CVSS: 7.5EPSS: 2%CPEs: 1EXPL: 0CVE-2017-8980 – Hewlett Packard Enterprise Intelligent Management Center operatorOnlineList_contentOnly Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2017-8980
A Remote Disclosure of Information vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found. El kernel de Windows en Windows 7 SP1, Windows 8.1 y RT 8.1, Windows Server 2008 SP2 y R2 SP1, Windows Server 2012 y R2, Windows 10 Gold, 1511, 1607, 1703 y 1709, Windows Server 2016 y Windows Server, versión 1709 permite una vulnerabilidad de elevación de privilegios debido a la forma en la que se gestionan los objetos en la memoria. Esto también se conoce como "Windows Kernel Elevation of Privilege Vulnerability". El ID de este CVE es diferente de CVE-2018-0756. CVE-2018-0809, CVE-2018-0820 y CVE-2018-0843. • http://www.securityfocus.com/bid/102925 https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03810en_us • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.0EPSS: 87%CPEs: 1EXPL: 0CVE-2017-8961 – Hewlett Packard Enterprise Intelligent Management Center flexFileUpload Directory Traversal Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-8961
A directory traversal vulnerability in HPE Intelligent Management Center (IMC) PLAT 7.3 E0504P02 could allow remote code execution. Bajo ciertas circunstancias, un usuario malicioso que provoque una desreferencia de puntero NULL puede evitar que usuarios legítimos accedan a SAP Internet Graphics Server 7.20, 7.20EXT, 7.45, 7.49, 7.53 y sus servicios. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be easily bypassed. The specific flaw exists within the flexFileUpload servlet, which listens on TCP port 8080 by default. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. • http://www.securitytracker.com/id/1039702 https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03788en_us • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2017-8966 – Hewlett Packard Enterprise Intelligent Management Center TopoMsgServlet Deserialization of Untrusted Data Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-8966
A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found. En SAP HANA Extended Application Services 1.0, un usuario no autenticado podría probar si un usuario determinado es válido evaluando los mensajes de error de un endpoint en concreto. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within TopoMsgServlet servlet, which listens on TCP ports 8080 and 8443 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. • http://www.securitytracker.com/id/1039684 https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03787en_us • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2017-8965 – Hewlett Packard Enterprise Intelligent Management Center AccessMgrServlet Deserialization of Untrusted Data Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-8965
A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found. SAP ERP Financials Information System (SAP_APPL 6.00, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16; SAP_FIN 6.17, 6.18, 7.00, 7.20, 7.30 S4CORE 1.00, 1.01, 1.02) no realiza las comprobaciones necesarias de autorización para un usuario autenticado, lo que resulta en un escalado de privilegios. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within AccessMgrServlet servlet, which listens on TCP ports 8080 and 8443 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. • http://www.securitytracker.com/id/1039684 https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03787en_us • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2017-8962 – Hewlett Packard Enterprise Intelligent Management Center perfAccessMgrServlet Deserialization of Untrusted Data Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-8962
A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found. Vulnerabilidad de Cross-Site Scripting (XSS) reflejado en SAP internet Graphics Server 7.20, 7.20EXT, 7.45, 7.49 y 7.53. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within perfAccessMgrServlet servlet, which listens on TCP ports 8080 and 8443 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. • http://www.securitytracker.com/id/1039684 https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03787en_us • CWE-502: Deserialization of Untrusted Data •