ArcSight Logger Security Vulnerability

Overview :

‘External Task is undefined’ & ‘Syntax error’ errors appear on browser console after a Logger report query object is being created (new/modify) using IE browser.

Reports with lengthy names (> 60 characters) emailed via SMTP server are attached with an incorrect filename and extension.

Affected Product(s) :

ArcSight Logger 6.71

Vulnerability Details :

CVE ID :	CVE-2019-11655 (unrestricted file upload)
	Affected versions: Logger 6.7.0 and later Severity: Critical CVSS 3.0 Rating: 9.9 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) CWE Reference: 434 – Unrestricted Upload of File with Dangerous Type
CVE ID :	CVE-2019-11656 (stored XSS)
	Affected versions: versions prior to Logger 6.7.1 HotFix 6.7.1.8262.0 Severity: Medium CVSS 3.0 Rating: 5.4 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) CWE Reference: 79 – Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)

Remediation / Fixes :

Micro Focus recommends to apply this HotFix. HotFix 6.7.1.8262.0 on ArcSight Logger 6.7.1, either in software or appliance form factor. These fixes will also be part of the upcoming release of Logger.

Contact us to get started

CVE-2025-23208 : ZOT UP TO 2.1.1 API SETUSERGROUPS PRIVILEGES MANAGEMENT

Description zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database (meta.db)

Learn more

CVE-2024-12867 : ARCTIC SECURITY ARCTIC HUB UP TO 5.5.1872 CONFIGURATION SERVER-SIDE REQUEST FORGERY

Description Server-Side Request Forgery in URL Mapper in Arctic Security’s Arctic Hub versions 3.0.1764-5.6.1877 allows an unauthenticated remote attacker to

Learn more

CVE-2024-12840 : RED HAT SATELLITE HTTP PROXY SERVER-SIDE REQUEST FORGERY

Description A server-side request forgery exists in Satellite. When a PUT HTTP request is made to /http_proxies/test_connection, when supplied with

Learn more