PT-2016-3252

Name of the Vulnerable Software and Affected Versions HPE Data Protector versions prior to 8.17 HPE Data Protector versions prior to 9.09 Description A Remote Arbitrary Code Execution issue was discovered, which can be exploited by a remote attacker to execute arbitrary code. The issue is caused ...

CVE-2016-2008

HPE Data Protector before 7.03108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2016-2008

HPE Data Protector before 7.03108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2016-2007

HPE Data Protector before 7.03108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-3354...

CVE-2016-2007

HPE Data Protector before 7.03108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-3354...

CVE-2016-2006

HPE Data Protector before 7.03108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-3353...

CVE-2016-2006

HPE Data Protector before 7.03108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-3353...

CVE-2016-2005

HPE Data Protector before 7.03108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-3352...

CVE-2016-2004

HPE Data Protector before 7.03108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary code via unspecified vectors related to lack of authentication. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2623...

Authentication flaw

HPE Data Protector before 7.03108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary code via unspecified vectors related to lack of authentication. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2623...

Code injection

HPE Data Protector before 7.03108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-3354...

Command injection

HPE Data Protector before 7.03108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-3352...

Design/Logic Flaw

HPE Data Protector before 7.03108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-3353...

Code injection

HPE Data Protector before 7.03108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2016-2005

HPE Data Protector before 7.03108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-3352...

CVE-2016-2006

HPE Data Protector before 7.03108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-3353...

CVE-2016-2007

HPE Data Protector before 7.03108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-3354...

CVE-2016-2008

HPE Data Protector before 7.03108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2016-2006

CVE-2016-2006 affects Hewlett Packard Enterprise Data Protector prior to 7.03_108, 8.x before 8.15, and 9.x before 9.06. Connected advisories detail a remote code execution via Oracle? No—OmniInet.exe in HPE Data Protector listens on TCP port 5555. The vulnerability arises from a lack of boundary...

CVE-2016-2005

CVE-2016-2005 affects HP Data Protector via the OmniInet.exe service. A remote, unauthenticated attacker can exploit a flaw in the EXEC_BAR username handling (fixed-length stack buffer) to execute arbitrary code. The vulnerability enables code execution under the SYSTEM context by sending malform...