CVSS: 10.0EPSS: 20%CPEs: 17EXPL: 2CVE-2008-1842 – HP OpenView Network Node Manager 7.x - 'ovspmd' Buffer Overflow
https://notcve.org/view.php?id=CVE-2008-1842
Integer signedness error in ovspmd.exe in HP OpenView Network Node Manager (OV NNM) 8.01, and 7.53 and earlier, allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code via a long request to TCP port 8886 that begins with a certain negative integer, which passes a signed comparison and triggers a heap-based buffer overflow. Error en la propiedad signedness de enteros en el archivo ovspmd.exe en HP OpenView Network Node Manager (OV NNM) versiones 8.01 y 7.53 y anteriores, permite a los atacantes remotos causar una denegación de servicio (bloqueo del demonio) o ejecutar código arbitrario por medio de una petición larga al puerto TCP 8886 que comienza con un determinado entero negativo, que pasa una comparación firmada y desencadena un desbordamiento de búfer en la región heap de la memoria. • https://www.exploit-db.com/exploits/31629 http://aluigi.altervista.org/adv/closedview-adv.txt http://aluigi.org/poc/closedview.zip http://marc.info/?l=bugtraq&m=121321155405849&w=2 http://secunia.com/advisories/29713 http://securitytracker.com/id?1019821 http://www.securityfocus.com/archive/1/493781/100/0/threaded http://www.securityfocus.com/bid/28689 http://www.vupen.com/english/advisories/2008/1159 https://exchange.xforce.ibmcloud.com/vulnerabilities/41737 • CWE-189: Numeric Errors •
CVSS: 10.0EPSS: 95%CPEs: 3EXPL: 4CVE-2008-1697 – HP OpenView Network Node Manager (OV NNM) 7.5.1 - 'OVAS.exe' Overflow (SEH)
https://notcve.org/view.php?id=CVE-2008-1697
Stack-based buffer overflow in ovwparser.dll in HP OpenView Network Node Manager (OV NNM) 7.53, 7.51, and earlier allows remote attackers to execute arbitrary code via a long URI in an HTTP request processed by ovas.exe, as demonstrated by a certain topology/homeBaseView request. NOTE: some of these details are obtained from third party information. Un desbordamiento de búfer en la región stack de la memoria en la biblioteca ovwparser.dll en HP OpenView Network Node Manager (OV NNM) versiones 7.53, 7.51 y anteriores, permite a los atacantes remotos ejecutar código arbitrario por medio de un URI largo en una petición HTTP procesada por el archivo ovas.exe, como es demostrado por una determinada petición de topology/homeBaseView. NOTA: algunos de estos datos fueron obtenidos de la información de terceros. • https://www.exploit-db.com/exploits/5342 https://www.exploit-db.com/exploits/16774 http://marc.info/?l=bugtraq&m=121553626110871&w=2 http://secunia.com/advisories/29641 http://www.offensive-security.com/0day/hp-nnm-ov.py.txt http://www.securityfocus.com/bid/28569 http://www.securitytracker.com/id?1019782 http://www.vupen.com/english/advisories/2008/1085/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41600 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 4%CPEs: 9EXPL: 0CVE-2008-0212
https://notcve.org/view.php?id=CVE-2008-0212
ovtopmd in HP OpenView Network Node Manager (OV NNM) 6.41, 7.01, and 7.51 allows remote attackers to cause a denial of service (crash) via a crafted TCP request that triggers an out-of-bounds memory access. ovtopmd en HP OpenView Network Node Manager (OV NNM) versiones 6.41, 7.01 y 7.51, permite a los atacantes remotos causar una denegación de servicio (bloqueo) por medio de una petición TCP diseñada que desencadena un acceso de memoria fuera de límites. • http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=652 http://secunia.com/advisories/28798 http://www.securityfocus.com/archive/1/487586/100/0/threaded http://www.securityfocus.com/bid/27629 http://www.securitytracker.com/id?1019306 http://www.vupen.com/english/advisories/2008/0424 • CWE-399: Resource Management Errors •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2007-6343
https://notcve.org/view.php?id=CVE-2007-6343
Cross-site scripting (XSS) vulnerability in HP OpenView Network Node Manager (OV NNM) 6.41, 7.01, and 7.51 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en HP OpenView Network Node Manager (OV NNM) 6.41, 7.01, y 7.51 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante vectores no especificados. • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01218087 http://secunia.com/advisories/27846 http://www.securityfocus.com/bid/26637 http://www.securitytracker.com/id?1019016 http://www.vupen.com/english/advisories/2007/4041 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 51%CPEs: 3EXPL: 3CVE-2007-6204 – Hewlett-Packard OpenView Network Node Manager Multiple CGI Buffer Overflow Vulnerabilities
https://notcve.org/view.php?id=CVE-2007-6204
Multiple stack-based buffer overflows in HP OpenView Network Node Manager (OV NNM) 6.41, 7.01, and 7.51 allow remote attackers to execute arbitrary code via unspecified long arguments to (1) ovlogin.exe, (2) OpenView5.exe, (3) snmpviewer.exe, and (4) webappmon.exe, as demonstrated via a long Action parameter to OpenView5.exe. Múltiples desbordamientos de búfer en la región stack de la memoria en HP OpenView Network Node Manager (OV NNM) versiones 6.41, 7.01 y 7.51, permiten a los atacantes remotos ejecutar código arbitrario por medio de argumentos largos no especificados en los archivos (1) ovlogin.exe, (2) OpenView5.exe, (3) snmpviewer.exe y (4) webappmon.exe, como es demostrado por medio de un parámetro action largo en el archivo OpenView5.exe. These vulnerabilities allow remote attackers to execute arbitrary code on vulnerable installations of Hewlett-Packard (HP) OpenView Network Node Manager (NNM). Authentication is not required to exploit these vulnerabilities. The specific flaws exists within the CGI applications that handle the management of the NNM server. Due to lack of bounds checking during a call to sprintf(), sending overly long arguments to the various CGI variables result in a classic stack overflow leading to compromise of the remote server. • https://www.exploit-db.com/exploits/16805 https://www.exploit-db.com/exploits/4724 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01188923 http://secunia.com/advisories/27964 http://securityreason.com/securityalert/3441 http://www.securityfocus.com/archive/1/484704/100/0/threaded http://www.securityfocus.com/bid/26741 http://www.securitytracker.com/id?1019055 http://www.vupen.com/english/advisories/2007/4111 http://www.zerodayinitiative.com/advisories/ZDI-07 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •