DATABASE RESOURCES PRICING ABOUT US

{"id": "SECURITYVULNS:DOC:30945", "bulletinFamily": "software", "title": "[security bulletin] HPSBHF02913 rev.1 - HP Intelligent Management Center (iMC) and HP Branch Intelligent Management System (BIMS), Remote Disclosure of Information", "description": "\r\n\r\n-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA1\r\n\r\nNote: the current version of the following document is available here:\r\nhttps://h20564.www2.hp.com/portal/site/hpsc/public/kb/\r\ndocDisplay?docId=emr_na-c04369484\r\n\r\nSUPPORT COMMUNICATION - SECURITY BULLETIN\r\n\r\nDocument ID: c04369484\r\nVersion: 1\r\n\r\nHPSBHF02913 rev.1 - HP Intelligent Management Center (iMC) and HP Branch\r\nIntelligent Management System (BIMS), Remote Disclosure of Information\r\n\r\nNOTICE: The information in this Security Bulletin should be acted upon as\r\nsoon as possible.\r\n\r\nRelease Date: 2014-07-14\r\nLast Updated: 2014-07-14\r\n\r\nPotential Security Impact: Remote disclosure of information\r\n\r\nSource: Hewlett-Packard Company, HP Software Security Response Team\r\n\r\nVULNERABILITY SUMMARY\r\nPotential security vulnerabilities have been identified with HP Intelligent\r\nManagement Center (iMC) and HP Branch Intelligent Management System (BIMS).\r\nThe vulnerabilities could be exploited remotely resulting in disclosure of\r\ninformation.\r\n\r\nReferences:\r\n\r\nCVE-2014-2618 (ZDI-CAN-2080, SSRT101406)\r\nCVE-2014-2619 (ZDI-CAN-2088, SSRT101408)\r\nCVE-2014-2620 (ZDI-CAN-2089, SSRT101409)\r\nCVE-2014-2621 (ZDI-CAN-2090, SSRT101410)\r\nCVE-2014-2622 (ZDI-CAN-2312, SSRT101552)\r\n\r\nSUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.\r\nPlease refer to the RESOLUTION\r\n section below for a list of impacted products.\r\n\r\nBACKGROUND\r\n\r\nCVSS 2.0 Base Metrics\r\n===========================================================\r\n Reference Base Vector Base Score\r\nCVE-2014-2618 (AV:N/AC:L/Au:N/C:C/I:N/A:N) 7.8\r\nCVE-2014-2619 (AV:N/AC:L/Au:N/C:C/I:N/A:N) 7.8\r\nCVE-2014-2620 (AV:N/AC:L/Au:N/C:C/I:N/A:N) 7.8\r\nCVE-2014-2621 (AV:N/AC:L/Au:N/C:C/I:N/A:N) 7.8\r\nCVE-2014-2622 (AV:N/AC:L/Au:S/C:C/I:C/A:N) 8.5\r\n===========================================================\r\n Information on CVSS is documented\r\n in HP Customer Notice: HPSN-2008-002\r\n\r\nThe Hewlett-Packard Company thanks Bluesea working with HP's Zero Day\r\nInitiative for reporting CVE-2014-2618 through CVE-2014-2621 to\r\nsecurity-alert@hp.com.\r\n\r\nThe Hewlett-Packard Company thanks Brandon Perry working with HP's Zero Day\r\nInitiative for reporting CVE-2014-2622 to security-alert@hp.com.\r\n\r\nRESOLUTION\r\nHP has released the following software updates to resolve the vulnerabilities\r\nin HP Intelligent Management Center (iMC) and HP Branch Intelligent\r\nManagement System (BIMS).\r\n\r\nFamily\r\n Fixed Version\r\n HP Branded Products Impacted\r\n\r\niMC PLAT 7.0\r\n iMC PLAT 7.0 E02020P03\r\n JF377AAE HP IMC Standard Edition Software Platform with 100-node E-LTU\r\n JG549AAE HP PCM+ to IMC Std Upgr w/200-node E-LTU\r\n JG747AAE HP IMC Standard Software Platform with 50-node E-LTU\r\n JG768AAE HP PCM+ to IMC Std Upg w/ 200-node E-LTU\r\n JD125A HP IMC Standard Edition Software Platform with 100-node License\r\n JD815A HP IMC Standard Edition Software Platform with 100-node License\r\n JD816A HP A-IMC Standard Edition Software DVD Media\r\n JF377A HP IMC Standard Edition Software Platform with 100-node License\r\n JF288AAE HP Network Director to Intelligent Management Center Upgrade E-LTU\r\n JF289AAE HP Enterprise Management System to Intelligent Management Center\r\nUpgrade E-LTU\r\n TJ635AAE HP IMC for ANM 50 node pack SW E-LTU (On HP Softwares CPL not HPNs)\r\n JF378AAE HP IMC Enterprise Edition Software Platform with 200-Node E-LTU\r\n JG748AAE HP IMC Enterprise Software Platform with 50-node E-LTU\r\n JD126A HP A-IMC Enterprise Software Platform with 200-node License\r\n JD808A HP A-IMC Enterprise Software Platform with 200-node License\r\n JD814A HP A-IMC Enterprise Edition Software DVD Media\r\n JF378A HP IMC Enterprise Edition Software Platform with 200-node License\r\n JG546AAE HP IMC Basic SW Platform w/50-node E-LTU\r\n JG548AAE HP PCM+ to IMC Bsc Upgr w/50-node E-LTU\r\n JG550AAE HP PMM to IMC Bsc WLM Upgr w/150 AP E-LTU\r\n JG590AAE HP IMC Bsc WLAN Mgr SW Pltfm 50 AP E-LTU\r\n JG659AAE HP IMC Smart Connect Virtual Appliance Edition E-LTU\r\n JG766AAE HP IMC Smart Connect Virtual Appliance Edition E-LTU\r\n JG660AAE HP IMC Smart Connect w / WLAN Manager Virtual Appliance Edition\r\nE-LTU\r\n JG767AAE HP IMC Smart Connect with Wireless Service Manager Virtual\r\nAppliance Software E-LTU\r\n\r\nHP IMC Branch Intelligent Management System (BIMS\r\n iMC BIMS7.0 E0201P02\r\n JG265AAE HP IMC Branch Intelligent Management System Software Module with\r\n50-node E-LTU\r\n JG265A HP IMC Branch Intelligent Management System Software Module with\r\n50-node License\r\n\r\nHISTORY\r\nVersion:1 (rev.1) - 14 July 2014 Initial release\r\n\r\nThird Party Security Patches: Third party security patches that are to be\r\ninstalled on systems running HP software products should be applied in\r\naccordance with the customer's patch management policy.\r\n\r\nSupport: For issues about implementing the recommendations of this Security\r\nBulletin, contact normal HP Services support channel. For other issues about\r\nthe content of this Security Bulletin, send e-mail to security-alert@hp.com.\r\n\r\nReport: To report a potential security vulnerability with any HP supported\r\nproduct, send Email to: security-alert@hp.com\r\n\r\nSubscribe: To initiate a subscription to receive future HP Security Bulletin\r\nalerts via Email:\r\nhttp://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins\r\n\r\nSecurity Bulletin Archive: A list of recently released Security Bulletins is\r\navailable here:\r\nhttps://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/\r\n\r\nSoftware Product Category: The Software Product Category is represented in\r\nthe title by the two characters following HPSB.\r\n\r\n3C = 3COM\r\n3P = 3rd Party Software\r\nGN = HP General Software\r\nHF = HP Hardware and Firmware\r\nMP = MPE/iX\r\nMU = Multi-Platform Software\r\nNS = NonStop Servers\r\nOV = OpenVMS\r\nPI = Printing and Imaging\r\nPV = ProCurve\r\nST = Storage Software\r\nTU = Tru64 UNIX\r\nUX = HP-UX\r\n\r\nCopyright 2014 Hewlett-Packard Development Company, L.P.\r\nHewlett-Packard Company shall not be liable for technical or editorial errors\r\nor omissions contained herein. The information provided is provided "as is"\r\nwithout warranty of any kind. To the extent permitted by law, neither HP or\r\nits affiliates, subcontractors or suppliers will be liable for\r\nincidental,special or consequential damages including downtime cost; lost\r\nprofits; damages relating to the procurement of substitute products or\r\nservices; or damages for loss of data, or software restoration. The\r\ninformation in this document is subject to change without notice.\r\nHewlett-Packard Company and the names of Hewlett-Packard products referenced\r\nherein are trademarks of Hewlett-Packard Company in the United States and\r\nother countries. Other product and company names mentioned herein may be\r\ntrademarks of their respective owners.\r\n\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v2.0.19 (GNU/Linux)\r\n\r\niEYEARECAAYFAlPEETwACgkQ4B86/C0qfVlf0QCeJD/lBaM9kk8kU8TVqWpFAV5A\r\nEn0An0+SlAPlodSdrRTtUhpVZlHZLYb6\r\n=DgCW\r\n-----END PGP SIGNATURE-----\r\n\r\n", "published": "2014-07-22T00:00:00", "modified": "2014-07-22T00:00:00", "cvss": {"score": 8.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:NONE/"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:30945", "reporter": "Securityvulns", "references": [], "cvelist": ["CVE-2014-2619", "CVE-2014-2620", "CVE-2014-2622", "CVE-2014-2621", "CVE-2014-2618"], "type": "securityvulns", "lastseen": "2018-08-31T11:10:52", "edition": 1, "viewCount": 64, "enchantments": {"score": {"value": -0.3, "vector": "NONE"}, "dependencies": {"references": [{"type": "checkpoint_advisories", "idList": ["CPAI-2013-1707", "CPAI-2014-1747"]}, {"type": "cve", "idList": ["CVE-2014-2618", "CVE-2014-2619", "CVE-2014-2620", "CVE-2014-2621", "CVE-2014-2622"]}, {"type": "nessus", "idList": ["HP_IMC_70_E0202P03.NASL", "HP_IMC_BIMS_70_E0201P02.NASL"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:13883"]}, {"type": "zdi", "idList": ["ZDI-14-231", "ZDI-14-232", "ZDI-14-233", "ZDI-14-234", "ZDI-14-235"]}]}, "backreferences": {"references": [{"type": "canvas", "idList": ["MU"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2013-1701", "CPAI-2013-1707", "CPAI-2013-1839"]}, {"type": "cve", "idList": ["CVE-2014-2618", "CVE-2014-2619", "CVE-2014-2620", "CVE-2014-2621", "CVE-2014-2622"]}, {"type": "nessus", "idList": ["HP_IMC_70_E0202P03.NASL"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:13883"]}, {"type": "zdi", "idList": ["ZDI-14-232", "ZDI-14-233"]}]}, "exploitation": null, "vulnersScore": -0.3}, "affectedSoftware": [], "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1659919447, "score": 1659919836}, "_internal": {"score_hash": "b52b9854c32d8881f02d33293f0ccd08"}}

{"nessus": [{"lastseen": "2022-04-16T14:08:11", "description": "The version of the HP Intelligent Management Center Branch Intelligent Management System (BIMS) module on the remote host is version 7.x prior to 7.0-E0201P02 and has multiple vulnerabilities that could allow a remote attacker to access sensitive information via unspecified vectors.", "cvss3": {"score": null, "vector": null}, "published": "2014-07-21T00:00:00", "type": "nessus", "title": "HP Intelligent Management Center Branch Intelligent Management Module 7.x < 7.0-E0201P02 Multiple Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-2618", "CVE-2014-2619", "CVE-2014-2620", "CVE-2014-2621", "CVE-2014-2622"], "modified": "2022-04-11T00:00:00", "cpe": ["cpe:/a:hp:intelligent_management_center", "cpe:/a:hp:imc_branch_intelligent_management_system_software_module"], "id": "HP_IMC_BIMS_70_E0201P02.NASL", "href": "https://www.tenable.com/plugins/nessus/76621", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(76621);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/04/11\");\n\n script_cve_id(\n \"CVE-2014-2618\",\n \"CVE-2014-2619\",\n \"CVE-2014-2620\",\n \"CVE-2014-2621\",\n \"CVE-2014-2622\"\n );\n script_bugtraq_id(\n 68540,\n 68543,\n 68544,\n 68546,\n 68547\n );\n script_xref(name:\"HP\", value:\"emr_na-c04369484\");\n script_xref(name:\"HP\", value:\"HPSBHF02913\");\n script_xref(name:\"HP\", value:\"SSRT101406\");\n script_xref(name:\"HP\", value:\"SSRT101408\");\n script_xref(name:\"HP\", value:\"SSRT101409\");\n script_xref(name:\"HP\", value:\"SSRT101410\");\n script_xref(name:\"HP\", value:\"SSRT101552\");\n\n script_name(english:\"HP Intelligent Management Center Branch Intelligent Management Module 7.x < 7.0-E0201P02 Multiple Vulnerabilities\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The version of the HP Branch Intelligent Management System module on\nthe remote host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of the HP Intelligent Management Center Branch Intelligent\nManagement System (BIMS) module on the remote host is version 7.x\nprior to 7.0-E0201P02 and has multiple vulnerabilities that could\nallow a remote attacker to access sensitive information via\nunspecified vectors.\");\n # https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-c04369484\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?1bc1d445\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade the iMC BIMs module to version 7.0-E0201P02 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/07/14\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/07/14\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/07/21\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:hp:intelligent_management_center\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:hp:imc_branch_intelligent_management_system_software_module\");\n script_set_attribute(attribute:\"thorough_tests\", value:\"true\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Misc.\");\n\n script_copyright(english:\"This script is Copyright (C) 2014-2022 Tenable Network Security, Inc.\");\n\n script_dependencies(\"hp_imc_detect.nbin\");\n script_require_ports(\"Services/activemq\", 61616);\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\n# Figure out which port to use\nport = get_service(svc:'activemq', default:61616, exit_on_fail:TRUE);\n\nversion = get_kb_item_or_exit('hp/hp_imc/' + port + '/components/iMC-BIMS/version');\n\n# Only Version 7.0 known to be affected\nif (version !~ \"^7\\.0\") audit(AUDIT_LISTEN_NOT_VULN, 'HP Intelligent Management Center Branch Intelligent Management module', port, version);\n\nverparts = split(version, sep:\"-\");\npatchver = FALSE;\n# Versions 7.0 affected before E0201P02, remove letters in patch version (if patched)\nif (max_index(verparts) > 1) patchver = ereg_replace(string:verparts[1], pattern:\"[A-Z]\", replace:\"\");\n# All versions have the \"dash\" : i.e. 7.0-E202P03\n# if it doesn't have a dash we got a weird version somehow.\nif (!patchver) audit(AUDIT_UNKNOWN_APP_VER, 'HP Intelligent Management Center Branch Intelligent Management module');\n\nif (ver_compare(fix:\"020102\", ver:patchver, strict:FALSE) < 0)\n{\n if (report_verbosity > 0)\n {\n report =\n '\\n Installed version : ' + version +\n '\\n Fixed version : 7.0-E0201P02' +\n '\\n';\n security_hole(port:port, extra:report);\n }\n else security_hole(port);\n exit(0);\n}\nelse audit(AUDIT_LISTEN_NOT_VULN, 'HP Intelligent Management Center Branch Intelligent Management module', port, version);\n", "cvss": {"score": 8.5, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:N"}}, {"lastseen": "2022-04-16T14:07:38", "description": "The version of HP Intelligent Management Center on the remote host is version 7.x prior to 7.0-E0202P03. It is, therefore, affected by multiple vulnerabilities that could allow a remote attacker to access sensitive information via unspecified vectors.", "cvss3": {"score": null, "vector": null}, "published": "2014-07-21T00:00:00", "type": "nessus", "title": "HP Intelligent Management Center 7.x < 7.0-E0202P03 Multiple Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-2618", "CVE-2014-2619", "CVE-2014-2620", "CVE-2014-2621", "CVE-2014-2622"], "modified": "2022-04-11T00:00:00", "cpe": ["cpe:/a:hp:intelligent_management_center"], "id": "HP_IMC_70_E0202P03.NASL", "href": "https://www.tenable.com/plugins/nessus/76620", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(76620);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/04/11\");\n\n script_cve_id(\n \"CVE-2014-2618\",\n \"CVE-2014-2619\",\n \"CVE-2014-2620\",\n \"CVE-2014-2621\",\n \"CVE-2014-2622\"\n );\n script_bugtraq_id(\n 68540,\n 68543,\n 68544,\n 68546,\n 68547\n );\n script_xref(name:\"HP\", value:\"emr_na-c04369484\");\n script_xref(name:\"HP\", value:\"HPSBHF02913\");\n script_xref(name:\"HP\", value:\"SSRT101406\");\n script_xref(name:\"HP\", value:\"SSRT101408\");\n script_xref(name:\"HP\", value:\"SSRT101409\");\n script_xref(name:\"HP\", value:\"SSRT101410\");\n script_xref(name:\"HP\", value:\"SSRT101552\");\n\n script_name(english:\"HP Intelligent Management Center 7.x < 7.0-E0202P03 Multiple Vulnerabilities\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The version of HP Intelligent Management Center on the remote host is\naffected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of HP Intelligent Management Center on the remote host is\nversion 7.x prior to 7.0-E0202P03. It is, therefore, affected by\nmultiple vulnerabilities that could allow a remote attacker to access\nsensitive information via unspecified vectors.\");\n # https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-c04369484\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?1bc1d445\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to iMC version 7.0-E0202P03 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/07/14\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/07/14\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/07/21\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:hp:intelligent_management_center\");\n script_set_attribute(attribute:\"thorough_tests\", value:\"true\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Misc.\");\n\n script_copyright(english:\"This script is Copyright (C) 2014-2022 Tenable Network Security, Inc.\");\n\n script_dependencies(\"hp_imc_detect.nbin\");\n script_require_ports(\"Services/activemq\", 61616);\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\n# Figure out which port to use\nport = get_service(svc:'activemq', default:61616, exit_on_fail:TRUE);\n\nversion = get_kb_item_or_exit('hp/hp_imc/'+port+'/version');\n\n# Only Version 7.0 known to be affected\nif (version !~ \"^7\\.0\") audit(AUDIT_LISTEN_NOT_VULN, 'HP Intelligent Management Center', port, version);\n\nverparts = split(version, sep:\"-\");\npatchver = FALSE;\n# Versions 7.0 affected before E0202P03, remove letters in patch version (if patched)\nif (max_index(verparts) > 1) patchver = ereg_replace(string:verparts[1], pattern:\"[A-Z]\", replace:\"\");\n# All versions have the \"dash\" : i.e. 7.0-E202P03\n# if it doesn't have a dash we got a weird version somehow.\nif (!patchver) audit(AUDIT_UNKNOWN_APP_VER, 'HP Intelligent Management Center');\n\nif (ver_compare(fix:\"020203\", ver:patchver, strict:FALSE) < 0)\n{\n if (report_verbosity > 0)\n {\n report =\n '\\n Installed version : ' + version +\n '\\n Fixed version : 7.0-E0202P03' +\n '\\n';\n security_hole(port:port, extra:report);\n }\n else security_hole(port);\n exit(0);\n}\nelse audit(AUDIT_LISTEN_NOT_VULN, 'HP Intelligent Management Center', port, version);\n", "cvss": {"score": 8.5, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:N"}}], "securityvulns": [{"lastseen": "2021-06-08T18:50:13", "description": "No description provided", "edition": 2, "cvss3": {}, "published": "2014-07-22T00:00:00", "title": "HP Intelligent Management Center / HP Branch Intelligent Management System information leakage", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2014-2619", "CVE-2014-2620", "CVE-2014-2622", "CVE-2014-2621", "CVE-2014-2618"], "modified": "2014-07-22T00:00:00", "id": "SECURITYVULNS:VULN:13883", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:13883", "cvss": {"score": 8.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:NONE/"}}], "zdi": [{"lastseen": "2022-01-31T21:05:57", "description": "This vulnerability allows remote attackers to obtain sensitive information on vulnerable installations of Hewlett-Packard Intelligent Management Center. Authentication is required to exploit this vulnerability. The specific flaw exists within the RssServlet servlet. This servlet exhibits an XML external entity injection vulnerability which allows any file readable by SYSTEM to be disclosed. By abusing this behavior an attacker can disclose administrative credentials and possibly leverage this situation to achieve remote code execution.", "cvss3": {}, "published": "2014-07-16T00:00:00", "type": "zdi", "title": "Hewlett-Packard Intelligent Management Center RssServlet Information Disclosure Vulnerability", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "NONE", "integrityImpact": "COMPLETE", "baseScore": 8.5, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 9.2, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-2622"], "modified": "2014-07-16T00:00:00", "id": "ZDI-14-235", "href": "https://www.zerodayinitiative.com/advisories/ZDI-14-235/", "cvss": {"score": 8.5, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:N"}}, {"lastseen": "2022-01-31T21:05:56", "description": "This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett-Packard Intelligent Management Center. Authentication is not required to exploit this vulnerability. The specific flaw exists within the IctDownloadServlet servlet. This servlet contains a directory traversal issue which allows any file readable by SYSTEM to be disclosed. By abusing this behavior, an attacker can disclose administrative credentials and possibly leverage this situation to achieve remote code execution.", "cvss3": {}, "published": "2014-07-16T00:00:00", "type": "zdi", "title": "Hewlett-Packard Intelligent Management Center IctDownloadServlet Information Disclosure Vulnerability", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-2621"], "modified": "2014-07-16T00:00:00", "id": "ZDI-14-234", "href": "https://www.zerodayinitiative.com/advisories/ZDI-14-234/", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:C/I:N/A:N"}}, {"lastseen": "2022-01-31T21:05:58", "description": "This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett-Packard Intelligent Management Center. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SyslogDownloadServlet servlet. This servlet contains a directory traversal issue which allows any file readable by SYSTEM to be disclosed. By abusing this behavior, an attacker can disclose administrative credentials and possibly leverage this situation to achieve remote code execution.", "cvss3": {}, "published": "2014-07-16T00:00:00", "type": "zdi", "title": "Hewlett-Packard Intelligent Management Center SyslogDownloadServlet Information Disclosure Vulnerability", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-2619"], "modified": "2014-07-16T00:00:00", "id": "ZDI-14-232", "href": "https://www.zerodayinitiative.com/advisories/ZDI-14-232/", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:C/I:N/A:N"}}, {"lastseen": "2022-01-31T21:05:59", "description": "This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett-Packard Intelligent Management Center. Authentication is not required to exploit this vulnerability. The specific flaw exists within the FaultDownloadServlet servlet. This servlet contains a directory traversal issue which allows any file readable by SYSTEM to be disclosed. By abusing this behavior, an attacker can disclose administrative credentials and possibly leverage this situation to achieve remote code execution.", "cvss3": {}, "published": "2014-07-16T00:00:00", "type": "zdi", "title": "Hewlett-Packard Intelligent Management Center FaultDownloadServlet Information Disclosure Vulnerability", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-2620"], "modified": "2014-07-16T00:00:00", "id": "ZDI-14-233", "href": "https://www.zerodayinitiative.com/advisories/ZDI-14-233/", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:C/I:N/A:N"}}, {"lastseen": "2022-01-31T21:05:57", "description": "This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett-Packard Intelligent Management Center. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UploadServlet servlet. This servlet contains a directory traversal issue which allows any file readable by SYSTEM to be disclosed. By abusing this behavior, an attacker can disclose administrative credentials and possibly leverage this situation to achieve remote code execution.", "cvss3": {}, "published": "2014-07-16T00:00:00", "type": "zdi", "title": "Hewlett-Packard Intelligent Management Center BIMS UploadServlet Information Disclosure Vulnerability", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-2618"], "modified": "2014-07-16T00:00:00", "id": "ZDI-14-231", "href": "https://www.zerodayinitiative.com/advisories/ZDI-14-231/", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:C/I:N/A:N"}}], "cve": [{"lastseen": "2022-03-23T12:40:09", "description": "Unspecified vulnerability in HP Intelligent Management Center (iMC) before 7.0 E02020P03 and Branch Intelligent Management System (BIMS) before 7.0 E0201P02 allows remote authenticated users to obtain sensitive information or modify data via unknown vectors, aka ZDI-CAN-2312.", "cvss3": {}, "published": "2014-07-16T04:58:00", "type": "cve", "title": "CVE-2014-2622", "cwe": ["NVD-CWE-noinfo"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "NONE", "integrityImpact": "COMPLETE", "baseScore": 8.5, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 9.2, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-2622"], "modified": "2017-08-29T01:34:00", "cpe": ["cpe:/a:hp:imc_branch_intelligent_management_system_software_module:7.0", "cpe:/a:hp:intelligent_management_center:7.0"], "id": "CVE-2014-2622", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2622", "cvss": {"score": 8.5, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:N"}, "cpe23": ["cpe:2.3:a:hp:imc_branch_intelligent_management_system_software_module:7.0:*:*:*:*:*:*:*", "cpe:2.3:a:hp:intelligent_management_center:7.0:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T12:40:07", "description": "Unspecified vulnerability in HP Intelligent Management Center (iMC) before 7.0 E02020P03 and Branch Intelligent Management System (BIMS) before 7.0 E0201P02 allows remote attackers to obtain sensitive information via unknown vectors, aka ZDI-CAN-2090.", "cvss3": {}, "published": "2014-07-16T04:58:00", "type": "cve", "title": "CVE-2014-2621", "cwe": ["NVD-CWE-noinfo"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-2621"], "modified": "2017-08-29T01:34:00", "cpe": ["cpe:/a:hp:imc_branch_intelligent_management_system_software_module:7.0", "cpe:/a:hp:intelligent_management_center:7.0"], "id": "CVE-2014-2621", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2621", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:C/I:N/A:N"}, "cpe23": ["cpe:2.3:a:hp:imc_branch_intelligent_management_system_software_module:7.0:*:*:*:*:*:*:*", "cpe:2.3:a:hp:intelligent_management_center:7.0:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T12:40:06", "description": "Unspecified vulnerability in HP Intelligent Management Center (iMC) before 7.0 E02020P03 and Branch Intelligent Management System (BIMS) before 7.0 E0201P02 allows remote attackers to obtain sensitive information via unknown vectors, aka ZDI-CAN-2088.", "cvss3": {}, "published": "2014-07-16T04:58:00", "type": "cve", "title": "CVE-2014-2619", "cwe": ["NVD-CWE-noinfo"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-2619"], "modified": "2017-08-29T01:34:00", "cpe": ["cpe:/a:hp:imc_branch_intelligent_management_system_software_module:7.0", "cpe:/a:hp:intelligent_management_center:7.0"], "id": "CVE-2014-2619", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2619", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:C/I:N/A:N"}, "cpe23": ["cpe:2.3:a:hp:imc_branch_intelligent_management_system_software_module:7.0:*:*:*:*:*:*:*", "cpe:2.3:a:hp:intelligent_management_center:7.0:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T12:40:07", "description": "Unspecified vulnerability in HP Intelligent Management Center (iMC) before 7.0 E02020P03 and Branch Intelligent Management System (BIMS) before 7.0 E0201P02 allows remote attackers to obtain sensitive information via unknown vectors, aka ZDI-CAN-2089.", "cvss3": {}, "published": "2014-07-16T04:58:00", "type": "cve", "title": "CVE-2014-2620", "cwe": ["NVD-CWE-noinfo"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-2620"], "modified": "2017-08-29T01:34:00", "cpe": ["cpe:/a:hp:imc_branch_intelligent_management_system_software_module:7.0", "cpe:/a:hp:intelligent_management_center:7.0"], "id": "CVE-2014-2620", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2620", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:C/I:N/A:N"}, "cpe23": ["cpe:2.3:a:hp:imc_branch_intelligent_management_system_software_module:7.0:*:*:*:*:*:*:*", "cpe:2.3:a:hp:intelligent_management_center:7.0:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T12:40:05", "description": "Unspecified vulnerability in HP Intelligent Management Center (iMC) before 7.0 E02020P03 and Branch Intelligent Management System (BIMS) before 7.0 E0201P02 allows remote attackers to obtain sensitive information via unknown vectors, aka ZDI-CAN-2080.", "cvss3": {}, "published": "2014-07-16T04:58:00", "type": "cve", "title": "CVE-2014-2618", "cwe": ["NVD-CWE-noinfo"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-2618"], "modified": "2019-10-09T23:10:00", "cpe": ["cpe:/a:hp:imc_branch_intelligent_management_system_software_module:7.0", "cpe:/a:hp:intelligent_management_center:7.0"], "id": "CVE-2014-2618", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2618", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:C/I:N/A:N"}, "cpe23": ["cpe:2.3:a:hp:imc_branch_intelligent_management_system_software_module:7.0:*:*:*:*:*:*:*", "cpe:2.3:a:hp:intelligent_management_center:7.0:*:*:*:*:*:*:*"]}], "checkpoint_advisories": [{"lastseen": "2022-08-02T18:31:06", "description": "An information disclosure vulnerability exists in the BIMS add-in module of HP Intelligent Management Center. The vulnerability is due to lack of authentication and insufficient input validation in the UploadServlet servlet when processing HTTP request parameters. By sending crafted HTTP requests to the target system, a remote unauthenticated attacker can leverage this vulnerability to view the contents of arbitrary files on a target system.", "cvss3": {}, "published": "2014-08-24T00:00:00", "type": "checkpoint_advisories", "title": "HP Intelligent Management Center BIMS UploadServlet Information Disclosure (CVE-2014-2618)", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2014-2618"], "modified": "2014-08-14T00:00:00", "id": "CPAI-2014-1747", "href": "", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2022-08-02T18:39:47", "description": "An information disclosure vulnerability has been reported in HP Intelligent Management Center. The vulnerability is due to a lack of authentication and insufficient input validation when processing HTTP request parameters. A remote unauthenticated attacker can leverage this vulnerability to view the file contents of arbitrary files on a target system.", "cvss3": {}, "published": "2013-05-05T00:00:00", "type": "checkpoint_advisories", "title": "HP Intelligent Management Center FaultDownloadServlet Information Disclosure (CVE-2012-5202; CVE-2014-2620)", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2012-5202", "CVE-2014-2620"], "modified": "2014-09-23T00:00:00", "id": "CPAI-2013-1707", "href": "", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:C/I:N/A:N"}}]}