CVSS: 10.0EPSS: 96%CPEs: 9EXPL: 2CVE-2013-4835 – HP SiteScope issueSiebelCmd SOAP Request Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2013-4835
The APISiteScopeImpl SOAP service in HP SiteScope 10.1x and 11.x before 11.22 allows remote attackers to bypass authentication and execute arbitrary code via a direct request to the issueSiebelCmd method, aka ZDI-CAN-1765. El servicio SOAP de APISiteScopeImpl en HP SiteScope versiones 10.1x y versiones 11.x anteriores a 11.22, permite a los atacantes remotos omitir la autenticación y ejecutar código arbitrario mediante una petición directa al método issueSiebelCmd, también conocido como ZDI-CAN-1765. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP SiteScope. Authentication is not required to exploit this vulnerability. The specific flaw exists within the issueSiebelCmd() web method. A remote attacker can abuse this web method in order to remotely execute code under the context of the SYSTEM user. • https://www.exploit-db.com/exploits/30473 http://www.exploit-db.com/exploits/30473 https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03969435 https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c03969435 •
CVSS: 10.0EPSS: 96%CPEs: 2EXPL: 1CVE-2013-2367 – Hewlett-Packard SiteScope SOAP Call runOMAgentCommand Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2013-2367
Multiple unspecified vulnerabilities in HP SiteScope 11.20 and 11.21, when SOAP is used, allow remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1678. Múltiples vulnerabilidades sin especificar en HP SiteScope 11.20 y 11.21, cuando SOAP es usado, permite a atacantes remotos ejecutar código arbitrario a través de vectores desconocidos. Aka ZDI-CAN-1678. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP SiteScope. Authentication is not required to exploit this vulnerability. The specific flaw exists within APIBSMIntegrationImpl's processing of the runOMAgentCommand which can be invoked through SOAP requests without prior authentication. • https://www.exploit-db.com/exploits/28188 https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03861260 •