Hp vulnerabilities
Published CVEs affecting Hp products: 95 record(s), with severity, exploitation and fixes.
Linux Imaging And Printing 12Probook 440 G8 Firmware 11Pc Bios 11Support Assistant 10HP Linux Imaging and Printing Software (HPLIP) 10Prodesk 405 G6 Small Form Factor Firmware 6Elitebook 830 G6 Firmware 5Mp9 G4 Retail System Firmware 5Elite Dragonfly Firmware 5Elite X2 1013 G3 Firmware 5Engage Flex Mini Retail System Firmware 5Z6 G4 Workstation Firmware 5Elite Dragonfly Max Firmware 5Elite X2 G4 Firmware 5Elite Dragonfly G2 Firmware 5Z8 G4 Workstation Firmware 5Z4 G4 Workstation (core-x) Firmware 5Z1 G8 Tower Desktop Pc Firmware 5260 G3 Desktop Mini Pc Firmware 5Elitedesk 800 35w G4 Desktop Mini Pc Firmware 5Elitedesk 800 65w G4 Desktop Mini Pc Firmware 5Elitedesk 800 95w G4 Desktop Mini Pc Firmware 5Elitedesk 800 G4 Small Form Factor Pc Firmware 5Elitedesk 800 G4 Tower Pc Firmware 5Elitedesk 800 G4 Workstation Edition Firmware 5Elitedesk 800 G5 Desktop Mini Pc Firmware 5Elitedesk 800 G5 Small Form Factor Pc Firmware 5Elitedesk 800 G5 Tower Pc Firmware 5Elitedesk 800 G6 Desktop Mini Pc Firmware 5Elitedesk 800 G6 Small Form Factor Pc Firmware 5Elitedesk 800 G6 Tower Pc Firmware 5Elitedesk 800 G8 Desktop Mini Pc Firmware 5Elitedesk 800 G8 Small Form Factor Pc Firmware 5Elitedesk 800 G8 Tower Pc Firmware 5Elitedesk 805 G6 Desktop Mini Pc Firmware 5Elitedesk 805 G6 Small Form Factor Pc Firmware 5Elitedesk 805 G8 Desktop Mini Pc Firmware 5Elitedesk 805 G8 Small Form Factor Pc Firmware 5Elitedesk 880 G4 Tower Pc Firmware 5Elitedesk 880 G5 Tower Pc Firmware 5
CVE-2021-39299
High · 8.8
CWE-269 Feb 16, 2022
Improper Privilege Management in Hp Elite Dragonfly Firmware
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.
CVE-2021-39298
High · 8.8
CWE-269 Feb 16, 2022
Improper Privilege Management in Hp Z1 Entry Tower G5 Workstation Firmware
A potential vulnerability in AMD System Management Mode (SMM) interrupt handler may allow an attacker with high privileges to access the SMM resulting in arbitrary code execution which could be used by malicious actors to bypass security mechanisms provided in the UEFI firmware.
CVE-2021-39297
High · 8.8
CWE-269 Feb 16, 2022
Improper Privilege Management in Hp 260 G3 Desktop Mini Pc Firmware
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.
CVE-2020-6922
High · 7.8
Feb 16, 2022
Potential security vulnerabilities including compromise of integrity, and allowed…
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
CVE-2020-6921
High · 7.8
Feb 16, 2022
Potential security vulnerabilities including compromise of integrity, and allowed…
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
CVE-2020-6920
Medium · 5.5
Feb 16, 2022
Potential security vulnerabilities including compromise of integrity, and allowed…
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
CVE-2020-6919
High · 7.8
Feb 16, 2022
Potential security vulnerabilities including compromise of integrity, and allowed…
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
CVE-2020-6918
High · 7.8
Feb 16, 2022
Potential security vulnerabilities including compromise of integrity, and allowed…
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
CVE-2020-6917
High · 7.8
Feb 16, 2022
Potential security vulnerabilities including compromise of integrity, and allowed…
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
CVE-2022-23456
Medium · 5.5
Jan 28, 2022
Potential arbitrary file deletion vulnerability has been identified in HP Support…
Potential arbitrary file deletion vulnerability has been identified in HP Support Assistant software.
CVE-2017-5638
Critical · 9.8
KEV Urgent · 93 Public exploit Ransomware CWE-755 Mar 10, 2017
Apache Struts Remote Code Execution Vulnerability
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
CVE-2016-5388
High · 8.1
CWE-284 Jul 18, 2016
Improper Access Control in Apache Tomcat
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.
CVE-2016-3092
High · 7.5
CWE-20 Jul 4, 2016
Improper Input Validation in Hp Icewall Identity Manager
The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.
CVE-2015-8651
High · 8.8
KEV High · 66 CWE-190 Dec 28, 2015
Adobe Flash Player Integer Overflow Vulnerability
Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors.
CVE-2015-5477
High · 7.5
KEV Urgent · 79 Public exploit CWE-19 Jul 29, 2015
ISC BIND Data Processing Errors Vulnerability
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.
CVE-2015-3113
Critical · 9.8
KEV Urgent · 90 Public exploit CWE-787 Jun 23, 2015
Adobe Flash Player Heap-Based Buffer Overflow Vulnerability
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015.
CVE-2013-4810
Critical · 9.8
KEV Urgent · 71 Public exploit CWE-94 Sep 16, 2013
HP Multiple Products Remote Code Execution Vulnerability
HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet, aka ZDI-CAN-1760. NOTE: this is probably a duplicate of CVE-2007-1036, CVE-2010-0738, and/or CVE-2012-0874.
CVE-2012-1823
Critical · 9.8
KEV Urgent · 83 Public exploit CWE-77 May 11, 2012
PHP-CGI Query String Parameter Vulnerability
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
CVE-2005-2773
Critical · 9.8
KEV Urgent · 83 Public exploit CWE-77 Sep 2, 2005
HP OpenView Network Node Manager Remote Code Execution Vulnerability
HP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) node parameter to connectedNodes.ovpl, (2) cdpView.ovpl, (3) freeIPaddrs.ovpl, and (4) ecscmg.ovpl.
CVE-2000-0515
High · 10.0
Public exploit Jun 7, 2000
The snmpd.conf configuration file for the SNMP daemon (snmpd) in HP-UX 11.0 is world…
The snmpd.conf configuration file for the SNMP daemon (snmpd) in HP-UX 11.0 is world writable, which allows local users to modify SNMP configuration or gain privileges.