Micro Focus Self Service Password Reset vulnerabilities

2 CVEs affecting Micro Focus Self Service Password Reset, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-25837, published 2020-11-05.

More from Micro Focus.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2016-1599, published 2016-03-24. Medium severity, CVSS 6.1. EPSS: 1.4% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in NetIQ Self Service Password Reset (SSPR) 2.x and 3.x before 3.3.1 HF2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
• CVE-2020-25837, published 2020-11-05. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Sensitive information disclosure vulnerability in Micro Focus Self Service Password Reset (SSPR) product. The vulnerability affects versions 4.4.0.0 to 4.4.0.6 and 4.5.0.1 and 4.5.0.2. In certain…