CVE-2017-13984

An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows remote users to delete arbitrary files via servlet directory traversal...

HPE Intelligent Management Center getSelInsBean Expression Language Injection (CVE-2017-12490)

An Expression Language injection vulnerability exists in HPE Intelligent Management Center. The vulnerability is due to insufficient handling of a parameter used by the getSelInsBean method that was received from a prior GWT RPC request. A remote, authenticated attacker can exploit this...

HPESBNS03775 rev.1 - HPE NonStop Samba, Remote Disclosure of Information, Authentication Bypass, Unauthorized Elevation of Privilege

Potential Security Impact: Remote: Authentication Bypass, Disclosure of Information, Unauthorized Elevation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Samba on NonStop L-Series: T1201L01 through T1201L01^AAO; H and J-Series: T1201H01 through T1201H01^AAN CVSS...

HPE < 7.2 - Java Deserialization Exploit

Exploit for java platform in category remote exploits !/usr/bin/env python HPE/H3C IMC - Java Deserialization Exploit Version 0.1 Tested on Windows Server 2008 R2 Name HPE/H3C IMC Intelligent Management Center Java 1.8.091 Author: Raphael Kuhn Daimler TSS Special thanks to: Jan Esslinger @Hngan f...

HPE < 7.2 - Java Deserialization

!/usr/bin/env python HPE/H3C IMC - Java Deserialization Exploit Version 0.1 Tested on Windows Server 2008 R2 Name HPE/H3C IMC Intelligent Management Center Java 1.8.091 Author: Raphael Kuhn Daimler TSS Special thanks to: Jan Esslinger @Hngan for the websphere exploit this one is based upon import...

HPE 7.2 - Java Deserialization

HPE 7.2 - Java Deserialization !/usr/bin/env python HPE/H3C IMC - Java Deserialization Exploit Version 0.1 Tested on Windows Server 2008 R2 Name HPE/H3C IMC Intelligent Management Center Java 1.8.091 Author: Raphael Kuhn Daimler TSS Special thanks to: Jan Esslinger @Hngan for the websphere exploi...

HPE Operations Orchestration central-remoting Insecure Deserialization (CVE-2017-8994)

An insecure deserialization vulnerability in HPE Operations Orchestration. The vulnerability is due to the deserialization of untrusted data in central-remoting servlets. A remote, unauthenticated attacker can exploit this vulnerability by sending crafted serialized data to the target application...

HPE Intelligent Management Center userSelectPagingContent Expression Language Injection (CVE-2017-12521)

An Expression Language injection vulnerability exists in HPE Intelligent Management Center. The vulnerability is due to a lack of validation on a request parameter on requests sent to the server. A remote attacker can exploit this vulnerability by sending a crafted request to the target server...

HPE BSM Platform Application Performance Management System Health Path Traversal Vulnerability

HPE BSM Platform Application Performance Management System Health is a suite of application performance management systems for the BSM platform from Hewlett Packard Enterprise HPE. A path traversal vulnerability exists in HPE BSM Platform Application Performance Management System Health versions...

HPE Intelligent Management Center saveSelectedDevices Expression Language Injection (CVE-2017-12491)

An Expression Language injection vulnerability exists in HPE Intelligent Management Center. The vulnerability is due to insufficient handling of a parameter passed to the saveSelectedDevices method through a GWT RPC request. A remote, authenticated attacker can exploit this vulnerability by sendi...

HPE Operations Orchestration Remote Code Execution Vulnerability

HPE Operations Orchestration is a suite of IT process automation solutions from Hewlett Packard Enterprise HPE. A remote code execution vulnerability exists in HPE Operations Orchestration versions prior to 10.80. A remote attacker could exploit the vulnerability to execute code...

HPE Intelligent Management Center multiple Expressions Language Injection (CVE-2017-12500; CVE-2017-12526)

An Expression Language injection vulnerability exists in HPE Intelligent Management Center. The vulnerability is due to insufficient handling of the beanName request parameter on ictExpertDownload.xhtml and on wmiConfigContent.xhtml . A remote, authenticated attacker can exploit this vulnerabilit...

HP Integrated Lights-Out (iLO) 4 Multiple Remote Vulnerabilities

HP Integrated Lights-Out iLO 4 is prone to multiple remote vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

HPE Intelligent Management Center PLAT Arbitrary Code Execution Vulnerability (CNVD-2017-215911)

HPE Intelligent Management Center iMC PLAT is a suite of network intelligent management center solutions from Hewlett Packard Enterprise HPE. The solution provides network-wide visibility and enables comprehensive management of resources, services and users. An arbitrary code execution...

HPE Intelligent Management Center PLAT Arbitrary Code Execution Vulnerability (CNVD-2017-215933)

HPE Intelligent Management Center iMC PLAT is a suite of network intelligent management center solutions from Hewlett Packard Enterprise HPE. The solution provides network-wide visibility and enables comprehensive management of resources, services and users. An arbitrary code execution...

HPE Intelligent Management Center PLAT Arbitrary Code Execution Vulnerability (CNVD-2017-21564)

HPE Intelligent Management Center iMC PLAT is a suite of network intelligent management center solutions from Hewlett Packard Enterprise HPE. The solution provides network-wide visibility and enables comprehensive management of resources, services and users. An arbitrary code execution...

HPE Intelligent Management Center PLAT Arbitrary Code Execution Vulnerability (CNVD-2017-21578)

HPE Intelligent Management Center iMC PLAT is a suite of network intelligent management center solutions from Hewlett Packard Enterprise HPE. The solution provides network-wide visibility and enables comprehensive management of resources, services and users. An arbitrary code execution...

HPE Intelligent Management Center dbman RestoreDBase Command Injection (CVE-2017-5817; CVE-2017-5819)

A command injection vulnerability exists in the dbman component of HPE Intelligent Management Center. The vulnerability exists due to missing validation of user-provided parameters when handling RestoreDBase commands for MSSQL and MySQL databases. A remote, unauthenticated attacker can exploit th...

H3C / HPE Intelligent Management Center PLAT < 7.3 E0506 Multiple Vulnerabilities

The version of HPE Intelligent Management Center iMC PLAT installed on the remote host is prior to 7.3 E0506. It is, therefore, affected by multiple vulnerabilities that can be exploited to execute arbitrary code. Note that Intelligent Management Center iMC is an HPE product; however, it is brand...

Hewlett Packard Enterprise Intelligent Management Center perfAddorModDeviceMonitor Expression Language Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...