[security bulletin] HPSBMA02598 SSRT100314 rev.2 - HP Insight Control Virtual Machine Management for Windows, Remote Cross Site Scripting (XSS), Denial of Service (DoS), Cross Site Request Forgery (CSRF)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c02560655 Version: 2 HPSBMA02598 SSRT100314 rev.2 - HP Insight Control Virtual Machine Management for Windows, Remote Cross Site Scripting XSS, Denial of Service DoS, Cross Site Request Forgery CS...

CVE-2010-3989

Cross-site request forgery CSRF vulnerability in HP Insight Control Virtual Machine Management before 6.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2010-3988

Unspecified vulnerability in HP Insight Control Virtual Machine Management before 6.2 allows remote attackers to bypass intended access restrictions and cause a denial of service via unknown vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in HP Insight Control Virtual Machine Management before 6.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

Design/Logic Flaw

Unspecified vulnerability in HP Insight Control Virtual Machine Management before 6.2 allows remote attackers to bypass intended access restrictions and cause a denial of service via unknown vectors...

CVE-2010-3989

HP Insight Control Virtual Machine Management for Windows is affected by CVE-2010-3989: a CSRF vulnerability allows remote attackers to hijack user sessions in installations prior to version 6.2. The issue affects HP Insight Control VM management before 6.2, with the payload described in HP secur...

CVE-2010-3988

HP Insight Control Virtual Machine Management for Windows prior to v6.2 contains a Denial of Service vulnerability (CVE-2010-3988) that can be triggered remotely, as noted in HP security bulletin and CVE records. The vulnerability affects HP Insight Control VM Management before 6.2 and was addres...

CVE-2010-3987: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in HP Insight Control Virtual Machine Management before 6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2010-5220

Name of the Vulnerable Software and Affected Versions HP Insight Control Virtual Machine Management versions prior to 6.2 Description The issue allows remote attackers to bypass intended access restrictions and cause a denial of service. The exact vectors used for the attack are not specified...

PT-2010-5221

Name of the Vulnerable Software and Affected Versions HP Insight Control Virtual Machine Management versions prior to 6.2 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of victims via unknown vectors. Recommendations For versions prior to...

CVE-2010-3988: Undefined Security Weakness

Unspecified vulnerability in HP Insight Control Virtual Machine Management before 6.2 allows remote attackers to bypass intended access restrictions and cause a denial of service via unknown vectors...

PT-2010-5219

Name of the Vulnerable Software and Affected Versions HP Insight Control Virtual Machine Management versions prior to 6.2 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML. Recommendations For versions prior to 6.2, update to version 6.2 o...

CVE-2010-3989: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in HP Insight Control Virtual Machine Management before 6.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2010-2419

Unspecified vulnerability in the Java Virtual Machine component in Oracle Database Server 10.1.0.5, 10.2.0.4, 11.1.0.7, and 11.2.0.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors...

Design/Logic Flaw

Unspecified vulnerability in the Java Virtual Machine component in Oracle Database Server 10.1.0.5, 10.2.0.4, 11.1.0.7, and 11.2.0.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors...

CVE-2010-2419: Undefined Security Weakness

Unspecified vulnerability in the Java Virtual Machine component in Oracle Database Server 10.1.0.5, 10.2.0.4, 11.1.0.7, and 11.2.0.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors...

DEBIAN-CVE-2010-2938

arch/x86/hvm/vmx/vmcs.c in the virtual-machine control structure VMCS implementation in the Linux kernel 2.6.18 on Red Hat Enterprise Linux RHEL 5, when an Intel platform without Extended Page Tables EPT functionality is used, accesses VMCS fields without verifying hardware support for these...

CVE-2010-2938

arch/x86/hvm/vmx/vmcs.c in the virtual-machine control structure VMCS implementation in the Linux kernel 2.6.18 on Red Hat Enterprise Linux RHEL 5, when an Intel platform without Extended Page Tables EPT functionality is used, accesses VMCS fields without verifying hardware support for these...

Design/Logic Flaw

arch/x86/hvm/vmx/vmcs.c in the virtual-machine control structure VMCS implementation in the Linux kernel 2.6.18 on Red Hat Enterprise Linux RHEL 5, when an Intel platform without Extended Page Tables EPT functionality is used, accesses VMCS fields without verifying hardware support for these...

Debian DSA-2101-1 : wireshark - several vulnerabilities

Several implementation errors in the dissector of the Wireshark network traffic analyzer for the ASN.1 BER protocol and in the SigComp Universal Decompressor Virtual Machine may lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...