Hp Procurve Manager vulnerabilities

6 known vulnerabilities affecting hp/procurve_manager.

Total CVEs

6

CISA KEV

1

actively exploited

Public exploits

3

Exploited in wild

1

Severity breakdown

CRITICAL4HIGH1MEDIUM1

Vulnerabilities

Page 1 of 1

CVE-2013-4813CRITICALCVSS 10.0v3.20v4.02013-09-16

CVE-2013-4813 [CRITICAL] CWE-94 CVE-2013-4813: The Agent (aka AgentController) servlet in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0 The Agent (aka AgentController) servlet in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 allows remote attackers to execute arbitrary commands via a HEAD request, aka ZDI-CAN-1745.

CVE-2013-4811CRITICALCVSS 10.0PoCv3.20v4.02013-09-16

CVE-2013-4811 [CRITICAL] CWE-20 CVE-2013-4811: UpdateDomainControllerServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and UpdateDomainControllerServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 does not properly validate the adCert argument, which allows remote attackers to upload .jsp files and consequently execute arbitrary code via unspecified vectors, aka ZDI-CAN-1743.

CVE-2013-4810CRITICALCVSS 9.8KEVPoCv3.20v4.02013-09-16

CVE-2013-4810 [CRITICAL] CVE-2013-4810: HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Ap HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet, aka ZDI-CAN-1760. NOTE: this is probably a duplicate of CVE-2007-1036, CVE-2010-0738, and/or CVE-2012-08

CVE-2013-4812CRITICALCVSS 10.0PoCv3.20v4.02013-09-16

CVE-2013-4812 [CRITICAL] CWE-20 CVE-2013-4812: UpdateCertificatesServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, UpdateCertificatesServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 does not properly validate the fileName argument, which allows remote attackers to upload .jsp files and consequently execute arbitrary code via unspecified vectors, aka ZDI-CAN-1743.

CVE-2013-4809HIGHCVSS 7.5v3.20v4.02013-09-16

CVE-2013-4809 [HIGH] CWE-89 CVE-2013-4809: Multiple SQL injection vulnerabilities in GetEventsServlet in HP ProCurve Manager (PCM) 3.20 and 4.0 Multiple SQL injection vulnerabilities in GetEventsServlet in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 allow remote attackers to execute arbitrary SQL commands via the (1) sort or (2) dir parameter.

CVE-2007-4514MEDIUMCVSS 5.0≤ 2.3v1.6+4 more2009-04-15

CVE-2007-4514 [MEDIUM] CWE-200 CVE-2007-4514: Unspecified vulnerability in HP ProCurve Manager and HP ProCurve Manager Plus 2.3 and earlier allows Unspecified vulnerability in HP ProCurve Manager and HP ProCurve Manager Plus 2.3 and earlier allows remote attackers to obtain sensitive information from the ProCurve Manager server via unknown attack vectors.