CVE-2015-6030

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

HP ArcSight Logger 6.0.0.7307.1, ArcSight Command Center 6.8.0.1896.0, and ArcSight Connector Appliance 6.4.0.6881.3 use the root account to execute files owned by the arcsight user, which might allow local users to gain privileges by leveraging arcsight account access.

Metrics

CVSS 2.0 7.2/10AV:L/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.kb.cert.org/vuls/id/842252Third Party Advisory, US Government Resource
http://www.securitytracker.com/id/1034072Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1034073Third Party Advisory, VDB Entry
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04872416Third Party Advisory
http://www.kb.cert.org/vuls/id/842252Third Party Advisory, US Government Resource
http://www.securitytracker.com/id/1034072Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1034073Third Party Advisory, VDB Entry
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04872416Third Party Advisory

Timeline

Published: Nov 4, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-60316.8Buffer overflow in the IGDstartelt function in igd_desc_parse.c in the MiniUPnP client (aka MiniUPnPc) before 1.9.20150917 allows remote UPN CVE-2015-60329.3Qolsys IQ Panel (aka QOL) before 1.5.1 has hardcoded cryptographic keys, which allows remote attackers to create digital signatures for code CVE-2015-60339.3Qolsys IQ Panel (aka QOL) before 1.5.1 does not verify the digital signatures of software updates, which allows man-in-the-middle attackers CVE-2015-60346.9EPSON Network Utility 4.10 uses weak permissions (Everyone: Full Control) for eEBSVC.exe, which allows local users to gain privileges via a CVE-2015-60356.1Opsview before 2015-11-06 has XSS via SNMP.CVE-2015-60367.5QNAP Signage Station before 2.0.1 allows remote attackers to bypass authentication, and consequently upload files, via a spoofed HTTP reques CVE-2015-60373.5Cross-site scripting (XSS) vulnerability in Microsoft Excel Services on SharePoint Server 2010 SP2 and 2013 SP1, Office Web Apps 2010 SP2, E CVE-2015-60389.3Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Comp CVE-2015-60393.5Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allows remote authentica CVE-2015-60409.3Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, and Excel Viewer allow remo CVE-2015-60429.3Use-after-free vulnerability in the CWindow object implementation in Microsoft Internet Explorer 11 allows remote attackers to execute arbit CVE-2015-60446.8Microsoft Internet Explorer 8 allows remote attackers to gain privileges via a crafted web site, as demonstrated by a transition from Low In