Vulnerabilities (CVE)

Filtered by vendor Hp Subscribe
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2018-1853 6 Apple, Hp, Ibm and 3 more 7 Macos, Hp-ux, Aix and 4 more 2021-11-20 4.3 MEDIUM 6.1 MEDIUM
IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 151014.
CVE-2016-6306 4 Hp, Nodejs, Novell and 1 more 7 Icewall Federation Agent, Icewall Mcrp, Icewall Sso and 4 more 2021-11-17 4.3 MEDIUM 5.9 MEDIUM
The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c.
CVE-2021-38949 5 Hp, Ibm, Linux and 2 more 8 Hp-ux, Aix, I and 5 more 2021-11-17 2.1 LOW 5.5 MEDIUM
IBM MQ 7.5, 8.0, 9.0 LTS, 9.1 CD, and 9.1 LTS stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 211403.
CVE-2019-18914 1 Hp 755 Digital Sender Flow 8500 Fn2 Document Capture Workstation L2762a, Futuresmart 3, Futuresmart 4 and 752 more 2021-11-15 4.3 MEDIUM 6.1 MEDIUM
A potential security vulnerability has been identified for certain HP printers and MFPs that would allow redirection page Cross-Site Scripting in a client’s browser by clicking on a third-party malicious link.
CVE-2021-39237 1 Hp 3 Futuresmart 3, Futuresmart 4, Futuresmart 5 2021-11-04 2.1 LOW 4.6 MEDIUM
Certain HP LaserJet, HP LaserJet Managed, HP PageWide, and HP PageWide Managed printers may be vulnerable to potential information disclosure.
CVE-2021-3662 1 Hp 2 Futuresmart 4, Futuresmart 5 2021-11-04 3.5 LOW 5.4 MEDIUM
Certain HP Enterprise LaserJet and PageWide MFPs may be vulnerable to stored cross site scripting (XSS).
CVE-2019-18567 1 Hp 1 Bromium 2021-11-03 3.3 LOW 6.3 MEDIUM
Bromium client version 4.0.3.2060 and prior to 4.1.7 Update 1 has an out of bound read results in race condition causing Kernel memory leaks or denial of service.
CVE-2021-3441 1 Hp 2 Officejet 7110, Officejet 7110 Firmware 2021-11-03 3.5 LOW 4.8 MEDIUM
A potential security vulnerability has been identified for the HP OfficeJet 7110 Wide Format ePrinter that enables Cross-Site Scripting (XSS).
CVE-2021-20579 5 Hp, Ibm, Linux and 2 more 6 Hp-ux, Aix, Db2 and 3 more 2021-09-20 3.5 LOW 6.5 MEDIUM
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a user who can create a view or inline SQL function to obtain sensitive information when AUTO_REVAL is set to DEFFERED_FORCE. IBM X-Force ID: 199283.
CVE-2021-29777 5 Hp, Ibm, Linux and 2 more 6 Hp-ux, Aix, Db2 and 3 more 2021-09-20 4.0 MEDIUM 6.5 MEDIUM
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5, under specific circumstance of a table being dropped while being accessed in another session, could allow an authenticated user to cause a denial of srevice IBM X-Force ID: 203031.
CVE-2021-29728 5 Hp, Ibm, Linux and 2 more 8 Hp-ux, Aix, Linux On Zseries and 5 more 2021-09-02 4.0 MEDIUM 4.9 MEDIUM
IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 201160.
CVE-2021-20560 5 Hp, Ibm, Linux and 2 more 6 Hp-ux, Aix, Sterling Connect Direct User Interface and 3 more 2021-08-04 4.9 MEDIUM 5.4 MEDIUM
IBM Sterling Connect:Direct Browser User Interface 1.4.1.1 and 1.5.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 199229.
CVE-2020-7196 1 Hp 2 Bluedata Epic, Ezmeral Container Platform 2021-07-21 4.0 MEDIUM 6.5 MEDIUM
The HPE BlueData EPIC Software Platform version 4.0 and HPE Ezmeral Container Platform 5.0 use an insecure method of handling sensitive Kerberos passwords that is susceptible to unauthorized interception and/or retrieval. Specifically, they display the kdc_admin_password in the source file of the url "/bdswebui/assignusers/".
CVE-2019-3483 1 Hp 1 Arcsight Logger 2021-07-21 6.8 MEDIUM 6.5 MEDIUM
Mitigates a potential information leakage issue in ArcSight Logger versions prior to 6.7.
CVE-2020-7134 1 Hp 1 Hpe Iot \+ Gcp 2021-07-21 4.0 MEDIUM 6.5 MEDIUM
A remote access to sensitive data vulnerability was discovered in HPE IOT + GCP version(s): 1.4.0, 1.4.1, 1.4.2, 1.2.4.2.
CVE-2020-4299 5 Hp, Ibm, Linux and 2 more 7 Hp-ux, Aix, I and 4 more 2021-07-21 4.0 MEDIUM 4.3 MEDIUM
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.1 could expose sensitive information to a user through a specially crafted HTTP request. IBM X-Force ID: 176606.
CVE-2019-4656 5 Hp, Ibm, Linux and 2 more 8 Hp-ux, Aix, Mq and 5 more 2021-07-21 4.0 MEDIUM 6.5 MEDIUM
IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD is vulnerable to a denial of service attack that would allow an authenticated user to crash the queue and require a restart due to an error processing error messages. IBM X-Force ID: 170967.
CVE-2019-12000 1 Hp 1 Mse Msg Gw Application E-ltu 2021-07-21 5.4 MEDIUM 6.6 MEDIUM
HPE has found a potential Remote Access Restriction Bypass in HPE MSE Msg Gw application E-LTU prior to version 3.2 when HTTPS is used between the USSD and an external USSD service logic application. Update to version 3.2 and update the HTTPS configuration as described in the HPE MSE Messaging Gateway Configuration and Operations Guide.
CVE-2019-11946 1 Hp 1 Intelligent Management Center 2021-07-21 6.8 MEDIUM 6.5 MEDIUM
A remote credential disclosure vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2020-15596 1 Hp 28 Elite X2 1012 G1, Elite X2 1012 G1 Firmware, Elite X2 1012 G2 and 25 more 2021-07-21 4.6 MEDIUM 6.7 MEDIUM
The ALPS ALPINE touchpad driver before 8.2206.1717.634, as used on various Dell, HP, and Lenovo laptops, allows attackers to conduct Path Disclosure attacks via a "fake" DLL file.
CVE-2019-4568 5 Hp, Ibm, Linux and 2 more 7 Hp-ux, Aix, Mq and 4 more 2021-07-21 4.3 MEDIUM 5.9 MEDIUM
IBM MQ and IBM MQ Appliance 8.0 and 9.0 LTS could allow a remote attacker with intimate knowledge of the server to cause a denial of service when receiving data on the channel. IBM X-Force ID: 166629.
CVE-2020-7202 1 Hp 83 Apollo 4200 Gen10 Server, Apollo 4200 Gen9 Server, Apollo 4510 System and 80 more 2021-07-21 5.0 MEDIUM 5.3 MEDIUM
A potential security vulnerability has been identified in HPE Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4) firmware. The vulnerability could be remotely exploited to disclose the serial number and other information.
CVE-2020-7207 1 Hp 42 Apollo 2000, Apollo 2000 Firmware, Apollo 4200 Gen10 and 39 more 2021-07-21 7.2 HIGH 6.8 MEDIUM
A local elevation of privilege using physical access security vulnerability was found in HPE Proliant Gen10 Servers using Intel Innovation Engine (IE). This attack requires a physical attack to the server motherboard. To mitigate this issue, ensure your server is always physically secured. HPE will not address this issue in the impacted Gen 10 servers listed. HPE recommends using appropriate physical security methods as a compensating control to disallow an attacker from having physical access to the server main circuit board.
CVE-2016-4376 2 Broadcom, Hp 2 Fabric Operating System, Storefabric B Series Switch 2021-06-22 7.8 HIGH 6.5 MEDIUM
HPE FOS before 7.4.1d and 8.x before 8.0.1 on StoreFabric B switches allows remote attackers to obtain sensitive information via unspecified vectors.
CVE-2021-26584 1 Hp 1 Oneview For Vmware Vcenter 2021-06-11 4.3 MEDIUM 6.1 MEDIUM
A security vulnerability in HPE OneView for VMware vCenter (OV4VC) could be exploited remotely to allow Cross-Site Scripting. HPE has released the following software update to resolve the vulnerability in HPE OneView for VMware vCenter (OV4VC).
CVE-2021-29202 1 Hp 29 Integrated Lights-out 4, Integrated Lights-out 5, Proliant Bl460c Gen10 Server Blade and 26 more 2021-06-02 4.6 MEDIUM 6.7 MEDIUM
A local buffer overflow vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.
CVE-2021-29201 1 Hp 29 Integrated Lights-out 4, Integrated Lights-out 5, Proliant Bl460c Gen10 Server Blade and 26 more 2021-06-02 3.5 LOW 4.8 MEDIUM
A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.
CVE-2021-29204 1 Hp 29 Integrated Lights-out 4, Integrated Lights-out 5, Proliant Bl460c Gen10 Server Blade and 26 more 2021-06-02 3.5 LOW 4.8 MEDIUM
A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.
CVE-2021-29205 1 Hp 29 Integrated Lights-out 4, Integrated Lights-out 5, Proliant Bl460c Gen10 Server Blade and 26 more 2021-06-02 3.5 LOW 4.8 MEDIUM
A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.
CVE-2021-29206 1 Hp 29 Integrated Lights-out 4, Integrated Lights-out 5, Proliant Bl460c Gen10 Server Blade and 26 more 2021-06-02 3.5 LOW 4.8 MEDIUM
A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.
CVE-2021-29211 1 Hp 29 Integrated Lights-out 4, Integrated Lights-out 5, Proliant Bl460c Gen10 Server Blade and 26 more 2021-06-02 3.5 LOW 4.8 MEDIUM
A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.
CVE-2021-29207 1 Hp 29 Integrated Lights-out 4, Integrated Lights-out 5, Proliant Bl460c Gen10 Server Blade and 26 more 2021-06-02 3.5 LOW 4.8 MEDIUM
A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.
CVE-2019-3485 1 Hp 1 Arcsight Logger 2021-05-12 4.3 MEDIUM 6.1 MEDIUM
Mitigates a stored cross site scripting issue in ArcSight Logger versions prior to 6.7.1
CVE-2019-3486 1 Hp 1 Arcsight Management Center 2021-05-12 4.3 MEDIUM 6.1 MEDIUM
Mitigates a stored cross site scripting issue in ArcSight Security Management Center versions prior to 2.9.1
CVE-2021-20515 5 Hp, Ibm, Linux and 2 more 6 Hp-ux, Aix, Informix Dynamic Server and 3 more 2021-04-30 4.6 MEDIUM 6.7 MEDIUM
IBM Informix Dynamic Server 14.10 is vulnerable to a stack based buffer overflow, caused by improper bounds checking. A local privileged user could overflow a buffer and execute arbitrary code on the system or cause a denial of service condition. IBM X-Force ID: 198366.
CVE-2021-26582 3 Hp, Microsoft, Redhat 4 Hp-ux, Icewall Sso Dgfw, Windows and 1 more 2021-04-22 4.3 MEDIUM 6.1 MEDIUM
A security vulnerability in HPE IceWall SSO Domain Gateway Option (Dgfw) module version 10.0 on RHEL 5/6/7, version 10.0 on HP-UX 11i v3, version 10.0 on Windows and 11.0 on Windows could be exploited remotely to allow cross-site scripting (XSS).
CVE-2021-20480 5 Hp, Ibm, Linux and 2 more 8 Hp-ux, Aix, I and 5 more 2021-04-13 4.0 MEDIUM 6.5 MEDIUM
IBM WebSphere Application Server 7.0, 8.0, and 8.5 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to obtain sensitive data. IBM X-Force ID: 197502.
CVE-2019-11135 6 Canonical, Fedoraproject, Hp and 3 more 292 Ubuntu Linux, Fedora, Apollo 2000 and 289 more 2021-01-20 2.1 LOW 6.5 MEDIUM
TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.
CVE-2020-4761 5 Hp, Ibm, Linux and 2 more 7 Hp-ux, Aix, I and 4 more 2021-01-08 5.0 MEDIUM 5.3 MEDIUM
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 188895.
CVE-2020-4657 5 Hp, Ibm, Linux and 2 more 7 Hp-ux, Aix, I and 4 more 2020-12-17 4.3 MEDIUM 6.1 MEDIUM
IBM Sterling B2B Integrator 5.2.0.0 through 6.0.3.2 Standard Edition is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186094.
CVE-2020-4658 5 Hp, Ibm, Linux and 2 more 7 Hp-ux, Aix, I and 4 more 2020-12-17 4.3 MEDIUM 6.1 MEDIUM
IBM Sterling File Gateway 2.2.0.0 through 6.0.3.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186095.
CVE-2019-4738 5 Hp, Ibm, Linux and 2 more 7 Hp-ux, Aix, I and 4 more 2020-12-11 4.0 MEDIUM 6.5 MEDIUM
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 and 6.0.0.0 through 6.0.3.1 discloses sensitive information to an authenticated user from the dashboard UI which could be used in further attacks against the system. IBM X-Force ID: 172753.
CVE-2020-4578 5 Hp, Ibm, Linux and 2 more 8 Hp-ux, Aix, I and 5 more 2020-09-11 3.5 LOW 5.4 MEDIUM
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 184433.
CVE-2016-2775 4 Fedoraproject, Hp, Isc and 1 more 9 Fedora, Hp-ux, Bind and 6 more 2020-08-25 4.3 MEDIUM 5.9 MEDIUM
ISC BIND 9.x before 9.9.9-P2, 9.10.x before 9.10.4-P2, and 9.11.x before 9.11.0b2, when lwresd or the named lwres option is enabled, allows remote attackers to cause a denial of service (daemon crash) via a long request that uses the lightweight resolver protocol.
CVE-2018-7125 1 Hp 1 Intelligent Management Center 2020-08-24 6.5 MEDIUM 6.3 MEDIUM
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2018-7113 1 Hp 3 Gen 10 Servers, Integrated Lights-out, Integrated Lights-out 5 Firmware 2020-08-24 7.2 HIGH 6.6 MEDIUM
A security vulnerability in HPE Integrated Lights-Out 5 (iLO 5) prior to v1.37 could be locally exploited to bypass the security restrictions for firmware updates.
CVE-2019-4719 5 Hp, Ibm, Linux and 2 more 8 Hp-ux, Aix, Mq and 5 more 2020-08-24 2.1 LOW 5.5 MEDIUM
IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclusion of sensitive data within runmqras data.
CVE-2018-7112 1 Hp 204 Integrated Lights-out, Integrated Lights-out 2, Integrated Lights-out 2 Firmware and 201 more 2020-08-24 4.9 MEDIUM 5.5 MEDIUM
The HPE-provided Windows firmware installer for certain Gen9, Gen8, G7,and G6 HPE servers allows local disclosure of privileged information. This issue was resolved in previously provided firmware updates as follows. The HPE Windows firmware installer was updated in the system ROM updates which also addressed the original Spectre/Meltdown set of vulnerabilities. At that time, the Windows firmware installer was also updated in the versions of HPE Integrated Lights-Out 2, 3, and 4 (iLO 2, 3, and 4) listed in the security bulletin. The updated HPE Windows firmware installer was released in the system ROM and HPE Integrated Lights-Out (iLO) releases documented in earlier HPE Security Bulletins: HPESBHF03805, HPESBHF03835, HPESBHF03831. Windows-based systems that have already been updated to the system ROM or iLO versions described in these security bulletins require no further action.
CVE-2019-6337 1 Hp 82 2dr21d, 2dr21d Firmware, D3q15a and 79 more 2020-08-24 3.3 LOW 5.2 MEDIUM
For the printers listed a maliciously crafted print file might cause certain HP Inkjet printers to assert. Under certain circumstances, the printer produces a core dump to a local device.
CVE-2019-5408 1 Hp 3 Xp7 Device Manager, Xp7 Replication Manager, Xp7 Tiered Storage Manager 2020-08-24 6.4 MEDIUM 6.5 MEDIUM
Command View Advanced Edition (CVAE) products contain a vulnerability that could expose configuration information of hosts and storage systems that are managed by Device Manager server. This problem is due to a vulnerability in Device Manager GUI. The following products are affected. DevMgr version 7.0.0-00 to earlier than 8.6.1-02 RepMgr if it is installed on the same machine as DevMgr TSMgr if it is installed on the same machine as DevMgr. The resolution is to upgrade to the fixed version as described below or later version of DevMgr 8.6.2-02 or later. RepMgr and TSMgr will be corrected by upgrading DevMgr.