PT-2017-3008

Name of the Vulnerable Software and Affected Versions HPE SiteScope versions 11.2x through 11.3x Description The issue is related to inadequate access control in the HPE SiteScope product, allowing read-only accounts to view all SiteScope interfaces and monitors. This could potentially expose...

HPESBNS03775 rev.1 - HPE NonStop Samba, Remote Disclosure of Information, Authentication Bypass, Unauthorized Elevation of Privilege

Potential Security Impact: Remote: Authentication Bypass, Disclosure of Information, Unauthorized Elevation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Samba on NonStop L-Series: T1201L01 through T1201L01^AAO; H and J-Series: T1201H01 through T1201H01^AAN CVSS...

HPE < 7.2 - Java Deserialization Exploit

Exploit for java platform in category remote exploits !/usr/bin/env python HPE/H3C IMC - Java Deserialization Exploit Version 0.1 Tested on Windows Server 2008 R2 Name HPE/H3C IMC Intelligent Management Center Java 1.8.091 Author: Raphael Kuhn Daimler TSS Special thanks to: Jan Esslinger @Hngan f...

HPE Operations Orchestration central-remoting Insecure Deserialization (CVE-2017-8994)

An insecure deserialization vulnerability in HPE Operations Orchestration. The vulnerability is due to the deserialization of untrusted data in central-remoting servlets. A remote, unauthenticated attacker can exploit this vulnerability by sending crafted serialized data to the target application...

HPE 7.2 - Java Deserialization

HPE 7.2 - Java Deserialization !/usr/bin/env python HPE/H3C IMC - Java Deserialization Exploit Version 0.1 Tested on Windows Server 2008 R2 Name HPE/H3C IMC Intelligent Management Center Java 1.8.091 Author: Raphael Kuhn Daimler TSS Special thanks to: Jan Esslinger @Hngan for the websphere exploi...

HPE < 7.2 - Java Deserialization

!/usr/bin/env python HPE/H3C IMC - Java Deserialization Exploit Version 0.1 Tested on Windows Server 2008 R2 Name HPE/H3C IMC Intelligent Management Center Java 1.8.091 Author: Raphael Kuhn Daimler TSS Special thanks to: Jan Esslinger @Hngan for the websphere exploit this one is based upon import...

HPE Intelligent Management Center userSelectPagingContent Expression Language Injection (CVE-2017-12521)

An Expression Language injection vulnerability exists in HPE Intelligent Management Center. The vulnerability is due to a lack of validation on a request parameter on requests sent to the server. A remote attacker can exploit this vulnerability by sending a crafted request to the target server...

HPE Intelligent Management Center saveSelectedDevices Expression Language Injection (CVE-2017-12491)

An Expression Language injection vulnerability exists in HPE Intelligent Management Center. The vulnerability is due to insufficient handling of a parameter passed to the saveSelectedDevices method through a GWT RPC request. A remote, authenticated attacker can exploit this vulnerability by sendi...

HPE BSM Platform Application Performance Management System Health Path Traversal Vulnerability

HPE BSM Platform Application Performance Management System Health is a suite of application performance management systems for the BSM platform from Hewlett Packard Enterprise HPE. A path traversal vulnerability exists in HPE BSM Platform Application Performance Management System Health versions...

PT-2017-13178

Name of the Vulnerable Software and Affected Versions HPE BSM Platform Application Performance Management System Health versions 9.26, 9.30, 9.40 Description The issue allows remote users to delete arbitrary files via servlet directory traversal in the SHExportToExcel Servlet. Recommendations For...

PT-2017-13179

Name of the Vulnerable Software and Affected Versions HPE BSM Platform Application Performance Management System Health versions 9.26, 9.30, 9.40 Description The issue allows remote users to traverse directories, leading to the disclosure of information due to an authentication vulnerability...

PT-2017-13177

Name of the Vulnerable Software and Affected Versions HPE BSM Platform Application Performance Management System Health versions 9.26, 9.30, 9.40 Description A directory traversal issue allows users to upload unrestricted files, potentially leading to security breaches. Recommendations For versio...

PT-2017-18647

Name of the Vulnerable Software and Affected Versions HPE Operations Orchestration versions prior to 10.80 Description The issue is related to input validation, allowing for remote code execution due to deserialization of untrusted data. This affects the backwards compatibility and central-remoti...

HPE Operations Orchestration Remote Code Execution Vulnerability

HPE Operations Orchestration is a suite of IT process automation solutions from Hewlett Packard Enterprise HPE. A remote code execution vulnerability exists in HPE Operations Orchestration versions prior to 10.80. A remote attacker could exploit the vulnerability to execute code...

HPE Intelligent Management Center multiple Expressions Language Injection (CVE-2017-12500; CVE-2017-12526)

An Expression Language injection vulnerability exists in HPE Intelligent Management Center. The vulnerability is due to insufficient handling of the beanName request parameter on ictExpertDownload.xhtml and on wmiConfigContent.xhtml . A remote, authenticated attacker can exploit this vulnerabilit...

HPESBGN03767 rev.1 - HPE Operations Orchestration, Remote Code Execution

Potential Security Impact: Remote: Code Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Operations Orchestration - All versions prior to 10.80 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2017-8994 |...

HP Integrated Lights-Out (iLO) 4 Multiple Remote Vulnerabilities

HP Integrated Lights-Out iLO 4 is prone to multiple remote vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2017-12573

Name of the Vulnerable Software and Affected Versions HPE iLO 4 versions prior to 2.53 HPE iLO 3 versions prior to 1.89 HPE iLO 2 versions prior to 2.30 Moonshot Remote Console Administrator versions prior to 2.50 Description A remote disclosure of information issue was found, which could be...

PT-2017-3653

Name of the Vulnerable Software and Affected Versions: HPE Integrated Lights-out 4 iLO 4 versions prior to 2.53 Description: A vulnerability in the authentication procedure of HPE Integrated Lights-out 4 iLO 4 allows an attacker to bypass authentication and execute arbitrary code remotely...

HPE Intelligent Management Center PLAT Arbitrary Code Execution Vulnerability (CNVD-2017-21564)

HPE Intelligent Management Center iMC PLAT is a suite of network intelligent management center solutions from Hewlett Packard Enterprise HPE. The solution provides network-wide visibility and enables comprehensive management of resources, services and users. An arbitrary code execution...