HP System Management Homepage multiple security vulnerabilities

DoS, XSS, CSRF, clickjacking, unauthorized access, information leakage...

HP/HPE System Management Homepage (SMH) Multiple Vulnerabilities (HPSBMU03112)

HP/HPE System Management Homepage SMH is prone to multiple vulnerabilities. Copyright C 2014 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is...

[security bulletin] HPSBMU03112 rev.1 - HP System Management Homepage (SMH) on Linux and Windows, Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04463322 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04463322 Version: 1 HPSBMU03112 rev....

HP System Management Homepage vulnerable to cross-site scripting

Overview HP System Management Homepage versions 7.2.3 and 7.3.2.1 contain a reflected cross site scripting vulnerability. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' - CVE-2014-2640HP System Management Homepage versions 7.2.3 and 7.3.2.1...

CVE-2014-2641

Cross-site request forgery CSRF vulnerability in HP System Management Homepage SMH before 7.4 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors...

CVE-2014-2640

Cross-site scripting XSS vulnerability in HP System Management Homepage SMH before 7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-2642

HP System Management Homepage SMH before 7.4 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in HP System Management Homepage SMH before 7.4 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in HP System Management Homepage SMH before 7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Code injection

HP System Management Homepage SMH before 7.4 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

CVE-2014-2641

Cross-site request forgery CSRF vulnerability in HP System Management Homepage SMH before 7.4 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors...

CVE-2014-2642

HP System Management Homepage SMH before 7.4 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

CVE-2014-2642

CVE-2014-2642 applies to HP System Management Homepage (SMH) prior to version 7.4, with a clickjacking vulnerability described in multiple sources (HP Security Bulletin HPSBMU03112 rev.1 and related CVE mappings). The connected documents confirm the affected product and the specific issue (clickj...

PT-2014-4846

Name of the Vulnerable Software and Affected Versions HP System Management Homepage SMH versions prior to 7.4 Description The issue allows remote attackers to conduct clickjacking attacks via unspecified vectors. Recommendations For HP System Management Homepage SMH versions prior to 7.4, update ...

PT-2014-4845

Name of the Vulnerable Software and Affected Versions HP System Management Homepage versions prior to 7.4 Description A cross-site request forgery issue allows remote authenticated users to hijack the authentication of other users via unknown vectors. Recommendations For versions prior to 7.4,...

PT-2014-4844

Name of the Vulnerable Software and Affected Versions HP System Management Homepage versions prior to 7.4 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML. Recommendations For versions prior to 7.4, update to version 7.4 or later to resolve t...

CVE-2014-2640

Cross-site scripting XSS vulnerability in HP System Management Homepage SMH before 7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-2640: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in HP System Management Homepage SMH before 7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-2642: Improper Input Validation

HP System Management Homepage SMH before 7.4 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

CVE-2014-2641: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in HP System Management Homepage SMH before 7.4 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors...