Overview 813 matches · 22 in Waratek scope · 20 protected · 0 exploited · 0 CISA KEV · 53 public PoC · 6 EPSS ≥ 0.5
813matches
22in Waratek scope2.7%
20protected2.5%
0exploited0.0%
0CISA KEV0.0%
53public PoC6.5%
6EPSS ≥ 0.50.7%
Protected by Waratek
20
2.5%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
2
0.2%
Outside Waratek scope
16
2.0%
Not applicable
775
95.3%
Withdrawn CVE
0
0.0%
blocked by ARMR today
20
2.5%
partly blocked
0
0.0%
not blocked
793
97.5%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 100 / year
19931
Not applicable1
Medium1
not blocked1
No public exploit1
19945
Not applicable5
Medium5
not blocked5
No public exploit5
19950
19963
Not applicable3
Medium3
not blocked3
No public exploit3
199713
Not applicable13
Medium13
not blocked13
Working exploit published2
No public exploit11
19985
Not applicable5
Medium5
not blocked5
Working exploit published1
No public exploit4
19998
Not applicable8
Medium8
not blocked8
No public exploit8
200021
Not applicable21
Medium21
not blocked21
Working exploit published6
No public exploit15
200112
Not applicable12
Medium12
not blocked12
Working exploit published2
No public exploit10
200223
Not applicable23
Medium23
not blocked23
No public exploit23
200312
Not applicable12
Medium12
not blocked12
Working exploit published2
No public exploit10
200414
Not applicable14
Medium14
not blocked14
Working exploit published2
No public exploit12
20058
Not applicable8
Medium8
not blocked8
No public exploit8
200619
Not applicable19
Medium19
not blocked19
Working exploit published3
No public exploit16
200727
Not applicable27
Medium27
not blocked27
Working exploit published7
No public exploit20
200822
Not applicable22
Medium22
not blocked22
Working exploit published2
No public exploit20
200921
Not applicable21
Medium21
not blocked21
Working exploit published2
No public exploit19
201074
Not applicable74
Medium74
not blocked74
Working exploit published3
No public exploit71
201161
Not applicable61
Medium61
not blocked61
Working exploit published4
No public exploit57
201233
Not applicable33
Medium33
not blocked33
Working exploit published2
No public exploit31
201352
No exploit published1
Not applicable51
Medium52
not blocked52
Working exploit published2
No public exploit50
201440
Outside Waratek scope6
Not applicable34
Medium40
not blocked40
Working exploit published3
No public exploit37
201552
Not applicable52
Medium52
not blocked52
Working exploit published2
No public exploit50
201622
Outside Waratek scope1
Not applicable21
Medium22
not blocked22
Working exploit published1
Forecast only2
No public exploit19
201714
Not applicable14
Medium14
not blocked14
No public exploit14
2018100
Protected by Waratek16
No exploit published1
Outside Waratek scope7
Not applicable76
Medium100
blocked by ARMR today16
not blocked84
Working exploit published3
No public exploit97
201937
Protected by Waratek4
Outside Waratek scope1
Not applicable32
Medium37
blocked by ARMR today4
not blocked33
Working exploit published1
No public exploit36
202018
Outside Waratek scope1
Not applicable17
Medium18
not blocked18
Proof of concept only1
No public exploit17
202117
Not applicable17
Medium17
not blocked17
Working exploit published1
No public exploit16
202215
Not applicable15
Medium15
not blocked15
No public exploit15
202315
Not applicable15
Medium15
not blocked15
No public exploit15
202419
Not applicable19
Medium19
not blocked19
Proof of concept only1
No public exploit18
202522
Not applicable22
Medium22
not blocked22
No public exploit22
20268
Not applicable8
Medium8
not blocked8
No public exploit8
199319961999200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-91103 | Medium | 2026-09-16 | Not applicable | No public exploit | HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions. |
| CVE-2026-91101 | Medium | 2026-09-16 | Not applicable | No public exploit | HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions. |
| CVE-2026-91100 | Medium | 2026-09-16 | Not applicable | No public exploit | HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions. |
| CVE-2026-91099 | Medium | 2026-09-16 | Not applicable | No public exploit | HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions. |
| CVE-2026-3291 | Medium | 2026-05-06 | Not applicable | No public exploit | Samsung Print Service Plugin for Android is potentially vulnerable to information disclosure when using an outdated version of the application via mobile devices. HP is releasing updates to mitigate these potential vulnerabilities. |
| CVE-2026-2915 | Medium | 2026-03-03 | Not applicable | No public exploit | HP System Event Utility might allow denial of service with elevated arbitrary file writes. This potential vulnerability was remediated with HP System Event Utility version 3.2.16. |
| CVE-2026-1997 | Medium | 2026-02-10 | Not applicable | No public exploit | Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web origins to access device resource. CORS is disabled by default on Pro‑class devices and can only be enabled by an administrator through the Embedded Web Server (EWS). Keeping CORS disabled unless explicitly required helps ensure that only trusted solutions can interact with the device. |
| CVE-2026-1996 | Medium | 2026-02-10 | Not applicable | No public exploit | Certain HP OfficeJet Pro printers may be vulnerable to potential denial of service when the IPP requests are mishandled, failing to establish a TCP connection. |
| CVE-2025-11531 | Medium | 2025-12-09 | Not applicable | No public exploit | HP System Event Utility and Omen Gaming Hub might allow execution of certain files outside of their restricted paths. This potential vulnerability was remediated with HP System Event Utility version 3.2.12 and Omen Gaming Hub version 1101.2511.101.0. |
| CVE-2025-13492 | Medium | 2025-12-03 | Not applicable | No public exploit | A potential security vulnerability has been identified in HP Image Assistant for versions prior to 5.3.3. The vulnerability could potentially allow a local attacker to escalate privileges via a race condition when installing packages. |
| CVE-2025-12785 | Medium | 2025-11-13 | Not applicable | No public exploit | Certain HP LaserJet Pro printers may be vulnerable to information disclosure leading to credential exposure by altering the scan/send destination address and/or modifying the LDAP Server. |
| CVE-2025-12784 | Medium | 2025-11-13 | Not applicable | No public exploit | Certain HP LaserJet Pro printers may be vulnerable to information disclosure leading to credential exposure by altering the scan/send destination address and/or modifying the LDAP Server. |
| CVE-2025-43024 | Medium | 2025-10-28 | Not applicable | No public exploit | A GUI dialog of an application allows to view what files are in the file system without proper authorization. |
| CVE-2025-10578 | Medium | 2025-10-01 | Not applicable | No public exploit | A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.47.41.0. The vulnerability could potentially allow a local attacker to escalate privileges via an arbitrary file write. |
| CVE-2025-43018 | Medium | 2025-07-30 | Not applicable | No public exploit | Certain HP LaserJet Pro printers may be vulnerable to information disclosure when a non-authenticated user queries a device’s local address book. |
| CVE-2025-43023 | Medium | 2025-07-28 | Not applicable | No public exploit | A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software documentation. This potential vulnerability is due to the use of a weak code signing key, Digital Signature Algorithm (DSA). |
| CVE-2025-3508 | Medium | 2025-07-25 | Not applicable | No public exploit | Certain HP DesignJet products may be vulnerable to information disclosure though printer's web interface allowing unauthenticated users to view sensitive print job information. |
| CVE-2025-43487 | Medium | 2025-07-23 | Not applicable | No public exploit | A potential privilege escalation through Sudo vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The firmware flaw does not properly implement access controls. HP has addressed the issue in the latest software update. |
| CVE-2025-43486 | Medium | 2025-07-23 | Not applicable | No public exploit | A potential stored cross-site scripting vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The website allows user input to be stored and rendered without proper sanitization. HP has addressed the issue in the latest software update. |
| CVE-2025-43485 | Medium | 2025-07-23 | Not applicable | No public exploit | A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The vulnerability could potentially allow a privileged user to retrieve credentials from the log files. HP has addressed the issue in the latest software update. |
| CVE-2025-43484 | Medium | 2025-07-23 | Not applicable | No public exploit | A potential reflected cross-site scripting vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The website does not validate or sanitize the user input before rendering it in the response. HP has addressed the issue in the latest software update. |
| CVE-2025-43483 | Medium | 2025-07-23 | Not applicable | No public exploit | A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vulnerability could allow the retrieval of hardcoded cryptographic keys. HP has addressed the issue in the latest software update. |
| CVE-2025-43021 | Medium | 2025-07-22 | Not applicable | No public exploit | A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vulnerability could allow the use and retrieval of the default password. HP has addressed the issue in the latest software update. |
| CVE-2025-43020 | Medium | 2025-07-22 | Not applicable | No public exploit | A potential command injection vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The vulnerability could allow a privileged user to submit arbitrary input. HP has addressed the issue in the latest software update. |
| CVE-2025-43019 | Medium | 2025-07-08 | Not applicable | No public exploit | A potential security vulnerability has been identified in the HP Support Assistant, which allows a local attacker to escalate privileges via an arbitrary file deletion. |
| CVE-2025-43025 | Medium | 2025-07-02 | Not applicable | No public exploit | HP Universal Print Driver is potentially vulnerable to denial of service due to buffer overflow in versions of UPD 7.4 or older (e.g., v7.3.x, v7.2.x, v7.1.x, etc.). |
| CVE-2025-1697 | Medium | 2025-04-18 | Not applicable | No public exploit | A potential security vulnerability has been identified in the HP Touchpoint Analytics Service for certain HP PC products with versions prior to 4.2.2439. This vulnerability could potentially allow a local attacker to escalate privileges. HP is providing software updates to mitigate this potential vulnerability. |
| CVE-2025-2268 | Medium | 2025-03-14 | Not applicable | No public exploit | The HP LaserJet MFP M232-M237 Printer Series may be vulnerable to a denial of service attack when a specially crafted request message is sent via Internet Printing Protocol (IPP). |
| CVE-2025-26507 | Medium | 2025-02-14 | Not applicable | No public exploit | Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers may potentially be vulnerable to Remote Code Execution and Elevation of Privilege when processing a PostScript print job. |
| CVE-2025-1004 | Medium | 2025-02-06 | Not applicable | No public exploit | Certain HP LaserJet Pro printers may potentially experience a denial of service when a user sends a raw JPEG file to the printer via IPP (Internet Printing Protocol). |
| CVE-2024-9423 | Medium | 2024-10-02 | Not applicable | No public exploit | Certain HP LaserJet printers may potentially experience a denial of service when a user sends a raw JPEG file to the printer. The printer displays a “JPEG Unsupported” message which may not clear, potentially blocking queued print jobs. |
| CVE-2024-42400 | Medium | 2024-08-06 | Not applicable | No public exploit | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point. |
| CVE-2024-42399 | Medium | 2024-08-06 | Not applicable | No public exploit | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point. |
| CVE-2024-42398 | Medium | 2024-08-06 | Not applicable | No public exploit | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point. |
| CVE-2024-42397 | Medium | 2024-08-06 | Not applicable | No public exploit | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point. |
| CVE-2024-42396 | Medium | 2024-08-06 | Not applicable | No public exploit | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point. |
| CVE-2024-41911 | Medium | 2024-08-06 | Not applicable | No public exploit | A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The flaw does not properly neutralize input during a web page generation. |
| CVE-2024-41910 | Medium | 2024-08-06 | Not applicable | No public exploit | A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware contained multiple XSS vulnerabilities in the version of JavaScript used. |
| CVE-2022-37020 | Medium | 2024-06-10 | Not applicable | No public exploit | Potential vulnerabilities have been identified in the system BIOS for certain HP PC products, which might allow escalation of privileges and code execution. HP is releasing firmware updates to mitigate the potential vulnerabilities. |
| CVE-2022-37019 | Medium | 2024-06-10 | Not applicable | No public exploit | Potential vulnerabilities have been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and code execution. HP is releasing firmware updates to mitigate the potential vulnerabilities. |
| CVE-2024-5143 | Medium | 2024-05-23 | Not applicable | No public exploit | A user with device administrative privileges can change existing SMTP server settings on the device, without having to re-enter SMTP server credentials. By redirecting send-to-email traffic to the new server, the original SMTP server credentials may potentially be exposed. |
| CVE-2024-31483 | Medium | 2024-05-14 | Not applicable | No public exploit | An authenticated sensitive information disclosure vulnerability exists in the CLI service accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to read arbitrary files in the underlying operating system. |
| CVE-2024-27460 | Medium | 2024-05-14 | Not applicable | Proof of concept only | A privilege escalation exists in the updater for Plantronics Hub 3.25.1 and below. |
| CVE-2024-2209 | Medium | 2024-03-27 | Not applicable | No public exploit | A user with administrative privileges can create a compromised dll file of the same name as the original dll within the HP printer’s Firmware Update Utility (FUU) bundle and place it in the Microsoft Windows default downloads directory which can lead to potential arbitrary code execution. |
| CVE-2023-4063 | Medium | 2024-03-22 | Not applicable | No public exploit | Certain HP OfficeJet Pro printers are potentially vulnerable to a Denial of Service when using an improper eSCL URL GET request. |
| CVE-2024-0407 | Medium | 2024-02-21 | Not applicable | No public exploit | Certain HP Enterprise LaserJet, and HP LaserJet Managed Printers are potentially vulnerable to information disclosure, when connections made by the device back to services enabled by some solutions may have been trusted without the appropriate CA certificate in the device's certificate store. |
| CVE-2022-48220 | Medium | 2024-02-14 | Not applicable | No public exploit | Potential vulnerabilities have been identified in certain HP Desktop PC products using the HP TamperLock feature, which might allow intrusion detection bypass via a physical attack. HP is releasing firmware and guidance to mitigate these potential vulnerabilities. |
| CVE-2022-48219 | Medium | 2024-02-14 | Not applicable | No public exploit | Potential vulnerabilities have been identified in certain HP Desktop PC products using the HP TamperLock feature, which might allow intrusion detection bypass via a physical attack. HP is releasing firmware and guidance to mitigate these potential vulnerabilities. |
| CVE-2023-6573 | Medium | 2024-01-23 | Not applicable | No public exploit | HPE OneView may have a missing passphrase during restore. |
| CVE-2023-45627 | Medium | 2023-11-14 | Not applicable | No public exploit | An authenticated Denial-of-Service (DoS) vulnerability exists in the CLI service. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected access point. |
| CVE-2023-5409 | Medium | 2023-10-13 | Not applicable | No public exploit | HP is aware of a potential security vulnerability in HP t430 and t638 Thin Client PCs. These models may be susceptible to a physical attack, allowing an untrusted source to tamper with the system firmware using a publicly disclosed private key. HP is providing recommended guidance for customers to reduce exposure to the potential vulnerability. |
| CVE-2023-5113 | Medium | 2023-10-04 | Not applicable | No public exploit | Certain HP Enterprise LaserJet and HP LaserJet Managed Printers are potentially vulnerable to denial of service due to WS-Print request and potential injections of Cross Site Scripting via jQuery-UI. |
| CVE-2015-1390 | Medium | 2023-09-05 | Not applicable | No public exploit | Aruba AirWave before 8.0.7 allows XSS attacks agsinat an administrator. |
| CVE-2023-30903 | Medium | 2023-06-16 | Not applicable | No public exploit | HP-UX could be exploited locally to create a Denial of Service (DoS) when any physical interface is configured with IPv6/inet6. |
| CVE-2023-22791 | Medium | 2023-05-08 | Not applicable | No public exploit | A vulnerability exists in Aruba InstantOS and ArubaOS 10 where an edge-case combination of network configuration, a specific WLAN environment and an attacker already possessing valid user credentials on that WLAN can lead to sensitive information being disclosed via the WLAN. The scenarios in which this disclosure of potentially sensitive information can occur are complex and depend on factors that are beyond the control of the attacker. |
| CVE-2023-28092 | Medium | 2023-05-01 | Not applicable | No public exploit | A potential security vulnerability has been identified in HPE ProLiant RL300 Gen11 Server. The vulnerability could result in the system being vulnerable to exploits by attackers with physical access inside the server chassis. |
| CVE-2023-1526 | Medium | 2023-04-28 | Not applicable | No public exploit | Certain DesignJet and PageWide XL TAA compliant models may have risk of potential information disclosure if the hard disk drive is physically removed from the printer. |
| CVE-2022-31643 | Medium | 2023-04-28 | Not applicable | No public exploit | A potential security vulnerability has been identified in the system BIOS for certain HP PC products which may allow loss of integrity. HP is releasing firmware updates to mitigate the potential vulnerability. |
| CVE-2023-28090 | Medium | 2023-04-25 | Not applicable | No public exploit | An HPE OneView appliance dump may expose SNMPv3 read credentials |
| CVE-2023-28087 | Medium | 2023-04-25 | Not applicable | No public exploit | An HPE OneView appliance dump may expose OneView user accounts |
| CVE-2023-28086 | Medium | 2023-04-25 | Not applicable | No public exploit | An HPE OneView appliance dump may expose proxy credential settings |
| CVE-2023-28084 | Medium | 2023-04-25 | Not applicable | No public exploit | HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens |
| CVE-2023-28091 | Medium | 2023-04-14 | Not applicable | No public exploit | HPE OneView virtual appliance "Migrate server hardware" option may expose sensitive information in an HPE OneView support dump |
| CVE-2022-37935 | Medium | 2023-03-01 | Not applicable | No public exploit | HPE OneView for VMware vCenter, in certain circumstances, may disclose the “HPE OneView” Username and Password. |
| CVE-2021-46846 | Medium | 2022-12-12 | Not applicable | No public exploit | Cross Site Scripting vulnerability in Hewlett Packard Enterprise Integrated Lights-Out 5. |
| CVE-2022-1602 | Medium | 2022-09-13 | Not applicable | No public exploit | A potential security vulnerability has been identified in HP ThinPro 7.2 Service Pack 8 (SP8). The security vulnerability in SP8 is not remedied after upgrading from SP8 to Service Pack 9 (SP9). HP has released Service Pack 10 (SP10) to remediate the potential vulnerability introduced in SP8. |
| CVE-2022-23678 | Medium | 2022-09-06 | Not applicable | No public exploit | A vulnerability in the Aruba Virtual Intranet Access (VIA) client for Microsoft Windows operating system client communications that could allow for an attacker in a privileged network position to intercept sensitive information in Aruba Virtual Intranet Access (VIA) client for Microsoft Windows operating system versions: 4.3.0 build 2208101 and below. Aruba has released upgrades for Virtual Intranet Access (VIA) Client that address this security vulnerability. |
| CVE-2022-28625 | Medium | 2022-08-31 | Not applicable | No public exploit | A local disclosure of sensitive information vulnerability was discovered in HPE OneView version(s): Prior to 7.0 or 6.60.01. A low privileged user could locally exploit this vulnerability to disclose sensitive information resulting in a complete loss of confidentiality, integrity, and availability. To exploit this vulnerability, HPE OneView must be configured with credential access to external repositories. HPE has provided a software update to resolve this vulnerability in HPE OneView. |
| CVE-2022-23706 | Medium | 2022-05-17 | Not applicable | No public exploit | A remote cross-site scripting (xss) vulnerability was discovered in HPE OneView version(s): Prior to 7.0. HPE has provided a software update to resolve this vulnerability in HPE OneView. |
| CVE-2022-23700 | Medium | 2022-04-04 | Not applicable | No public exploit | A local unauthorized read access to files vulnerability was discovered in HPE OneView version(s): Prior to 6.6. HPE has provided a software update to resolve this vulnerability in HPE OneView. |
| CVE-2022-23697 | Medium | 2022-04-04 | Not applicable | No public exploit | A remote cross-site scripting (xss) vulnerability was discovered in HPE OneView version(s): Prior to 6.6. HPE has provided a software update to resolve this vulnerability in HPE OneView. |
| CVE-2022-23958 | Medium | 2022-03-02 | Not applicable | No public exploit | Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. |
| CVE-2022-23957 | Medium | 2022-03-02 | Not applicable | No public exploit | Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. |
| CVE-2022-23956 | Medium | 2022-03-02 | Not applicable | No public exploit | Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. |
| CVE-2022-23955 | Medium | 2022-03-02 | Not applicable | No public exploit | Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. |
| CVE-2022-23954 | Medium | 2022-03-02 | Not applicable | No public exploit | Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. |
| CVE-2022-23953 | Medium | 2022-03-02 | Not applicable | No public exploit | Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. |
| CVE-2020-6920 | Medium | 2022-02-16 | Not applicable | No public exploit | Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software. |
| CVE-2022-23456 | Medium | 2022-01-28 | Not applicable | No public exploit | Potential arbitrary file deletion vulnerability has been identified in HP Support Assistant software. |
| CVE-2019-18914 | Medium | 2021-11-09 | Not applicable | No public exploit | A potential security vulnerability has been identified for certain HP printers and MFPs that would allow redirection page Cross-Site Scripting in a client’s browser by clicking on a third-party malicious link. |
| CVE-2021-39237 | Medium | 2021-11-03 | Not applicable | No public exploit | Certain HP LaserJet, HP LaserJet Managed, HP PageWide, and HP PageWide Managed printers may be vulnerable to potential information disclosure. |
| CVE-2021-3662 | Medium | 2021-10-29 | Not applicable | No public exploit | Certain HP Enterprise LaserJet and PageWide MFPs may be vulnerable to stored cross site scripting (XSS). |
| CVE-2021-3441 | Medium | 2021-10-29 | Not applicable | Working exploit published | A potential security vulnerability has been identified for the HP OfficeJet 7110 Wide Format ePrinter that enables Cross-Site Scripting (XSS). |
| CVE-2021-26584 | Medium | 2021-06-03 | Not applicable | No public exploit | A security vulnerability in HPE OneView for VMware vCenter (OV4VC) could be exploited remotely to allow Cross-Site Scripting. HPE has released the following software update to resolve the vulnerability in HPE OneView for VMware vCenter (OV4VC). |
| CVE-2021-29211 | Medium | 2021-05-25 | Not applicable | No public exploit | A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78. |
| CVE-2021-29210 | Medium | 2021-05-25 | Not applicable | No public exploit | A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78. |
| CVE-2021-29209 | Medium | 2021-05-25 | Not applicable | No public exploit | A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78. |
| CVE-2021-29208 | Medium | 2021-05-25 | Not applicable | No public exploit | A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78. |
| CVE-2021-29207 | Medium | 2021-05-25 | Not applicable | No public exploit | A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78. |
| CVE-2021-29206 | Medium | 2021-05-25 | Not applicable | No public exploit | A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78. |
| CVE-2021-29205 | Medium | 2021-05-25 | Not applicable | No public exploit | A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78. |
| CVE-2021-29204 | Medium | 2021-05-25 | Not applicable | No public exploit | A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78. |
| CVE-2021-29202 | Medium | 2021-05-25 | Not applicable | No public exploit | A local buffer overflow vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78. |
| CVE-2021-29201 | Medium | 2021-05-25 | Not applicable | No public exploit | A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78. |
| CVE-2021-26582 | Medium | 2021-04-15 | Not applicable | No public exploit | A security vulnerability in HPE IceWall SSO Domain Gateway Option (Dgfw) module version 10.0 on RHEL 5/6/7, version 10.0 on HP-UX 11i v3, version 10.0 on Windows and 11.0 on Windows could be exploited remotely to allow cross-site scripting (XSS). |
| CVE-2020-7202 | Medium | 2021-01-05 | Not applicable | No public exploit | A potential security vulnerability has been identified in HPE Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4) firmware. The vulnerability could be remotely exploited to disclose the serial number and other information. |
| CVE-2020-7207 | Medium | 2020-11-05 | Not applicable | No public exploit | A local elevation of privilege using physical access security vulnerability was found in HPE Proliant Gen10 Servers using Intel Innovation Engine (IE). This attack requires a physical attack to the server motherboard. To mitigate this issue, ensure your server is always physically secured. HPE will not address this issue in the impacted Gen 10 servers listed. HPE recommends using appropriate physical security methods as a compensating control to disallow an attacker from having physical access to the server main circuit board. |
| CVE-2020-7196 | Medium | 2020-10-26 | Not applicable | No public exploit | The HPE BlueData EPIC Software Platform version 4.0 and HPE Ezmeral Container Platform 5.0 use an insecure method of handling sensitive Kerberos passwords that is susceptible to unauthorized interception and/or retrieval. Specifically, they display the kdc_admin_password in the source file of the url "/bdswebui/assignusers/". |
| CVE-2020-15596 | Medium | 2020-08-12 | Not applicable | No public exploit | The ALPS ALPINE touchpad driver before 8.2206.1717.634, as used on various Dell, HP, and Lenovo laptops, allows attackers to conduct Path Disclosure attacks via a "fake" DLL file. |
| CVE-2019-18618 | Medium | 2020-07-22 | Not applicable | No public exploit | Incorrect access control in the firmware of Synaptics VFS75xx family fingerprint sensors that include external flash (all versions prior to 2019-11-15) allows a local administrator or physical attacker to compromise the confidentiality of sensor data via injection of an unverified partition table. |