Hp Identity Driven Manager vulnerabilities
4 known vulnerabilities affecting hp/identity_driven_manager.
Total CVEs
4
CISA KEV
0
Public exploits
2
Exploited in wild
0
Severity breakdown
CRITICAL3HIGH1
Vulnerabilities
Page 1 of 1
CVE-2013-4813CRITICALCVSS 10.0v4.02013-09-16
CVE-2013-4813 [CRITICAL] CWE-94 CVE-2013-4813: The Agent (aka AgentController) servlet in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0
The Agent (aka AgentController) servlet in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 allows remote attackers to execute arbitrary commands via a HEAD request, aka ZDI-CAN-1745.
nvd
CVE-2013-4811CRITICALCVSS 10.0PoCv4.02013-09-16
CVE-2013-4811 [CRITICAL] CWE-20 CVE-2013-4811: UpdateDomainControllerServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and
UpdateDomainControllerServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 does not properly validate the adCert argument, which allows remote attackers to upload .jsp files and consequently execute arbitrary code via unspecified vectors, aka ZDI-CAN-1743.
nvd
CVE-2013-4812CRITICALCVSS 10.0PoCv4.02013-09-16
CVE-2013-4812 [CRITICAL] CWE-20 CVE-2013-4812: UpdateCertificatesServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0,
UpdateCertificatesServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 does not properly validate the fileName argument, which allows remote attackers to upload .jsp files and consequently execute arbitrary code via unspecified vectors, aka ZDI-CAN-1743.
nvd
CVE-2013-4809HIGHCVSS 7.5v4.02013-09-16
CVE-2013-4809 [HIGH] CWE-89 CVE-2013-4809: Multiple SQL injection vulnerabilities in GetEventsServlet in HP ProCurve Manager (PCM) 3.20 and 4.0
Multiple SQL injection vulnerabilities in GetEventsServlet in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 allow remote attackers to execute arbitrary SQL commands via the (1) sort or (2) dir parameter.
nvd