HP Arcsight Logger vulnerabilities

19 CVEs affecting HP Arcsight Logger, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-11656, published 2019-10-04.

More from HP.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2014-7884, published 2015-03-14. High severity, CVSS 9.0. EPSS: 11.7% chance of exploitation in the next 30 days. Multiple unspecified vulnerabilities in HP ArcSight Logger before 6.0P1 have unknown impact and remote authenticated attack vectors.
• CVE-2019-3479, published 2019-03-25. Critical severity, CVSS 9.8. EPSS: 6.9% chance of exploitation in the next 30 days. Mitigates a potential remote code execution issue in ArcSight Logger versions prior to 6.7.
• CVE-2015-6029, published 2015-11-04. Medium severity, CVSS 5.0. EPSS: 4.4% chance of exploitation in the next 30 days. HP ArcSight Logger before 6.0 P2 does not limit attempts to authenticate to the SOAP interface, which makes it easier for remote attackers to obtain access via a brute-force approach.
• CVE-2019-3482, published 2019-03-25. Medium severity, CVSS 6.5. EPSS: 4.2% chance of exploitation in the next 30 days. Mitigates a directory traversal issue in ArcSight Logger versions prior to 6.7.
• CVE-2012-5198, published 2013-02-16. Medium severity, CVSS 5.0. EPSS: 3.8% chance of exploitation in the next 30 days. Unspecified vulnerability in HP ArcSight Connector Appliance before 6.3 and ArcSight Logger 5.2 and earlier allows remote attackers to obtain sensitive information via unknown vectors.
• CVE-2012-3286, published 2013-02-16. Medium severity, CVSS 6.5. EPSS: 2.4% chance of exploitation in the next 30 days. Unspecified vulnerability in HP ArcSight Connector Appliance 6.3 and earlier and ArcSight Logger 5.2 and earlier allows remote authenticated users to obtain sensitive information, modify data, or…
• CVE-2015-6863, published 2016-01-16. High severity, CVSS 7.3. EPSS: 2.3% chance of exploitation in the next 30 days. HPE ArcSight Logger before 6.1P1 allows remote attackers to execute arbitrary code via unspecified input to the (1) Intellicus or (2) client-certificate upload component.
• CVE-2015-5441, published 2015-11-12. Medium severity, CVSS 4.3. EPSS: 1.9% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in HP ArcSight Management Center before 2.1 and ArcSight Logger before 6.1 allow remote attackers to inject arbitrary web script or HTML via…
• CVE-2015-2136, published 2015-09-16. Medium severity, CVSS 4.0. EPSS: 1.8% chance of exploitation in the next 30 days. HP ArcSight Logger before 6.0 P2 allows remote authenticated users to bypass the intended authorization policy via unspecified vectors.
• CVE-2019-3481, published 2019-03-25. High severity, CVSS 7.1. EPSS: 1.7% chance of exploitation in the next 30 days. Mitigates a XML External Entity Parsing issue in ArcSight Logger versions prior to 6.7.

Latest

• CVE-2019-11656, published 2019-10-04. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. Stored XSS vulnerability in Micro Focus ArcSight Logger, affects versions prior to Logger 6.7.1 HotFix 6.7.1.8262.0. This vulnerability could allow Improper Neutralization of Input During Web Page…
• CVE-2019-11655, published 2019-10-04. High severity, CVSS 8.8. EPSS: 1.5% chance of exploitation in the next 30 days. Unrestricted file upload vulnerability in Micro Focus ArcSight Logger, version 6.7.0 and later. This vulnerability could allow Unrestricted Upload of File with Dangerous type.
• CVE-2019-3485, published 2019-07-24. Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days. Mitigates a stored cross site scripting issue in ArcSight Logger versions prior to 6.7.1
• CVE-2019-3484, published 2019-03-25. High severity, CVSS 7.8. EPSS: 1.4% chance of exploitation in the next 30 days. Mitigates a remote code execution issue in ArcSight Logger versions prior to 6.7.
• CVE-2019-3483, published 2019-03-25. Medium severity, CVSS 6.5. EPSS: 1.5% chance of exploitation in the next 30 days. Mitigates a potential information leakage issue in ArcSight Logger versions prior to 6.7.
• CVE-2019-3480, published 2019-03-25. Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days. Mitigates a stored/reflected XSS issue in ArcSight Logger versions prior to 6.7.
• CVE-2015-6864, published 2016-01-16. Medium severity, CVSS 6.3. EPSS: 0.9% chance of exploitation in the next 30 days. HPE ArcSight Logger before 6.1P1 allows remote authenticated users to execute arbitrary code via unspecified input to the (1) Intellicus or (2) client-certificate upload component.