HP Arcsight Enterprise Security Manager Express vulnerabilities

9 CVEs affecting HP Arcsight Enterprise Security Manager Express, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-14358, published 2017-10-31.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-14356, published 2017-10-31. Critical severity, CVSS 9.8. EPSS: 1.8% chance of exploitation in the next 30 days. An SQL Injection vulnerability in HP ArcSight ESM and HP ArcSight ESM Express, in any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. This vulnerability could be exploited remotely to allow…
CVE-2017-13991, published 2017-09-30. Medium severity, CVSS 5.3. EPSS: 1.5% chance of exploitation in the next 30 days. An information leakage vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows disclosure of product license features.
CVE-2017-13990, published 2017-09-30. Medium severity, CVSS 5.3. EPSS: 1.5% chance of exploitation in the next 30 days. An information leakage vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows disclosure of Apache Tomcat application server version.
CVE-2017-14357, published 2017-10-31. Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days. A Reflected and Stored Cross-Site Scripting (XSS) vulnerability in HP ArcSight ESM and HP ArcSight ESM Express, in any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. This vulnerability could…
CVE-2017-14358, published 2017-10-31. Medium severity, CVSS 6.1. EPSS: 1.2% chance of exploitation in the next 30 days. A URL redirection to untrusted site vulnerability in HP ArcSight ESM and HP ArcSight ESM Express, in any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. This vulnerability could be exploited…
CVE-2017-13989, published 2017-09-30. High severity, CVSS 8.1. EPSS: 1% chance of exploitation in the next 30 days. An improper access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows unauthorized users to retrieve or modify storage…
CVE-2017-13987, published 2017-09-30. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. An insufficient access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows an unauthorized user to download log files.
CVE-2017-13986, published 2017-09-30. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. A reflected Cross-Site Scripting(XSS) vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows for unintended information when a…
CVE-2017-13988, published 2017-09-30. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. An improper access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows unauthorized users to alter the maximum size of…