnerabilities6 versions
- Operation Bridge Reporteroperation_bridge_reporter4 vulnerabilities10 versions
- Sentinelsentinel4 vulnerabilities15 versions
This directory lists the 121 Microfocus products with at least one tracked version, of 127 in our catalogue.
Running Microfocus? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Micro Focus Operation Bridge Report (OBR) contains an unspecified vulnerability that allows for remote code execution.
- Matched to
- Operation Bridge Reporter on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 270 published vulnerabilities across 127 products and 995 versions from Microfocus. The most recent Microfocus flaw added to the known-exploited list is CVE-2021-22502, on 3 November 2021.
2 Microfocus vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2021-22502 and CVE-2021-22506. The full list is on this page.
Imanager, with 22 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a Precursor Intelligence account and track the Microfocus products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.