Filtered by vendor Opentext Subscriptions
Total 115 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-6123 1 Opentext 1 Alm Octane 2024-12-18 7.5 High
Improper Neutralization vulnerability affects OpenText ALM Octane version 16.2.100 and above. The vulnerability could result in a remote code execution attack.
CVE-2019-17082 1 Opentext 1 Accurev For Ldap Integration 2024-12-17 N/A
Insufficiently Protected Credentials vulnerability in OpenText™ AccuRev allows Authentication Bypass. When installed on a Linux or Solaris system the vulnerability could allow anyone who knows a valid AccuRev username can use the AccuRev client to login and gain access to AccuRev source control without knowing the user’s password. This issue affects AccuRev: 2017.1.
CVE-2023-24467 1 Opentext 1 Imanager 2024-11-25 8.8 High
Possible Command Injection in iManager GET parameter has been discovered in OpenText™ iManager 3.2.6.0000.
CVE-2023-24466 1 Opentext 1 Imanager 2024-11-25 7.5 High
Possible XML External Entity Injection in iManager GET parameter has been discovered in OpenText™ iManager 3.2.6.0200.
CVE-2021-38135 1 Opentext 1 Imanager 2024-11-25 8.6 High
Possible External Service Interaction attack in iManager has been discovered in OpenText™ iManager 3.2.6.0000.
CVE-2021-38117 1 Opentext 1 Imanager 2024-11-25 8.8 High
Possible Command injection Vulnerability in iManager has been discovered in OpenText™ iManager 3.2.4.0000.
CVE-2021-38116 1 Opentext 1 Imanager 2024-11-25 8.8 High
Possible Elevation of Privilege Vulnerability in iManager has been discovered in OpenText™ iManager. This impacts all versions before 3.2.5
CVE-2024-10923 1 Opentext 1 Alm Octane 2024-11-21 N/A
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ ALM Octane Management allows Stored XSS. The vulnerability could result in a remote code execution attack. This issue affects ALM Octane Management: from 16.2.100 through 24.4.
CVE-2024-7050 1 Opentext 1 Directory Services 2024-11-21 N/A
Improper Authentication vulnerability in OpenText OpenText Directory Services may allow Multi-factor Authentication Bypass in particular scenarios.This issue affects OpenText Directory Services: 24.2.
CVE-2024-1148 1 Opentext 1 Pvcs Version Manager 2024-11-21 9.8 Critical
Weak access control in OpenText PVCS Version Manager allows potential bypassing of authentication and uploading of files.
CVE-2024-1147 1 Opentext 1 Pvcs Version Manager 2024-11-21 9.8 Critical
Weak access control in OpenText PVCS Version Manager allows potential bypassing of authentication and download of files.
CVE-2023-7248 1 Opentext 1 Vertica 2024-11-21 5 Medium
Certain functionality in OpenText Vertica Management console might be prone to bypass via crafted requests.  The vulnerability would affect one of Vertica’s authentication functionalities by allowing specially crafted requests and sequences. This issue impacts the following Vertica Management Console versions: 10.x 11.1.1-24 or lower 12.0.4-18 or lower Please upgrade to one of the following Vertica Management Console versions: 10.x to upgrade to latest versions from below. 11.1.1-25 12.0.4-19 23.x 24.x
CVE-2023-4554 3 Linux, Microsoft, Opentext 3 Linux Kernel, Windows, Appbuilder 2024-11-21 4.9 Medium
Improper Restriction of XML External Entity Reference vulnerability in OpenText AppBuilder on Windows, Linux allows Server Side Request Forgery, Probe System Files. AppBuilder's XML processor is vulnerable to XML External Entity Processing (XXE), allowing an authenticated user to upload specially crafted XML files to induce server-side request forgery, disclose files local to the server that processes them. This issue affects AppBuilder: from 21.2 before 23.2.
CVE-2023-4553 3 Linux, Microsoft, Opentext 3 Linux Kernel, Windows, Appbuilder 2024-11-21 5.3 Medium
Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files. AppBuilder configuration files are viewable by unauthenticated users. This issue affects AppBuilder: from 21.2 before 23.2.
CVE-2023-4552 3 Linux, Microsoft, Opentext 3 Linux Kernel, Windows, Appbuilder 2024-11-21 5.5 Medium
Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files. An authenticated AppBuilder user with the ability to create or manage existing databases can leverage them to exploit the AppBuilder server - including access to its local file system. This issue affects AppBuilder: from 21.2 before 23.2.
CVE-2023-4551 3 Linux, Microsoft, Opentext 3 Linux Kernel, Windows, Appbuilder 2024-11-21 7.2 High
Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows OS Command Injection. The AppBuilder's Scheduler functionality that facilitates creation of scheduled tasks is vulnerable to command injection. This allows authenticated users to inject arbitrary operating system commands into the executing process. This issue affects AppBuilder: from 21.2 before 23.2.
CVE-2023-4550 3 Linux, Microsoft, Opentext 3 Linux Kernel, Windows, Appbuilder 2024-11-21 7.5 High
Improper Input Validation, Files or Directories Accessible to External Parties vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files. An unauthenticated or authenticated user can abuse a page of AppBuilder to read arbitrary files on the server on which it is hosted. This issue affects AppBuilder: from 21.2 before 23.2.
CVE-2023-4501 2 Microfocus, Opentext 6 Cobol Server, Enterprise Developer, Enterprise Server and 3 more 2024-11-21 9.8 Critical
User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server (including product variants such as Enterprise Test Server), versions 7.0 patch updates 19 and 20, 8.0 patch updates 8 and 9, and 9.0 patch update 1, when LDAP-based authentication is used with certain configurations. When the vulnerability is active, authentication succeeds with any valid username, regardless of whether the password is correct; it may also succeed with an invalid username (and any password). This allows an attacker with access to the product to impersonate any user. Mitigations: The issue is corrected in the upcoming patch update for each affected product. Product overlays and workaround instructions are available through OpenText Support. The vulnerable configurations are believed to be uncommon. Administrators can test for the vulnerability in their installations by attempting to sign on to a Visual COBOL or Enterprise Server component such as ESCWA using a valid username and incorrect password.
CVE-2023-31871 1 Opentext 1 Documentum Content Server 2024-11-21 7.8 High
OpenText Documentum Content Server before 23.2 has a flaw that allows for privilege escalation from a non-privileged Documentum user to root. The software comes prepackaged with a root owned SUID binary dm_secure_writer. The binary has security controls in place preventing creation of a file in a non-owned directory, or as the root user. However, these controls can be carefully bypassed to allow for an arbitrary file write as root.
CVE-2022-45928 1 Opentext 1 Opentext Extended Ecm 2024-11-21 8.8 High
A remote OScript execution issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). Multiple endpoints allow the user to pass the parameter htmlFile, which is included in the HTML output rendering pipeline of a request. Because the Content Server evaluates and executes Oscript code in HTML files, it is possible for an attacker to execute Oscript code. The Oscript scripting language allows the attacker (for example) to manipulate files on the filesystem, create new network connections, or execute OS commands.