iLO 3 < 1.88 Information Disclosure Vulnerability

An information disclosure vulnerability exists in iLO 3 before firmware version 1.88 due to an improper use of a MAC protection mechanism in conjunction with CBC padding in its TLS implementation. An unauthenticated, remote attacker can exploit this to disclose potentially sensitive information. ...

CVE-2018-7112

The HPE-provided Windows firmware installer for certain Gen9, Gen8, G7,and G6 HPE servers allows local disclosure of privileged information. This issue was resolved in previously provided firmware updates as follows. The HPE Windows firmware installer was updated in the system ROM updates which...

CVE-2018-7112

The CVE-2018-7112 flaw affects HPE ProLiant servers (Gen9/Gen8, G7, G6) via the Windows firmware installer and related system ROM/iLO components. Root cause: local disclosure of privileged information due to the HPE Windows firmware installer. Remediation: updated firmware installers released in ...

Information disclosure

A security vulnerability in HPE Integrated Lights-Out 5 iLO 5 for HPE Gen10 Servers prior to v1.35, HPE Integrated Lights-Out 4 iLO 4 prior to v2.61, HPE Integrated Lights-Out 3 iLO 3 prior to v1.90 could be remotely exploited to execute arbitrary code leading to disclosure of information...

CVE-2016-4406

A remote cross site scripting vulnerability was identified in HPE iLO 3 all version prior to v1.88 and HPE iLO 4 all versions prior to v2.44...

Design/Logic Flaw

A Unauthenticated Remote Denial of Service vulnerability was identified in HPE Integrated Lights-Out 3 iLO 3 version v1.88 only. The vulnerability is resolved in iLO3 v1.89 or subsequent versions...

CVE-2017-8987

A Unauthenticated Remote Denial of Service vulnerability was identified in HPE Integrated Lights-Out 3 iLO 3 version v1.88 only. The vulnerability is resolved in iLO3 v1.89 or subsequent versions...

CVE-2016-4406

HP iLO remote XSS (CVE-2016-4406) affects HP iLO 3 versions prior to 1.88 and iLO 4 versions prior to 2.44. The vulnerability arises from improper neutralization/validation of input during web page generation, enabling a remote, unauthenticated attacker to lure a user into clicking a crafted URL ...

CVE-2017-8987

CVE-2017-8987 affects HPE Integrated Lights-Out 3 (iLO 3). The vulnerability is an unauthenticated remote DoS in firmware version v1.88, with a fix in iLO3 v1.89 and newer. Exploitation can render the device unresponsive, impacting availability; no other impacts are indicated. Remediation: upgrad...

CVE-2016-4375

HP’s CVE-2016-4375 covers multiple unspecified vulnerabilities in HP Integrated Lights-Out (iLO) 3 firmware prior to 1.88, iLO 4 prior to 2.44, and iLO 4 mRCA prior to 2.32. The description states that remote attackers can obtain sensitive information, modify data, or cause a denial of service vi...

iLO 3 < 1.65 / iLO 4 < 1.32 Multiple Vulnerabilities

Description not available %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid71494; scriptversion"1.8"; scriptsetattributeattribute:"pluginmodificationdate", value:"2021/01/19"; scriptcveid"CVE-2013-4842",...

iLO 3 < 1.57 / iLO 4 < 1.22 Unspecified Arbitrary Code Execution

According to its version number and single sign-on settings, the remote HP Integrated Lights-Out iLO server is affected by an arbitrary code execution vulnerability in its web interface. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...