CVSS: 10.0EPSS: 77%CPEs: 1EXPL: 0CVE-2017-8975 – Hewlett Packard Enterprise Moonshot Provisioning Manager Appliance khuploadfile Directory Traversal Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-8975
A Remote Code Execution vulnerability in Hewlett Packard Enterprise Moonshot Provisioning Manager Appliance version v1.20 was found. El proveedor de servicios SAML 2.0 de SAP Netweaver AS Java Web Application 7.50 no codifica lo suficiente las entradas controladas por el usuario, lo que resulta en una vulnerabilidad de Cross-Site Scripting (XSS). This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Moonshot Provisioning Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the khuploadfile.cgi file. The issue results from the lack of proper validation of user-supplied data, which can allow for the upload of arbitrary files. • http://www.securityfocus.com/bid/102410 https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03803en_us • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 77%CPEs: 1EXPL: 0CVE-2017-8976 – Hewlett Packard Enterprise Moonshot Provisioning Manager Appliance khuploadfile Directory Traversal Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-8976
A Remote Code Execution vulnerability in Hewlett Packard Enterprise Moonshot Provisioning Manager Appliance version v1.20 was found. Vulnerabilidad de Server Side Request Forgery (SSRF) en SAP Central Management Console, BI Launchpad y Fiori BI Launchpad, 4.10, de 4.20 y de 4.30, podría permitir que un usuario malicioso emplee técnicas comunes para determinar qué puertos están en uso en el servidor backend. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Moonshot Provisioning Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the khuploadfile.cgi file. The issue results from the lack of proper validation of user-supplied data, which can allow for the upload of arbitrary files. • http://www.securityfocus.com/bid/102410 https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03803en_us • CWE-20: Improper Input Validation •
CVSS: 9.1EPSS: 7%CPEs: 1EXPL: 0CVE-2017-8977 – Hewlett Packard Enterprise Moonshot Provisioning Manager Appliance server_response Directory Traversal Denial Of Service Vulnerability
https://notcve.org/view.php?id=CVE-2017-8977
A Remote Denial of Service vulnerability in Hewlett Packard Enterprise Moonshot Provisioning Manager Appliance version v1.20 was found. Bajo ciertas condiciones, SAP HANA 1.00 y 2.00 permite que un atacante no autenticado acceda a información que, de otra forma, estaría restringida. Un atacante puede emplear erróneamente la función de autenticación del servidor de SAP HANA en su interfaz de SQL y revelar 8 bytes de la memoria del proceso del servidor. El atacante no puede influenciar o predecir la ubicación de la memoria filtrada. This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of Hewlett Packard Enterprise Moonshot Provisioning Manager. • http://www.securityfocus.com/bid/102410 https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03803en_us • CWE-20: Improper Input Validation •