HP SiteScope SSLv3 Padding Oracle On Downgraded Legacy Encryption Vulnerability (POODLE)

The version of HP SiteScope installed on the remote host is affected by a man-in-the-middle MitM information disclosure vulnerability known as POODLE. The vulnerability is due to the way SSL 3.0 handles padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining...

HP Network Node Manager I ovopi.dll Command 685 Memory Corruption (CVE-2014-2624)

A memory corruption vulnerability in HP Network Node Manager I NNMi ha been reported. The vulnerability is caused by using remotely supplied data as a pointer without sufficient validation in ovopi.dll. By sending a crafted request to the vulnerable product on port 696/UDP, a remote unauthenticat...

HP Helion Cloud Development Platform restriction bypass

Same key is used in different installations...

[security bulletin] HPSBUX03166 SSRT101489 rev.1 - HP-UX running PAM libpam_updbe, Remote Authentication Bypass

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04511778 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04511778 Version: 1 HPSBUX03166...

HP-UX authentication bypass

HP-UX libpamupdbe authentication bypass...

[security bulletin] HPSBMU03190 rev.1 - HP Helion Cloud Development Platform Community and Commercial Editions, Remote Unauthenticated Access

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04500238 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04500238 Version: 1 HPSBMU03190 rev....

OracleVM 2.1 : udev (OVMSA-2009-0006)

The remote OracleVM system is missing necessary patches to address critical security updates : CVE-2009-1185 udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space. - fix fo...

HP-UX PHCO_43874 : s700_800 11.23 libpam_updbe cumulative patch

s700800 11.23 libpamupdbe cumulative patch : A potential security vulnerability has been identified in the HP-UX running PAM using libpamupdbe in pam.conf4. This vulnerability could allow remote users to bypass certain authentication restrictions. References: CVE-2014-7879 SSRT101489. %NASLMINLEV...

HP-UX PHCO_43873 : s700_800 11.11 libpam_updbe patch

s700800 11.11 libpamupdbe patch : A potential security vulnerability has been identified in the HP-UX running PAM using libpamupdbe in pam.conf4. This vulnerability could allow remote users to bypass certain authentication restrictions. References: CVE-2014-7879 SSRT101489. %NASLMINLEVEL 70300 C...

HP-UX PHCO_43875 : s700_800 11.31 libpam_updbe patch

s700800 11.31 libpamupdbe patch : A potential security vulnerability has been identified in the HP-UX running PAM using libpamupdbe in pam.conf4. This vulnerability could allow remote users to bypass certain authentication restrictions. References: CVE-2014-7879 SSRT101489. %NASLMINLEVEL 70300 C...

HP Performance Monitoring xglance Priv Esc

This exploit takes advantage of xglance-bin, part of HP's Glance or Performance Monitoring version 11 'and subsequent' , which was compiled with an insecure RPATH option. The RPATH includes a relative path to -L/lib64/ which can be controlled by a user. Creating libraries in this location will...

SAN snapshots on HP Store Virtual P4500 left behind after backup failures

Challenge The Veeam backup job fails but the SAN snapshot on HP Store Virtual is still created and left behind. On the proxy you may see in the event logs 2 events, one after another: first VSS event 8229 about VSS writer failure and then event 284 from HP StoreVirtual VSS Provider about successf...

CVE-2014-7878

The Application Lifecycle Service ALS in HP Helion Cloud Development Platform 1.0, when a virtual machine is derived from the Seed Node image, uses the same security keys across different customers' installations, which allows remote attackers to execute arbitrary code by leveraging these keys fo...

Code injection

The Application Lifecycle Service ALS in HP Helion Cloud Development Platform 1.0, when a virtual machine is derived from the Seed Node image, uses the same security keys across different customers' installations, which allows remote attackers to execute arbitrary code by leveraging these keys fo...

CVE-2014-7878

The CVE-2014-7878 issue affects HP Helion Cloud Development Platform 1.0: the Application Lifecycle Service (ALS) Seed Node image contains identical security keys across different customer installations, enabling a remote attacker with a VM derived from the Seed Node image to connect to other VMs...

CVE-2014-7878

The Application Lifecycle Service ALS in HP Helion Cloud Development Platform 1.0, when a virtual machine is derived from the Seed Node image, uses the same security keys across different customers' installations, which allows remote attackers to execute arbitrary code by leveraging these keys fo...

HP Operations Agent Remote XSS iFrame Injection

No description provided by source. !/usr/bin/python Exploit Title: HP Operations Agent / HP Communications Broker Remote XSS iFrame Injection Date: 10/16/2014 Exploit Author: Matt Schmidt Syph0n Vendor Homepage: www.hp.com Version: HP Operations Manager/Operations Agent / OpenView Communications...

HP Data Protector EXEC_INTEGUTIL Remote Code Execution

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = GreatRanking include Msf::Exploit::Remote::Tcp include...

HP Data Protector 'EXEC_INTEGUTIL' Arbitrary Command Execution

Binary data hpdataprotectorzdi14344.nbin...

Microsoft Secure Channel CVE-2014-6321 Remote Code Execution Vulnerability

Description Microsoft Secure Channel is prone to a remote code-execution vulnerability. An attacker can leverage this issue to execute arbitrary code in the context of the target server. Failed exploit attempts will result in denial-of-service conditions. Technologies Affected Avaya Aura...