HP Network Automation Multiple Remote Vulnerabilities (HPSBMU03264)

The version of HP Network Automation running on the remote host is affected by multiple vulnerabilities in the administrative web interface. These vulnerabilities include multiple cross-site request forgeries, cross-site scripting, and clickjacking vulnerabilities. An unauthenticated, remote...

Hewlett-Packard Network Automation contains multiple vulnerabilities

Overview HP Network Automation versions 9.0x, 9.1x, 9.2x, and 10.x contain multiple vulnerabilities affecting the administrative web interface. Description HP Network Automation versions 9.0x, 9.1x, 9.2x, and 10.x contain vulnerabilities in the administrative web interface, including multiple cro...

[security bulletin] HPSBMU03264 rev.1 - HP Network Automation, Multiple Remote Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04574207 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04574207 Version: 1 HPSBMU03264 rev....

HP Network Automation multiple security vulnerabilities

XSS, CSRF, clickjacking...

CVE-2014-7886: HP Network Automation cross-site request forgery

HP Network Automation (administrative web interface) is affected by CVE-2014-7886 due to Cross-Site Request Forgery (CSRF) vulnerabilities in versions 9.0X, 9.1X, 9.2X, and 10.X. The security bulletin notes that unauthenticated or authenticated users could be coaxed into executing actions on beha...

CVE-2014-5427

CVE-2014-5427 affects Johnson Controls Metasys 4.1–6.5 (ADS, ADX, LCS8520, NAE 55xx-x, NIE 5xxx-x, NxE8500). A remote, unauthenticated attacker can read password hashes via a POST request, exposing credentials and affecting confidentiality. Connected sources indicate multiple advisories and a pat...

CVE-2014-5428

Unrestricted file upload vulnerability in unspecified web services in Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server ADS, Extended Application and Data Server aka ADX, LonWorks Control Server 85 LCS8520, Network Automation Engine NAE 55xx-x, Network Integration...

CVE-2015-2033

Anyterm Daemon in Infoblox Network Automation NetMRI before NETMRI-23483 allows remote attackers to execute arbitrary commands with root privileges via a crafted terminal/anyterm-module request...

Server side request forgery (ssrf)

Anyterm Daemon in Infoblox Network Automation NetMRI before NETMRI-23483 allows remote attackers to execute arbitrary commands with root privileges via a crafted terminal/anyterm-module request...

CVE-2015-2033

Anyterm Daemon in Infoblox Network Automation NetMRI before NETMRI-23483 allows remote attackers to execute arbitrary commands with root privileges via a crafted terminal/anyterm-module request...

Weak Local Database Credentials in Infoblox Network Automation

Product: Network Automation • NetMRI • Switch Port Manager • Automation Change Manager • Security Device Controller Vendor: InfoBlox Vulnerable Versions: 6.4.X.X-6.8.4.X Tested Version: 6.8.2.11 Vendor Notification: May 12th, 2014 Public Disclosure: July 9th, 2014 Vulnerability Type: OS Command...

OS Command Injection Infoblox Network Automation

Product: Network Automation, licensed as: • NetMRI • Switch Port Manager • Automation Change Manager • Security Device Controller Vendor: Infoblox Vulnerable Versions: 6.4.X.X-6.8.4.X Tested Version: 6.8.2.11 Vendor Notification: May 12th, 2014 Vendor Patch Availability to Customers: May 16th, 20...

CVE-2014-2646

Unspecified vulnerability in HP Network Automation 9.10 and 9.20 allows local users to bypass intended access restrictions via unknown vectors...

Design/Logic Flaw

Unspecified vulnerability in HP Network Automation 9.10 and 9.20 allows local users to bypass intended access restrictions via unknown vectors...

CVE-2014-2646

Unspecified vulnerability in HP Network Automation 9.10 and 9.20 allows local users to bypass intended access restrictions via unknown vectors...

CVE-2014-2646

Technical details about CVE-2014-2646 are not publicly available in the provided documents. Monitor for updates.

Infoblox 6.8.2.11 - OS Command Injection

No description provided by source. Product: Network Automation, licensed as: • NetMRI • Switch Port Manager • Automation Change Manager • Security Device Controller Vendor: Infoblox Vulnerable Versions: 6.4.X.X-6.8.4.X Tested Version: 6.8.2.11 Vendor Notification: May 12th, 2014 Vendor Patch...

Infoblox 6.8.2.11 - OS Command Injection

Product: Network Automation, licensed as: • NetMRI • Switch Port Manager • Automation Change Manager • Security Device Controller Vendor: Infoblox Vulnerable Versions: 6.4.X.X-6.8.4.X Tested Version: 6.8.2.11 Vendor Notification: May 12th, 2014 Vendor Patch Availability to Customers: May 16th, 20...

Infoblox 6.8.2.11 - OS Command Injection

Infoblox 6.8.2.11 - OS Command Injection Product: Network Automation, licensed as: • NetMRI • Switch Port Manager • Automation Change Manager • Security Device Controller Vendor: Infoblox Vulnerable Versions: 6.4.X.X-6.8.4.X Tested Version: 6.8.2.11 Vendor Notification: May 12th, 2014 Vendor Patc...

Infoblox 6.8.2.11 - OS Command Injection / Weak MySQL Password Vulnerability

Infoblox versions 6.4.x.x through 6.8.4.x suffer from a remote OS command injection and use a default login of root with password root on their MySQL instances. Product: Network Automation, licensed as: • NetMRI • Switch Port Manager • Automation Change Manager • Security Device Controller Vendor...