HPSBHF03603 rev. 3 - Escalation of Privilege via Intel PROSet/Wireless Wi-Fi Software

Potential Security Impact Escalation of privilege Source: HP, HP Product Security Response Team PSRT, Intel Reported By: Intel VULNERABILITY SUMMARY A potential security vulnerability in Intel® PROSet/Wireless Wi-Fi Software might allow escalation of privilege. Intel has released a software updat...

Security Bulletin: Upward Integration Module for HP Openview Operations for Windows is affected by multiple vulnerabilities in IBM Java SDK

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition that is shipped with Upward Integration Module for HP Openview Operations for Windows. These issues were disclosed as part of the Java Technology Edition Quarterly CPU - January 2015. Vulnerability Details Abstract Ther...

HP DesignJet Printer Web Interface Detection

Binary data hpdesignjetwebinterfacedetect.nbin...

Arbitrary File Overwrite

hplip3 is vulnerable to arbitrary file overwrite attacks. The vulnerability exists as the senddatatostdout function in prnt/hpijs/hpcupsfax.cpp in HP Linux Imaging and Printing HPLIP 3.x before 3.11.10 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/hpcupsfax.out...

PRETty - "PRinter Exploitation Toolkit" LAN Automation Tool

PRETty is useful when a large number of printers are present on a network. Instead of scanning, logging, and manually running PRET againt each individual printer, PRETty will automatically discover and run choosen PRET payloads against all printers on the target network. Additionally, PRETty can ...

Cross site scripting

The admin web interface on Technicolor MediaAccess TG789vac v2 HP devices with firmware v16.3.7190-2761005-20161004084353 displays unsanitised user input, which allows an unauthenticated malicious user to embed JavaScript into the Log viewer interface via a crafted HTTP Referer header, aka XSS...

HP Intelligent Management Insecure Deserialization (CVE-2017-12557)

A remote code execution vulnerability exists within HP Enterprise Intelligent Management Center. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installation...

Security Bulletin: WebSphere MQ Internet Pass-Thru is affected by multiple vulnerabilities in IBM Java Runtime

Summary WebSphere MQ Internet Pass-Thru has addressed the following vulnerabilities in IBM® Runtime Environment Java™ Version 7.0.10.35. These issues were disclosed as part of the IBM Java SDK updates in October 2018. Vulnerability Details If you run your own Java code using the IBM Java Runtime...

HPE Windows Firmware Information Disclosure Vulnerability

HPE Windows Firmware is the Windows firmware provided with HP servers. An information disclosure vulnerability exists in HPE Windows Firmware. An attacker could exploit this vulnerability to obtain sensitive information...

HPSBGN03599 rev. 2 - Certificate Authentication Vulnerability in HP Remote Graphics Software

Potential Security Impact Information disclosure Source : HP, HP Product Security Response Team PSRT Reported by : Rowan Venables VULNERABILITY SUMMARY A potential vulnerability has been identified in HP Remote Graphics Software’s certificate authentication process. RESOLUTION HP has mitigated th...

HP Intelligent Management Java Deserialization Remote Code Execution Exploit

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Authentication is not required to exploit this vulnerability. The specific flaw exists within the WebDMDebugServlet, which listens on TCP...

CVE-2018-7115

HPE Intelligent Management Center IMC prior to IMC PLAT 7.3 E0605P06 is vulnerable to a remote buffer overflow in dbman.exe opcode 10001 on Windows. This problem is resolved in IMC PLAT 7.3 E0605P06 or subsequent versions...

Security Bulletin: WebSphere MQ V5.3 for HP NonStop Server (MIPS and Itanium) is affected by OpenSSL vulnerability CVE-2018-0732

Summary Security Bulletin: WebSphere MQ V5.3 for HP NonStop Server MIPS and Itanium is affected by OpenSSL vulnerability CVE-2018-0732 Vulnerability Details CVEID: CVE-2018-0732 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the sending of a very large prime value to the...

HPSBHF03600 rev. 2 - Insecure Handling of BIOS and AMT Passwords

Potential Security Impact Information Disclosure Source: HP, HP Product Security Response Team PSRT Reported by: Intel VULNERABILITY SUMMARY A potential security vulnerability has been identified with the Intel platform code firmware included in certain Intel vPro Processor families with AMT...

HPSBHF03598 rev. 6 - EDK II Untested Memory Not Covered by SMM Page Protections

Potential Security Impact Escalation of Privilege, Information Disclosure Source: HP, HP Product Security Response Team PSRT Reported By: TianoCore Bugzilla VULNERABILITY SUMMARY Incorrect handling of memory types in TianoCore firmware potentially allows an attacker with local access to bypass...

HPSBHF03597 rev. 3 - PortSmash Side-Channel Vulnerability

Potential Security Impact Information disclosure. Source: HP, HP Product Security Response Team PSRT Reported By: Tampere University of Technology, Finland and Technical University, Cuba VULNERABILITY SUMMARY An industry-wide vulnerability has been reported which impacts CPUs that use Simultaneou...

HPSBPI03596 rev. 2 - HP LaserJet Enterprise, HP PageWide Enterprise, HP LaserJet Managed, and HP OfficeJet Enterprise Printers, Execution of Arbitrary Code

Potential Security Impact Execution of arbitrary code. Source: HP, HP Product Security Response Team PSRT VULNERABILITY SUMMARY Solution application signature checking may allow potential execution of arbitrary code. RESOLUTION HP has provided firmware updates for impacted printers as indicated i...

HPSBHF03595 rev. 6 - LoJax UEFI Rootkit

Potential Security Impact Elevation of Privilege, Information Disclosure, Loss of Confidentiality, Loss of Integrity. Source: HP, HP Product Security Response Team PSRT Reported by: ESET Research VULNERABILITY SUMMARY HP has identified a potential security vulnerability with a UEFI rootkit LoJax...

HP Printers CSRF Vulnerability (Oct 2018)

A potential security vulnerability has been identified with certain HP printers and MFPs in 2405129000052 and other firmware versions. This vulnerability is known as cross-site request forgery CSRF, and could potentially be exploited remotely to allow elevation of privilege. Copyright C 2018...

CVE-2018-5921

A potential security vulnerability has been identified with certain HP printers and MFPs in 2405129000052 and other firmware versions. This vulnerability is known as Cross Site Request Forgery, and could potentially be exploited remotely to allow elevation of privilege...