CVE-2013-4813

The Agent aka AgentController servlet in HP ProCurve Manager PCM 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager IDM 4.0 allows remote attackers to execute arbitrary commands via a HEAD request, aka ZDI-CAN-1745...

CVE-2013-4809

Multiple SQL injection vulnerabilities in GetEventsServlet in HP ProCurve Manager PCM 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager IDM 4.0 allow remote attackers to execute arbitrary SQL commands via the 1 sort or 2 dir parameter...

CVE-2013-4810

HP ProCurve Manager (PCM) 3.20/4.0, PCM+ 3.20/4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management are affected. The root cause is a remote code execution vector via a marshalled object to the EJBInvokerServlet or JMXInvokerServlet, enabling an attacker to execute arbitrar...

CVE-2013-4813

CVE-2013-4813 affects HP ProCurve Manager (PCM) and HP PCM+ / IDM 4.0. The flaw resides in the AgentController/Agent servlet and allows remote code execution via HEAD requests, with the issue tracked as ZDI-CAN-1745. Affected software versions are PCM v3.x/v3.20 and v4.0, PCM+ v3.20/v4.0, and IDM...

CVE-2013-4811

UpdateDomainControllerServlet in the SNAC registration server in HP ProCurve Manager PCM 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager IDM 4.0 does not properly validate the adCert argument, which allows remote attackers to upload .jsp files and consequently execute arbitrary code...

CVE-2013-4812

CVE-2013-4812 covers a vulnerability in the HP ProCurve Manager SNAC UpdateCertificatesServlet (PCM/PCM+ 3.20/4.0, IDM 4.0) where the fileName argument is not properly validated, enabling remote attackers to upload JSP files and achieve arbitrary code execution via unspecified vectors (ZDI-CAN-17...

CVE-2013-4810

HP ProCurve Manager PCM 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager IDM 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to 1 EJBInvokerServlet or 2 JMXInvokerServlet, aka ZDI-CAN-1760. NOTE: this is probably a duplica...

CVE-2013-4810

HP ProCurve Manager PCM 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager IDM 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to 1 EJBInvokerServlet or 2 JMXInvokerServlet, aka ZDI-CAN-1760. NOTE: this is probably a duplica...

CVE-2013-4812

UpdateCertificatesServlet in the SNAC registration server in HP ProCurve Manager PCM 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager IDM 4.0 does not properly validate the fileName argument, which allows remote attackers to upload .jsp files and consequently execute arbitrary code vi...

CVE-2013-4809

CVE-2013-4809 is a SQL injection vulnerability in HP ProCurve Manager (PCM) 3.20 and 4.0, HP PCM+ 3.20 and 4.0, and HP Identity Driven Manager (IDM) 4.0. The flaw resides in the GetEventsServlet and is exploitable via the sort or dir parameters, potentially enabling remote code execution (reporte...

PT-2013-5212 · Hewlett Packard · Hp Procurve Manager +2

Name of the Vulnerable Software and Affected Versions: HP ProCurve Manager versions 3.20 through 4.0 HP PCM+ versions 3.20 through 4.0 Identity Driven Manager version 4.0 Description: The issue allows remote attackers to execute arbitrary commands via a HEAD request. This is related to the Agent...

HP ProCurve Manager, HP Identity Driven Manager multiple security vulnerabilities

Code execution, session reusage, SQL injection...

HP PCM+ SNAC Registration Server UpdateCertificatesServlet Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP PCM Plus. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UpdateCertificatesServlet. This servlet improperly sanitizes the 'fileName' argument...

HP PCM+ GetEventsServlet SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP PCM Plus. Authentication is not required to exploit this vulnerability. The specific flaw exists within the GetEventsServlet. This servlet contains a SQL injection vulnerability in the sort and...

HP PCM+ AgentController Servlet Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP PCM Plus. Authentication is not required to exploit this vulnerability. The specific flaws exist within the Agent servlet. This servlet is vulnerable to a command injection vulnerability when...

HP PCM+ SNAC Registration Server UpdateDomainControllerServlet Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP PCM Plus. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UpdateDomainControllerServlet. This servlet improperly sanitizes the 'adCert' argument...

[security bulletin] HPSBPV02918 rev.1 - HP ProCurve Manager (PCM), HP PCM+ and HP Identity Driven Manager (IDM), SQL Injection, Remote Code Execution, Session Reuse

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03897409 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03897409 Version: 1 HPSBPV02918 rev....

HP Data Protector CRS Multiple Opcodes Stack Buffer Overflow (CVE-2013-2324)

A buffer overflow vulnerability has been reported in HP Data Protector. The vulnerability exists in the Cell Request Service CRS.exe, which listens on a randomly chosen port. The application fails to sanitize input with opcodes 207, 210, 236, 243, and 265 which can result in a stack buffer...

HP PCM+ and Application Lifecycle Management JBoss Invoker Servlets Marshalled Object Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP PCM Plus and Application Lifecycle Management. Authentication is not required to exploit this vulnerability. The specific flaw exists within the exposed EJBInvokerServlet and JMXInvokerServlet. ...

HP Integrated Lights-Out (iLO) Remote Unauthorized Access Vulnerability

HP Integrated Lights-Out iLO is prone to an unauthorized access vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...