CVE-2013-4835

The vulnerability CVE-2013-4835 affects HP SiteScope’s APISiteScopeImpl SOAP service. In HP SiteScope versions 10.1x and 11.x (before 11.22), the issueSiebelCmd method allows remote attackers to bypass authentication and execute arbitrary code via a direct request. This is a remote code execution...

CVE-2013-2367

CVE-2013-2367 concerns HP SiteScope (versions 11.20/11.21) with a vulnerability in the SOAP interface, allowing remote code execution via the runOMAgentCommand SOAP path. Connected sources confirm an RCE vector related to the SOAP handling and the runOMAgentCommand entry, with multiple references...

CVE-2015-2802

CVE-2015-2802 affects HP SiteScope 11.2/11.3 (Windows/Linux/S Solaris) and HP Asset Manager 9.30–9.32, 9.40–9.41, 9.50, plus Asset Manager Cloudsystem Chargeback 9.40. The vulnerability is a TLS RC4/Bar Mitzvah information disclosure, enabling a remote attacker to obtain sensitive information. Th...

CVE-2007-4350

HP SiteScope 9.0 build 911 contains a cross-site scripting (XSS) vulnerability in the management interface. The issue arises from rendering SNMP trap messages in the web UI without filtering, allowing an attacker to inject arbitrary HTML/script that could execute in a user’s browser. This affects...

CVE-2015-2120

HP SiteScope CVE-2015-2120 is a remote privilege-escalation flaw in the Log Analysis Tool that arises from improper log-path validation, allowing an authenticated remote user to read the users.config file and escalate privileges to administrator. Affected: SiteScope v11.1x (before 11.13), v11.2x ...

CVE-2011-2400

HP SiteScope is affected by CVE-2011-2400: remote XSS in SiteScope 9.x, 10.x, and 11.x via unspecified vectors. The vulnerability is confirmed in multiple sources (NVD/NVD CVSS v2 base score 4.3; HP security bulletin HPSBMU02692/SSRT100581 rev.2 documents patches). Remediation guidance from the H...

CVE-2012-3262

HP SiteScope SOAP vulnerability CVE-2012-3262 affects SiteScope versions 11.10–11.12. The issue allows remote code execution via the SOAP API due to vulnerabilities in the SOAP features, with CVSS 2.0 base score 10.0 (high). HP’s remediation is SiteScope update v11.13, and to mitigate, disable th...

CVE-2014-7882

HP SiteScope 11.1x and 11.2x are affected by CVE-2014-7882, a remote privilege-escalation vulnerability exploitable by remote-authenticated users via unspecified vectors. The NVD entry cites a CVSS v2 base score of 5.5 (medium) with privileges “Partial” for confidentiality and integrity and no av...

CVE-2017-14349

CVE-2017-14349 affects HPE SiteScope versions 11.2x and 11.3x. The issue allows read-only accounts to view all SiteScope interfaces and monitors, potentially exposing sensitive data. The vulnerability’s root cause is described as an authentication weakness enabling broader read access; exploitati...

CVE-2011-1726

HP SiteScope is vulnerable to cross-site scripting and HTML injection in versions 9.54, 10.13, 11.01, and 11.1 due to improper sanitization of user-supplied input in dynamically generated content. The CVE-2011-1726 entry notes unspecified vectors for the XSS, and CVSS v2 base score is 4.3 (Medium...

CVE-2017-8949

CVE-2017-8949 affects HPE SiteScope 11.2x and 11.3x, linked to a hard-coded cryptographic key in the ss_pu.jar library that enables information disclosure. The issue is part of a group of vulnerabilities (CVE-2017-8949, -8950, -8951, -8952) affecting the same product, with separate weaknesses inc...

CVE-2017-8950

HP SiteScope (HP) versions 11.2x–11.3x are affected by CVE-2017-8950, a vulnerability in the ss_pu.jar crypto library that uses a broken or risky cryptographic algorithm, enabling partial information disclosure of credentials. Root cause: use of weak crypto; impact: potential exposure of sensitiv...

CVE-2012-3261

CVE-2012-3261 affects HP SiteScope versions 11.10–11.12, where a vulnerable SOAP call using APIPreferenceImpl enables remote code execution. The SAINT entries describe a Security Bypass/Remote Code Execution path via the SOAP API, with HP confirming vulnerable versions and recommending upgrading ...

CVE-2013-6207

HP SiteScope SOAP loadFileContents vulnerability (CVE-2013-6207) affects SiteScope 10.1x, 11.1x, 11.21. The flaw in handling SOAP requests allows remote, unauthenticated attackers to trigger remote code execution, arbitrary file download, or DoS. ZDI notes exploitation via SOAP endpoints without ...

CVE-2012-3260

CVE-2012-3260 is an HP SiteScope vulnerability affecting 11.10–11.12 in the SOAP feature that allows remote code execution via unknown vectors (ZDI-CAN-1462). HP’s security bulletin SSRT100715 rev.3 confirms remote disclosure of information and code execution across SiteScope SOAP APIs and specif...

CVE-2012-3259

HP SiteScope SOAP vulnerability CVE-2012-3259 affects SiteScope v11.10–11.12 (Windows/Linux/Solaris). The issue is in the SOAP feature, allowing remote code execution via unknown vectors (ZDI-CAN-1461). HP’s security bulletin SSRT100715 (HPSBMU02815) states a patch is available: SiteScope update ...

CVE-2012-3264

HP SiteScope SOAP features in versions 11.10–11.12 are affected by multiple vulnerabilities that can lead to remote code execution and information disclosure (ZDI-1472). The HP Security Bulletin HPSBMU02815 rev.3 confirms affected software versions and documents that HP released SiteScope update ...

CVE-2017-8952

CVE-2017-8952 is an information disclosure vulnerability in HP SiteScope prior to/around 11.2x–11.3x where an unauthenticated remote attacker could access arbitrary files on the SiteScope host by exploiting improper authentication. Public docs describe it as a missing authentication issue (CWE-30...

CVE-2012-3263

HP SiteScope versions 11.10–11.12 are affected by CVE-2012-3263 due to a vulnerability in the SOAP feature that could allow remote code execution via unknown vectors (ZDI-CAN-1465). The HP Security Bulletin HPSBMU02815 rev.3 documents that update v11.13 fixes the issue; after applying the update,...

CVE-2014-2614

CVE-2014-2614 affects HP SiteScope versions 11.1x–11.13 and 11.2x–11.24, enabling remote authentication bypass (ZDI-2140). HP’s advisory HPSBMU03059 rev.1 lists affected versions and provides patch paths (SiS 11.13 and 11.24) for Windows, Linux, Solaris. Other connected sources reference the same...

CVE-2011-1727

HP SiteScope contains a Cross-Site Scripting (XSS) and HTML Injection vulnerability tracked as CVE-2011-1727. Affected versions are SiteScope 9.54, 10.13, 11.01, and 11.1. The root cause is described inconsistently across sources; OpenVAS notes indicate failure to properly sanitize user-supplied ...

CVE-2011-2401

HP SiteScope versions 9.x–11.x are affected by CVE-2011-2401 (session fixation). The vulnerability could allow remote attackers, with network access and no authentication, to hijack user sessions (CVSSv2 base score 9.0 per HP bulletin), via unspecified vectors. HP’s security bulletin HPSBMU02692 ...

CVE-2017-8951

HPE SiteScope 11.2x/11.3x contains an information-disclosure vulnerability (CVE-2017-8951). Credentials stored in Credential Profiles can be sent in plaintext over HTTP to the client, enabling potential disclosure. CERT/CC notes mitigation via updates, TLS/SSL enforcement, and restricted access; ...