Jefferson Ogata

**Name of the Vulnerable Software and Affected Versions** HP ArcSight SmartConnectors versions prior to 7.1.6 **Description** The issue allows man-in-the-middle attackers to spoof devices and obtain sensitive information via a crafted certificate, as HP ArcSight SmartConnectors do not verify X.509 certificates from Logger devices. **Recommendations** For versions prior to 7.1.6, update to version 7.1.6 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** HP ArcSight SmartConnectors versions prior to 7.1.6 **Description** The issue concerns a hardcoded password in the CWSAPI SOAP service, which can be exploited by remote attackers to gain administrative access. **Recommendations** For versions prior to 7.1.6, update to version 7.1.6 or later to resolve the issue.