Micro Focus · weakness class

Cross-Site Request Forgery

9 CVEs

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

Every one of the 9 is a mark on the map. Named now: 1 to 9, most at risk first.

Cross-site request forgery (CSRF) vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Access Manager (NAM) 4.x before 4.1 allows remote attackers to…CVE-2014-5217Microfocus · 1.4% likely
CWE-352
A Cross-Site Request Forgery (CWE-352) vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 b…CVE-2017-7423Micro Focus · 0.8% likely
CWE-352
A Cross-Site Request Forgery (CWE-352) vulnerability in Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.…CVE-2017-5187Micro Focus · 0.8% likely
CWE-352
Cross-Site Request Forgery (CSRF) vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. Th…CVE-2021-22512Microfocus · 0.7% likely
CWE-352
MFSBGN03809 rev.1 - Universal CMDB, Deserialization Java Objects and CSRFCVE-2018-6496Micro Focus · CVSS 7.5 · 0.7% likely
CWE-352
MFSBGN03810 rev.1 - Universal CMDB, Deserialization Java Objects and CSRFCVE-2018-6497Micro Focus · CVSS 7.5 · 0.6% likely
CWE-352
MFSBGN03824 rev.1 - ArcSight Management Center, Insufficient Access Control, Reflected Cross Site Scripting, Access Control vulnerability, Cross-Site Request Forgery (CSRF), Unaut…CVE-2018-6504Micro Focus · CVSS 8.8 · 0.6% likely
CWE-352
MFSBGN03793 rev.1 - Project and Portfolio Management Center, Multiple vulnerabilitiesCVE-2017-14362Micro Focus · CVSS 7.3 · 0.5% likely
CWE-352
Cross Site Request Forgery vulnerability in Micro Focus Application Performance Management product, affecting versions 9.40, 9.50 and 9.51. The vulnerability could be exploited by…CVE-2021-22500Microfocus · 0.5% likely
CWE-352

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.