CVE-2017-5816

CVE-2017-5816: A Remote Code Execution via HPE iMC PLAT 7.3 E0504P04 dbman RestartDB (opcode 10008) allows unauthenticated remote command execution due to improper validation of RestartDB input. The vulnerability affects the dbman component of HP iMC and can execute OS commands as SYSTEM over TCP...

CVE-2013-4822

CVE-2013-4822 affects HP Intelligent Management Center (iMC) Branch Intelligent Management System (BIMS) UploadServlet. The vulnerability is described as an unauthenticated file-upload vulnerability in the BIMS module, enabling remote attackers to upload arbitrary files and potentially execute ar...

CVE-2013-4824

HP Intelligent Management Center (iMC) and HP IMC Service Operation Management Software Module contain an authentication bypass in the AccountService RpcServiceServlet (CVE-2013-4824). The vulnerability allows remote attackers to bypass authentication and can enable account creation/manipulation,...

CVE-2019-5392

CVE-2019-5392 affects HPE Intelligent Management Center (IMC) PLAT releases prior to 7.3 E0506P09. The issue is an information-disclosure vulnerability in the dbman component (command 10001), where improper validation allows an unauthenticated remote attacker to view potentially sensitive informa...

CVE-2013-4826

CVE-2013-4826 affects the HP Intelligent Management Center (iMC) SOM Module, specifically the FileDownloadServlet. An unauthenticated remote attacker can disclose arbitrary files due to a lack of authentication in the servlet, enabling information exposure (CVE-2013-4826; CVSSv2 base 5.0). A Meta...

CVE-2019-5385

Summary (CVE-2019-5385) : A remote code execution vulnerability exists in HPE Intelligent Management Center (IMC) PLAT older than 7.3 E0506P09. The issue is an Expression Language injection in the perfSelectTask endpoint, due to insufficient validation of the beanName parameter. Exploitation can ...

CVE-2019-5391

CVE-2019-5391 is a stack-based buffer overflow vulnerability in HPE Intelligent Management Center (IMC) Platform, present in IMC PLAT versions earlier than 7.3 E0506P09. Multiple connected sources (including Red Hat, CNVD, CVE records) describe it consistently as a stack overflow issue affecting ...

CVE-2019-5390

CVE-2019-5390 is a remote command injection vulnerability in HPE Intelligent Management Center (IMC) PLAT prior to version 7.3 E0506P09. The issue affects the iMC/dbman components and allows an unauthenticated, network‑based attacker to execute arbitrary commands on the remote host. Impact is des...

CVE-2019-11953

CVE-2019-11953 affects Hewlett Packard Enterprise Intelligent Management Center (IMC) Platform prior to 7.3 E0506P09. The root cause is improper handling/validation of the beanName parameter in the smsRulesDownload.xhtml endpoint, allowing an attacker to cause remote code execution. Some sources ...

CVE-2020-24630

The CVE-2020-24630 issue affects Hewlett Packard Enterprise Intelligent Management Center (iMC) prior to PLAT 7.3 (E0705P07). The ZDI advisory describes a privilege-escalation flaw in the operatorOnlineList_content.xhtml/operatorOnlineList_contentOnly.xhtml endpoints, where sensitive admin-level ...

CVE-2019-11957

CVE-2019-11957 affects HPE Intelligent Management Center (IMC) PLAT earlier than 7.3 E0506P09. The vulnerability is described as remote code execution. Several connected sources reiterate IMC versions prior to 7.3 E0506P09, with Red Hat and CNVD entries additionally noting a stack buffer overflow...

CVE-2019-11962

HPE Intelligent Management Center (IMC) PLAT contains a remote code execution vulnerability in the selectUserGroup expression language handling. Affected: IMC PLAT versions earlier than 7.3 E0506P09. Root cause: expression-language injection in selectUserGroup.xhtml. Impact: remote code execution...

CVE-2019-11985

CVE-2019-11985 affects HPE Intelligent Management Center (IMC) PLAT prior to 7.3 E0506P09. A remote attacker can trigger code execution via the beanName parameter handled by choosePerfView.xhtml due to improper validation. Documents indicate network-exposed remote code execution with possible aut...

CVE-2019-11986

Summary: CVE-2019-11986 affects Hewlett Packard Enterprise Intelligent Management Center (IMC) PLAT prior to version 7.3 E0506P09. A flaw in the GWT perfSelItemServer expression language allows an attacker to trigger remote code execution. The root cause is an injection in the expression evaluati...

CVE-2019-5389

CVE-2019-5389 affects Hewlett Packard Enterprise Intelligent Management Center (IMC) PLAT prior to 7.3 E0506P09. The root cause is an expression-language injection in IMC that can lead to remote code execution. ZDI notes that authentication is required to exploit, but the authentication mechanism...

CVE-2019-11958

CVE-2019-11958 affects Hewlett Packard Enterprise Intelligent Management Center (IMC) Platform versions prior to 7.3 E0506P09. The connected sources describe a remote code execution vulnerability in the IMC operatorGroupSelectContent Expression Language. The root cause is improper handling/valida...

CVE-2019-5386

CVE-2019-5386 affects HPE Intelligent Management Center (IMC) PLAT versions earlier than 7.3 E0506P09. The connected advisories describe a remote code execution vulnerability arising from incorrect handling of the beanName parameter in the Expression Language injection path, specifically involvin...

CVE-2020-24646

HPE Intelligent Management Center (iMC) before PLAT 7.3 (E0705P07) is affected by CVE-2020-24646. The vulnerability is a stack-based buffer overflow in the tftpserver component that allows remote code execution. The root cause is improper validation of the length of user-supplied data prior to co...

CVE-2020-7160

CVE-2020-7160 affects Hewlett Packard Enterprise Intelligent Management Center (iMC) before PLAT 7.3 (E0705P07). The issue is a iccSelectDeviceSeries expression language injection in the iccSelectDeviceSeries.xhtml endpoint, allowing remote code execution. The vulnerability can execute code with ...

CVE-2020-7192

HPE Intelligent Management Center (iMC) before PLAT 7.3 (E0705P07) is affected. The vulnerability is in the deviceThresholdConfig expression language handling (beanName parameter), where improper input validation enables remote code execution in the context of SYSTEM. Public advisories (e.g., ZDI...

CVE-2017-5817

HPE iMC PLAT 7.3 E0504P04 contains a Remote Code Execution via the dbman RestoreDBase opcode 10007. The vulnerability arises from improper validation of user-supplied input in RestoreDBase handling, allowing unauthenticated remote attackers to inject commands and execute arbitrary OS commands wit...

CVE-2019-11960

HPE Intelligent Management Center (IMC) PLAT, affected in versions earlier than 7.3 E0506P09, is vulnerable to a remote code execution through select expression language injection. The root cause involves improper handling of the beanName parameter in the select.xhtml endpoint, enabling an attack...

CVE-2019-11980

HPE Intelligent Management Center (IMC) Platform vulnerable in releases older than 7.3 E0506P09. The issue resides in SSHParameterResource addSSHParameterKeyFile handling, enabling remote code execution. Exploitation requires authentication, but the existing mechanism can be bypassed according to...

CVE-2019-5373

CVE-2019-5373 affects Hewlett Packard Enterprise Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09 . The root cause is improper handling/validation of the beanName parameter in the IMC web components (notably related to CustomTemplateSelectBean/bean handling in customTemp...

CVE-2019-11954

CVE-2019-11954 is a remote code execution vulnerability in Hewlett Packard Enterprise Intelligent Management Center (IMC) PLAT prior to 7.3 E0506P09. The root cause is improper validation of the beanName parameter in the operationSelect.xhtml endpoint, allowing an attacker to execute code in the ...

CVE-2019-11961

Affected software: HPE Intelligent Management Center (IMC) PLAT, prior to 7.3 E0506P09. Vulnerability: Remote code execution via templateSelect expression language injection, enabling code execution in the context of SYSTEM. Root cause / vector: Handling of templateSelect.xhtml beanName parameter...

CVE-2020-7156

HPE iMC (Intelligent Management Center)

CVE-2020-7169

Affected product : HPE Intelligent Management Center (iMC). Vulnerability class : ictExpertCSVDownload expression language injection leading to remote code execution. Root cause : improper handling of the beanName parameter in ictExpertCSVDownload.xhtml, allowing crafted input to be evaluated as ...

CVE-2019-5388

HPE Intelligent Management Center (IMC) PLAT is affected by CVE-2019-5388 in versions earlier than 7.3 E0506P09. The published reports describe a remote code execution vulnerability stemming from an expression language injection in IMC’s handling of the evaluation context (notably the passBeanNam...

CVE-2020-7141

Vulnerability: HPE Intelligent Management Center (iMC) prior to 7.3 (E0705P07) is affected by a remote code execution through adddevicetoview Expression Language Injection. Root cause (per ZDI): improper handling/validation of the beanName parameter in addDeviceToView.xhtml, enabling arbitrary co...

CVE-2020-7167

The CVE-2020-7167 issue affects Hewlett Packard Enterprise’s Intelligent Management Center (iMC) prior to version 7.3 (E0705P07). The vulnerability is a quickTemplateSelect expression language injection that leads to remote code execution. Affected component is the iMC web interface handling the ...

CVE-2019-5387

CVE-2019-5387 describes a remote code execution in HPE Intelligent Management Center (IMC) PLAT older than 7.3 E0506P09 . Connected advisories confirm the vulnerability stems from an expression-language/beanName handling flaw (navigationTo expression language injection) that allows an attacker to...

CVE-2020-7161

CVE-2020-7161 affects Hewlett Packard Enterprise Intelligent Management Center (iMC) prior to PLAT 7.3 (E0705P07). Multiple connected sources corroborate a reportTaskSelect expression language injection in iMC that enables remote code execution. The Red Hat, CNVD, NVD and ZDI entries describe the...

CVE-2019-5378

Summary of CVE-2019-5378 : A remote code execution vulnerability affects Hewlett Packard Enterprise Intelligent Management Center (IMC) PLAT prior to version 7.3 E0506P09. The flaw is an expression-language injection in the userSelectPagingContent feature, specifically the beanName parameter in t...

CVE-2020-7190

CVE-2020-7190 : In HPE Intelligent Management Center (iMC) prior to PLAT 7.3 (E0705P07), a deviceselect expression language injection allows remote code execution. The flaw stems from handling of the beanName parameter in deviceSelect.xhtml, enabling an attacker to run arbitrary code with SYSTEM ...

CVE-2019-5356

HPE IMC PLAT (HPE Intelligent Management Center) has a remote code execution vulnerability tracked as CVE-2019-5356 in versions earlier than 7.3 E0506P09. Exploitation details in connected sources point to a path traversal/remote code execution arising from insecure handling in the CommonUtils un...

CVE-2020-7154

CVE-2020-7154 affects HPE Intelligent Management Center (iMC) prior to 7.3 (PLAT E0705P07). The root cause is an expression language injection in the ifViewSelectPage.xhtml handling of the beanName parameter, allowing an attacker to execute arbitrary code on affected installations. Public sources...

CVE-2020-7166

CVE-2020-7166 affects Hewlett Packard Enterprise Intelligent Management Center (iMC) prior to version 7.3 (E0705P07). The issue is a remote code execution vulnerability caused by operatorGroupTreeSelectContent expression language injection, triggered via the beanName handling in operatorGroupTree...

CVE-2018-7123

CVE-2018-7123 is a remote denial-of-service vulnerability in HPE Intelligent Management Center (IMC) PLAT prior to version 7.3 E0506P09 . Multiple sources describe an unauthenticated remote DoS triggered via dbman/related commands (e.g., a crafted 10014 request), potentially causing the affected ...

CVE-2019-5349

CVE-2019-5349 is a remote code execution in HPE Intelligent Management Center (IMC) PLAT, affecting IMC up to and including 7.3 E0506P09. Connected sources describe a TopoDebugServlet expression language injection that can lead to remote code execution, with exploitation details indicating that a...

CVE-2020-7151

HPE Intelligent Management Center (iMC) before PLAT 7.3 E0705P07 is affected by a faulttrapgroupselect expression language injection that leads to remote code execution. The vulnerability stems from improper handling of the beanName parameter in faultTrapGroupSelect.xhtml, allowing an attacker to...

CVE-2020-7155

The CVE-2020-7155 entry concerns Hewlett Packard Enterprise Intelligent Management Center (iMC) prior to PLAT 7.3 (E0705P07). A vulnerability in the select expression language allows remote code execution via the beanName parameter handled by the select.xhtml endpoint, due to improper input valid...

CVE-2020-7159

CVE-2020-7159 affects Hewlett Packard Enterprise Intelligent Management Center (iMC) before PLAT 7.3 (E0705P07). The vulnerability arises from improper handling of the customtemplateselect expression/beanName parameter, enabling a remote code execution (RCE) condition. The NVD entry rates this as...

CVE-2019-5350

CVE-2019-5350 affects HPE Intelligent Management Center (IMC) PLAT prior to 7.3 E0506P09. The Red Hat, CNVD, CNVD-like entries corroborate a remote code execution via deserialization in TopoDebugServlet, treated as an untrusted data deserialization vulnerability that could allow an attacker to ex...

CVE-2020-24629

CVE-2020-24629 relates to HPE Intelligent Management Center (iMC) before PLAT 7.3 (E0705P07). The issue is an authentication bypass in the UrlAccessController servlet caused by insufficient URL filtering, enabling remote attackers to bypass authentication. ZDI details indicate the flaw could enab...

CVE-2020-7194

The CVE-2020-7194 entry concerns a vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) where the perfAddorModDeviceMonitor.xhtml endpoint parses the beanName parameter insecurely, allowing an expression language injection that can lead to remote code execution. The iss...

CVE-2020-7165

The CVE-2020-7165 entry concerns a remote code execution vulnerability in Hewlett Packard Enterprise’s HPE Intelligent Management Center (iMC) prior to version 7.3 (E0705P07). The flaw is described as an iccSelectCommand expression language injection vulnerability, affecting the iccSelectCommand....

CVE-2019-11941

CVE-2019-11941 affects Hewlett Packard Enterprise Intelligent Management Center (IMC) PLAT prior to version 7.3 E0506P09. Connected advisories consistently describe a remote code execution vulnerability caused by iccSelectDevType expression language injection, allowing an attacker to run arbitrar...

CVE-2019-11947

The CVE-2019-11947 entry corresponds to a remote code execution vulnerability in Hewlett Packard Enterprise Intelligent Management Center (IMC) PLAT, affecting versions earlier than 7.3 E0506P09. Publicly documented details across multiple sources converge on a root cause: hard-coded credentials ...

CVE-2019-11952

HPE Intelligent Management Center (IMC) PLAT earlier than 7.3 E0506P09 is affected by CVE-2019-11952, a remote code execution vulnerability. Multiple connected sources describe an issue in how IMC handles the beanName parameter fed to the faultTrapGroupSelect.xhtml endpoint, enabling arbitrary co...