Hp Procurve Manager vulnerabilities
6 known vulnerabilities affecting hp/procurve_manager.
Total CVEs
6
CISA KEV
1
actively exploited
Public exploits
3
Exploited in wild
1
Severity breakdown
CRITICAL4HIGH1MEDIUM1
Vulnerabilities
Page 1 of 1
CVE-2013-4810P1CRITICALCVSS 9.8KEVPoCRansomwarev3.20v4.02013-09-16
CVE-2013-4810 [CRITICAL] CVE-2013-4810: HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Ap
HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet, aka ZDI-CAN-1760. NOTE: this is probably a duplicate of CVE-2007-1036, CVE-2010-0738, and/or CVE-2012-08
nvd
CVE-2013-4811P1CRITICALCVSS 10.0PoCv3.20v4.02013-09-16
CVE-2013-4811 [CRITICAL] CWE-20 CVE-2013-4811: UpdateDomainControllerServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and
UpdateDomainControllerServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 does not properly validate the adCert argument, which allows remote attackers to upload .jsp files and consequently execute arbitrary code via unspecified vectors, aka ZDI-CAN-1743.
nvd
CVE-2013-4812P2CRITICALCVSS 10.0PoCv3.20v4.02013-09-16
CVE-2013-4812 [CRITICAL] CWE-20 CVE-2013-4812: UpdateCertificatesServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0,
UpdateCertificatesServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 does not properly validate the fileName argument, which allows remote attackers to upload .jsp files and consequently execute arbitrary code via unspecified vectors, aka ZDI-CAN-1743.
nvd
CVE-2013-4813P2CRITICALCVSS 10.0v3.20v4.02013-09-16
CVE-2013-4813 [CRITICAL] CWE-94 CVE-2013-4813: The Agent (aka AgentController) servlet in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0
The Agent (aka AgentController) servlet in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 allows remote attackers to execute arbitrary commands via a HEAD request, aka ZDI-CAN-1745.
nvd
CVE-2013-4809P3HIGHCVSS 7.5v3.20v4.02013-09-16
CVE-2013-4809 [HIGH] CWE-89 CVE-2013-4809: Multiple SQL injection vulnerabilities in GetEventsServlet in HP ProCurve Manager (PCM) 3.20 and 4.0
Multiple SQL injection vulnerabilities in GetEventsServlet in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 allow remote attackers to execute arbitrary SQL commands via the (1) sort or (2) dir parameter.
nvd
CVE-2007-4514P4MEDIUMCVSS 5.0≤ 2.3v1.6+4 more2009-04-15
CVE-2007-4514 [MEDIUM] CWE-200 CVE-2007-4514: Unspecified vulnerability in HP ProCurve Manager and HP ProCurve Manager Plus 2.3 and earlier allows
Unspecified vulnerability in HP ProCurve Manager and HP ProCurve Manager Plus 2.3 and earlier allows remote attackers to obtain sensitive information from the ProCurve Manager server via unknown attack vectors.
nvd