CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

HP : Security Vulnerabilities

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complex ity Authen tication Confiden tiality Integrity Availa bility
1 CVE-2012-2561 264 Exec Code 2012-05-21 2012-05-22
10.0
 None Remote Low Not required Complete Complete Complete
HP Business Service Management (BSM) 9.12 does not properly restrict the uploading of .war files, which allows remote attackers to execute arbitrary JSP code within the JBOSS Application Server component via a crafted request to TCP port 1098, 1099, or 4444.
2 CVE-2012-2010 264 +Priv 2012-05-18 2012-05-21
6.9
 None Local Medium Not required Complete Complete Complete
The ACMELOGIN implementation in HP OpenVMS 8.3 and 8.4 on the Alpha platform, and 8.3, 8.3-1H1, and 8.4 on the Itanium platform, when the SYS$ACM system service is enabled, allows local users to gain privileges via unspecified vectors.
3 CVE-2012-2009 264 +Priv 2012-05-09 2012-05-16
9.0
 None Remote Low Single system Complete Complete Complete
Unspecified vulnerability in HP Performance Insight for Networks 5.3.x, 5.41, 5.41.001, and 5.41.002 allows remote authenticated users to gain privileges via unknown vectors.
4 CVE-2012-2008 79 XSS 2012-05-09 2012-05-10
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in HP Performance Insight for Networks 5.3.x, 5.41, 5.41.001, and 5.41.002 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
5 CVE-2012-2007 89 Exec Code Sql 2012-05-09 2012-05-10
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in HP Performance Insight for Networks 5.3.x, 5.41, 5.41.001, and 5.41.002 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
6 CVE-2012-2006 DoS 2012-05-02 2012-05-11
4.9
 None Remote Medium Single system None Partial Partial
Unspecified vulnerability in HP Insight Management Agents before 9.0.0.0 on Windows Server 2003 and 2008 allows remote attackers to modify data or cause a denial of service via unknown vectors.
7 CVE-2012-2005 79 XSS 2012-05-02 2012-05-11
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in HP Insight Management Agents before 9.0.0.0 on Windows Server 2003 and 2008 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
8 CVE-2012-2004 20 2012-05-02 2012-05-03
8.3
 None Remote Medium Not required Complete Partial Partial
Open redirect vulnerability in HP Insight Management Agents before 9.0.0.0 on Windows Server 2003 and 2008 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
9 CVE-2012-2003 352 CSRF 2012-05-02 2012-05-11
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in HP Insight Management Agents before 9.0.0.0 on Windows Server 2003 and 2008 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
10 CVE-2012-2002 20 2012-05-02 2012-05-11
8.3
 None Remote Medium Not required Complete Partial Partial
Open redirect vulnerability in HP SNMP Agents for Linux before 9.0.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
11 CVE-2012-2001 79 XSS 2012-05-02 2012-05-11
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in HP SNMP Agents for Linux before 9.0.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
12 CVE-2012-2000 Exec Code 2012-05-02 2012-05-11
7.5
 None Remote Low Not required Partial Partial Partial
Multiple unspecified vulnerabilities in HP System Health Application and Command Line Utilities before 9.0.0 allow remote attackers to execute arbitrary code via unknown vectors.
13 CVE-2012-1993 +Info 2012-04-18 2012-04-19
3.2
 None Local Low Single system Partial Partial None
Unspecified vulnerability in HP System Management Homepage (SMH) before 7.0 allows local users to modify data or obtain sensitive information via unknown vectors.
14 CVE-2012-0697 22 Dir. Trav. 2012-01-12 2012-01-23
10.0
 Admin Remote Low Not required Complete Complete Complete
HP StorageWorks P2000 G3 MSA array systems have a default account, which makes it easier for remote attackers to perform administrative tasks via unspecified vectors, a different vulnerability than CVE-2011-4788.
15 CVE-2012-0135 DoS 2012-04-18 2012-04-20
3.5
 None Remote Medium Single system None None Partial
Unspecified vulnerability in HP System Management Homepage (SMH) before 7.0 allows remote authenticated users to cause a denial of service via unknown vectors.
16 CVE-2012-0134 DoS 2012-04-19 2012-04-20
4.9
 None Local Low Not required None None Complete
Unspecified vulnerability in HP OpenVMS 7.3-2 on the Alpha platform, 8.3 and 8.4 on the Alpha and IA64 platforms, and 8.3-1h1 on the IA64 platform allows local users to cause a denial of service via unknown vectors.
17 CVE-2012-0133 Exec Code 2012-04-12 2012-04-12
3.7
 None Local High Not required Partial Partial Partial
HP ProCurve 5400 zl switches with certain serial numbers include a compact flash card that contains an unspecified virus, which might allow user-assisted remote attackers to execute arbitrary code on a PC by leveraging manual transfer of this card.
18 CVE-2012-0132 79 XSS 2012-04-05 2012-04-05
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in HP Business Availability Center (BAC) 9.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
19 CVE-2012-0131 DoS 2012-04-05 2012-04-12
10.0
 None Remote Low Not required Complete Complete Complete
Distributed Computing Environment (DCE) 1.8 and 1.9 on HP HP-UX B.11.11 and B.11.23 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
20 CVE-2012-0130 200 +Info 2012-04-05 2012-04-12
5.0
 None Remote Low Not required Partial None None
HP Onboard Administrator (OA) before 3.50 allows remote attackers to obtain sensitive information via unspecified vectors.
21 CVE-2012-0129 264 Exec Code Bypass 2012-04-05 2012-04-05
7.6
 None Remote High Not required Complete Complete Complete
HP Onboard Administrator (OA) before 3.50 allows remote attackers to bypass intended access restrictions and execute arbitrary code via unspecified vectors.
22 CVE-2012-0128 20 2012-04-05 2012-04-12
5.8
 None Remote Medium Not required Partial Partial None
HP Onboard Administrator (OA) before 3.50 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
23 CVE-2012-0127 Exec Code 2012-03-31 2012-04-02
10.0
 None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in HP Performance Manager 9.00 allows remote attackers to execute arbitrary code via unknown vectors.
24 CVE-2012-0126 +Info 2012-03-28 2012-03-28
5.8
 None Remote Medium Not required Partial Partial None
Unspecified vulnerability in the WBEM implementation in HP HP-UX 11.11 and 11.23 allows remote attackers to obtain access to diagnostic information via unknown vectors, a related issue to CVE-2012-0125.
25 CVE-2012-0125 +Info 2012-03-28 2012-03-28
3.3
 None Local Medium Not required Partial Partial None
Unspecified vulnerability in the WBEM implementation in HP HP-UX 11.31 allows local users to obtain access to diagnostic information via unknown vectors, a related issue to CVE-2012-0126.
26 CVE-2012-0124 DoS Exec Code 2012-03-13 2012-04-24
10.0
 None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in HP Data Protector Express (aka DPX) 5.0.00 before build 59287 and 6.0.00 before build 11974 allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors.
27 CVE-2012-0123 DoS Exec Code 2012-03-13 2012-03-14
10.0
 None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in HP Data Protector Express (aka DPX) 5.0.00 before build 59287 and 6.0.00 before build 11974 allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1498.
28 CVE-2012-0122 DoS Exec Code 2012-03-13 2012-03-14
10.0
 None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in HP Data Protector Express (aka DPX) 5.0.00 before build 59287 and 6.0.00 before build 11974 allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1393.
29 CVE-2012-0121 DoS Exec Code 2012-03-13 2012-03-14
10.0
 None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in HP Data Protector Express (aka DPX) 5.0.00 before build 59287 and 6.0.00 before build 11974 allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1392.
30 CVE-2011-4834 264 +Priv 2011-12-14 2011-12-15
4.6
 None Local Low Not required Partial Partial Partial
The GetInstalledPackages function in the configuration tool in HP Application Lifestyle Management (ALM) 11 on AIX, HP-UX, and Solaris allows local users to gain privileges via (1) a Trojan horse /tmp/tmp.txt FIFO or (2) a symlink attack on /tmp/tmp.txt.
31 CVE-2011-4791 94 Exec Code 2012-02-02 2012-02-16
10.0
 None Remote Low Not required Complete Complete Complete
DBServer.exe in HP Data Protector Media Operations 6.11 and earlier allows remote attackers to execute arbitrary code via a crafted request containing a large value in a length field.
32 CVE-2011-4790 Exec Code 2012-02-01 2012-02-02
9.3
 None Remote Medium Not required Complete Complete Complete
Unspecified vulnerability in HP Network Automation 7.5x, 7.6x, 9.0, and 9.10 allows remote attackers to execute arbitrary code via unknown vectors.
33 CVE-2011-4789 119 Exec Code Overflow 2012-01-12 2012-01-23
10.0
 None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in magentservice.exe in the server in HP Diagnostics allows remote attackers to execute arbitrary code via a crafted size value in a packet.
34 CVE-2011-4788 22 Dir. Trav. 2012-01-12 2012-02-09
7.8
 None Remote Low Not required Complete None None
Absolute path traversal vulnerability in the web interface on HP StorageWorks P2000 G3 MSA array systems allows remote attackers to read arbitrary files via a pathname in the URI.
35 CVE-2011-4787 94 2012-01-12 2012-02-09
9.3
 None Remote Medium Not required Complete Complete Complete
A certain ActiveX control in HPTicketMgr.dll in HP Easy Printer Care Software 2.5 and earlier allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via unspecified vectors, a different vulnerability than CVE-2011-2404 and CVE-2011-4786.
36 CVE-2011-4786 94 2012-01-12 2012-02-09
9.3
 None Remote Medium Not required Complete Complete Complete
A certain ActiveX control in HPTicketMgr.dll in HP Easy Printer Care Software 2.5 and earlier allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via unspecified vectors, a different vulnerability than CVE-2011-2404 and CVE-2011-4787.
37 CVE-2011-4785 200 Dir. Trav. +Info 2012-01-10 2012-01-17
7.8
 None Remote Low Not required Complete None None
Directory traversal vulnerability in the HP-ChaiSOE/1.0 web server on the HP LaserJet P3015 printer with firmware before 07.080.3, LaserJet 4650 printer with firmware 07.006.0, and LaserJet 2430 printer with firmware 08.113.0_I35128 allows remote attackers to read arbitrary files via unspecified vectors, a different vulnerability than CVE-2008-4419.
38 CVE-2011-4169 DoS +Info 2011-12-26 2011-12-27
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in HP Managed Printing Administration before 2.6.4 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unknown vectors.
39 CVE-2011-4168 22 Dir. Trav. 2011-12-26 2011-12-27
7.5
 None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in hpmpa/jobDelivery/Default.asp in HP Managed Printing Administration before 2.6.4 allows remote attackers to create arbitrary files via crafted form data.
40 CVE-2011-4167 119 Exec Code Overflow 2011-12-26 2011-12-27
7.5
 None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in MPAUploader.dll in HP Managed Printing Administration before 2.6.4 allows remote attackers to execute arbitrary code via a long filename parameter in an uploadfile action to Default.asp.
41 CVE-2011-4166 22 Dir. Trav. 2011-12-26 2011-12-27
7.5
 None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in the MPAUploader.Uploader.1.UploadFiles method in HP Managed Printing Administration before 2.6.4 allows remote attackers to create arbitrary files via crafted form data.
42 CVE-2011-4165 Exec Code 2011-12-29 2012-02-01
10.0
 None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in HP Database Archiving Software 6.31 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1263.
43 CVE-2011-4164 Exec Code 2011-12-29 2012-02-01
10.0
 None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in HP Database Archiving Software 6.31 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1214.
44 CVE-2011-4163 Exec Code 2011-12-29 2012-02-01
10.0
 None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in HP Database Archiving Software 6.31 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1213.
45 CVE-2011-4162 119 DoS Exec Code Overflow Mem. Corr. 2011-12-05 2012-02-16
7.5
 None Remote Low Not required Partial Partial Partial
The (1) AddUser, (2) AddUserEx, (3) RemoveUser, (4) RemoveUserByGuide, (5) RemoveUserEx, and (6) RemoveUserRegardless methods in HP Protect Tools Device Access Manager (PTDAM) before 6.1.0.1 allow remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a long SidString argument.
46 CVE-2011-4161 264 Exec Code 2011-12-01 2012-02-01
10.0
 None Remote Low Not required Complete Complete Complete
The default configuration of the HP CM8060 Color MFP with Edgeline; Color LaserJet 3xxx, 4xxx, 5550, 9500, CMxxxx, CPxxxx, and Enterprise CPxxxx; Digital Sender 9200c and 9250c; LaserJet 4xxx, 5200, 90xx, Mxxxx, and Pxxxx; and LaserJet Enterprise 500 color M551, 600, M4555 MFP, and P3015 enables the Remote Firmware Update (RFU) setting, which allows remote attackers to execute arbitrary code by using a session on TCP port 9100 to upload a crafted firmware update.
47 CVE-2011-4160 Bypass 2011-11-23 2012-02-16
3.2
 None Local Low Single system Partial Partial None
Unspecified vulnerability in HP Operations Agent 11.00 and Performance Agent 4.73 and 5.0 on AIX, HP-UX, Linux, and Solaris allows local users to bypass intended directory-access restrictions via unknown vectors.
48 CVE-2011-4159 +Priv 2011-11-18 2011-11-21
6.8
 None Local Low Single system Complete Complete Complete
Unspecified vulnerability in System Administration Manager (SAM) in EMS before A.04.20.11.04_01 on HP HP-UX B.11.11, B.11.23, and B.11.31 allows local users to gain privileges via unknown vectors.
49 CVE-2011-4158 +Info 2011-11-16 2012-02-13
4.0
 None Remote Low Single system Partial None None
Unspecified vulnerability in HP Directories Support for ProLiant Management Processors 3.10 and 3.20 for Integrated Lights-Out iLO2 and iLO3 allows remote authenticated users to obtain sensitive information via unknown vectors.
50 CVE-2011-4157 119 Exec Code Overflow 2011-11-16 2011-12-28
10.0
 None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in hydra.exe in HP SAN/iQ before 9.5 on the HP StorageWorks P4000 Virtual SAN Appliance allows remote attackers to execute arbitrary code via a crafted login request.
Total number of vulnerabilities : 884   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
CVE is a registred trademark of the MITRE Corporation and the authoritive source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritive source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritive source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.