CVSS: 9.0EPSS: 87%CPEs: 1EXPL: 0CVE-2017-8961 – Hewlett Packard Enterprise Intelligent Management Center flexFileUpload Directory Traversal Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-8961
A directory traversal vulnerability in HPE Intelligent Management Center (IMC) PLAT 7.3 E0504P02 could allow remote code execution. Bajo ciertas circunstancias, un usuario malicioso que provoque una desreferencia de puntero NULL puede evitar que usuarios legítimos accedan a SAP Internet Graphics Server 7.20, 7.20EXT, 7.45, 7.49, 7.53 y sus servicios. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be easily bypassed. The specific flaw exists within the flexFileUpload servlet, which listens on TCP port 8080 by default. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. • http://www.securitytracker.com/id/1039702 https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03788en_us • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2017-8966 – Hewlett Packard Enterprise Intelligent Management Center TopoMsgServlet Deserialization of Untrusted Data Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-8966
A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found. En SAP HANA Extended Application Services 1.0, un usuario no autenticado podría probar si un usuario determinado es válido evaluando los mensajes de error de un endpoint en concreto. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within TopoMsgServlet servlet, which listens on TCP ports 8080 and 8443 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. • http://www.securitytracker.com/id/1039684 https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03787en_us • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2017-8965 – Hewlett Packard Enterprise Intelligent Management Center AccessMgrServlet Deserialization of Untrusted Data Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-8965
A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found. SAP ERP Financials Information System (SAP_APPL 6.00, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16; SAP_FIN 6.17, 6.18, 7.00, 7.20, 7.30 S4CORE 1.00, 1.01, 1.02) no realiza las comprobaciones necesarias de autorización para un usuario autenticado, lo que resulta en un escalado de privilegios. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within AccessMgrServlet servlet, which listens on TCP ports 8080 and 8443 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. • http://www.securitytracker.com/id/1039684 https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03787en_us • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2017-8962 – Hewlett Packard Enterprise Intelligent Management Center perfAccessMgrServlet Deserialization of Untrusted Data Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-8962
A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found. Vulnerabilidad de Cross-Site Scripting (XSS) reflejado en SAP internet Graphics Server 7.20, 7.20EXT, 7.45, 7.49 y 7.53. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within perfAccessMgrServlet servlet, which listens on TCP ports 8080 and 8443 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. • http://www.securitytracker.com/id/1039684 https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03787en_us • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2017-8964 – Hewlett Packard Enterprise Intelligent Management Center TopoBroadcastServlet Deserialization of Untrusted Data Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-8964
A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found. Se ha encontrado una vulnerabilidad de deserialización de datos no fiables en Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT 7.3 E0504P2. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within TopoBroadcastServlet servlet, which listens on TCP ports 8080 and 8443 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. • http://www.securitytracker.com/id/1039684 https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03787en_us • CWE-502: Deserialization of Untrusted Data •