WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Vendor hp✕
Overview 2,346 matches · 42 in Waratek scope · 35 protected · 24 exploited · 7 CISA KEV · 239 public PoC · 115 EPSS ≥ 0.5
2,346matches 42in Waratek scope1.8% 35protected1.5% 24exploited1.0% 7CISA KEV0.3% 239public PoC10.2% 115EPSS ≥ 0.54.9%
Protected by Waratek 35 1.5% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 7 0.3% Outside Waratek scope 34 1.4% Not applicable 2,270 96.8% Withdrawn CVE 0 0.0%
Critical 248 10.6% High 1,190 50.7% Medium 813 34.7% Low 95 4.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 35 1.5% partly blocked 0 0.0% not blocked 2,311 98.5% not established 0 0.0% unrecorded 0 0.0%
Exploited 24 1.0% Working exploit published 217 9.2% Proof of concept only 5 0.2% Forecast only 22 0.9% No public exploit 2,078 88.6%
split by peak 309 / year
Not applicable: 2,270Outside Waratek scope: 34No exploit published: 7Protected by Waratek: 35 Low: 95Medium: 813High: 1,190Critical: 248 not blocked: 2,311blocked by ARMR today: 35 No public exploit: 2,078Forecast only: 22Proof of concept only: 5Working exploit published: 217Exploited: 24
19901 Not applicable1 High1 not blocked1 No public exploit1 19911 Not applicable1 High1 not blocked1 No public exploit1 19920 19931 Not applicable1 Medium1 not blocked1 No public exploit1 19948 Not applicable8 High3 Medium5 not blocked8 No public exploit8 19951 Not applicable1 High1 not blocked1 No public exploit1 199619 Not applicable19 High12 Medium3 Low4 not blocked19 Working exploit published2 No public exploit17 199729 Not applicable29 High15 Medium13 Low1 not blocked29 Working exploit published7 No public exploit22 199812 Not applicable12 High7 Medium5 not blocked12 Exploited1 Working exploit published4 No public exploit7 199918 Not applicable18 Critical1 High9 Medium8 not blocked18 Working exploit published1 No public exploit17 200036 Not applicable36 High14 Medium21 Low1 not blocked36 Working exploit published14 No public exploit22 200148 No exploit published1 Not applicable47 Critical2 High24 Medium12 Low10 not blocked48 Exploited1 Working exploit published7 No public exploit40 200257 Outside Waratek scope1 Not applicable56 High28 Medium23 Low6 not blocked57 Working exploit published9 No public exploit48 200341 Not applicable41 High28 Medium12 Low1 not blocked41 Exploited3 Working exploit published13 No public exploit25 200429 Outside Waratek scope1 Not applicable28 High13 Medium14 Low2 not blocked29 Working exploit published3 No public exploit26 200533 Outside Waratek scope1 Not applicable32 Critical1 High19 Medium8 Low5 not blocked33 Exploited1 Working exploit published5 Forecast only1 No public exploit26 200639 Not applicable39 High17 Medium19 Low3 not blocked39 Working exploit published4 No public exploit35 200766 Not applicable66 High35 Medium27 Low4 not blocked66 Working exploit published21 No public exploit45 200868 Not applicable68 High43 Medium22 Low3 not blocked68 Working exploit published13 No public exploit55 200978 Not applicable78 High57 Medium21 not blocked78 Working exploit published17 No public exploit61 2010120 Not applicable120 High44 Medium74 Low2 not blocked120 Working exploit published18 No public exploit102 2011143 Not applicable143 High77 Medium61 Low5 not blocked143 Working exploit published15 No public exploit128 201285 Not applicable85 Critical1 High45 Medium33 Low6 not blocked85 Exploited1 Working exploit published12 Forecast only1 No public exploit71 2013143 No exploit published1 Not applicable142 Critical1 High79 Medium52 Low11 not blocked143 Exploited2 Working exploit published17 Forecast only9 No public exploit115 2014103 Outside Waratek scope7 Not applicable96 High56 Medium40 Low7 not blocked103 Exploited2 Working exploit published7 No public exploit94 2015108 Outside Waratek scope1 Not applicable107 Critical1 High51 Medium52 Low4 not blocked108 Exploited3 Working exploit published3 Proof of concept only1 No public exploit101 2016112 No exploit published2 Outside Waratek scope4 Not applicable106 Critical30 High58 Medium22 Low2 not blocked112 Exploited3 Working exploit published3 Forecast only5 No public exploit101 201732 Protected by Waratek2 Not applicable30 Critical10 High8 Medium14 blocked by ARMR today2 not blocked30 Exploited1 Forecast only1 No public exploit30 2018309 Protected by Waratek24 No exploit published3 Outside Waratek scope13 Not applicable269 Critical60 High143 Medium100 Low6 blocked by ARMR today24 not blocked285 Exploited3 Working exploit published15 Forecast only1 No public exploit290 2019184 Protected by Waratek9 Outside Waratek scope5 Not applicable170 Critical26 High114 Medium37 Low7 blocked by ARMR today9 not blocked175 Exploited1 Working exploit published3 Forecast only4 No public exploit176 2020112 Outside Waratek scope1 Not applicable111 Critical51 High41 Medium18 Low2 not blocked112 Exploited1 Working exploit published3 Proof of concept only2 No public exploit106 202135 Not applicable35 Critical8 High10 Medium17 not blocked35 Exploited1 Working exploit published1 No public exploit33 202260 Not applicable60 Critical10 High35 Medium15 not blocked60 No public exploit60 2023112 Not applicable112 Critical27 High69 Medium15 Low1 not blocked112 Proof of concept only1 No public exploit111 202455 Not applicable55 Critical15 High21 Medium19 not blocked55 Proof of concept only1 No public exploit54 202532 Not applicable32 Critical1 High7 Medium22 Low2 not blocked32 No public exploit32 202616 Not applicable16 Critical3 High5 Medium8 not blocked16 No public exploit16
1990199319961999200220052008201120142017202020232026
2,346 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 24 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-91106 Critical 2026-09-16 Not applicable No public exploit HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.
CVE-2026-91105 High 2026-09-16 Not applicable No public exploit HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.
CVE-2026-91104 Critical 2026-09-16 Not applicable No public exploit HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.
CVE-2026-91103 Medium 2026-09-16 Not applicable No public exploit HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.
CVE-2026-91102 High 2026-09-16 Not applicable No public exploit HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.
CVE-2026-91101 Medium 2026-09-16 Not applicable No public exploit HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.
CVE-2026-91100 Medium 2026-09-16 Not applicable No public exploit HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.
CVE-2026-91099 Medium 2026-09-16 Not applicable No public exploit HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.
CVE-2026-91098 High 2026-09-16 Not applicable No public exploit HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.
CVE-2026-91097 High 2026-09-16 Not applicable No public exploit HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.
CVE-2026-8632 High 2026-05-20 Not applicable No public exploit A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vulnerability may allow escalation of privileges and/or arbitrary code execution via operating system command injection.
CVE-2026-8631 Critical 2026-05-20 Not applicable No public exploit A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vulnerability may allow escalation of privileges and/or arbitrary code execution via an integer overflow in the hpcups processing path when handling crafted print data.
CVE-2026-3291 Medium 2026-05-06 Not applicable No public exploit Samsung Print Service Plugin for Android is potentially vulnerable to information disclosure when using an outdated version of the application via mobile devices. HP is releasing updates to mitigate these potential vulnerabilities.
CVE-2026-2915 Medium 2026-03-03 Not applicable No public exploit HP System Event Utility might allow denial of service with elevated arbitrary file writes. This potential vulnerability was remediated with HP System Event Utility version 3.2.16.
CVE-2026-1997 Medium 2026-02-10 Not applicable No public exploit Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web origins to access device resource. CORS is disabled by default on Pro‑class devices and can only be enabled by an administrator through the Embedded Web Server (EWS). Keeping CORS disabled unless explicitly required helps ensure that only trusted solutions can interact with the device.
CVE-2026-1996 Medium 2026-02-10 Not applicable No public exploit Certain HP OfficeJet Pro printers may be vulnerable to potential denial of service when the IPP requests are mishandled, failing to establish a TCP connection.
CVE-2025-14432 High 2025-12-16 Not applicable No public exploit In limited scenarios, sensitive data might be written to the log file if an admin uses Microsoft Teams Admin Center (TAC) to make device configuration changes. The affected log file is visible only to users with admin credentials. This is limited to Microsoft TAC and does not affect configuration changes made using the provisioning server or the device WebUI.
CVE-2025-11531 Medium 2025-12-09 Not applicable No public exploit HP System Event Utility and Omen Gaming Hub might allow execution of certain files outside of their restricted paths. This potential vulnerability was remediated with HP System Event Utility version 3.2.12 and Omen Gaming Hub version 1101.2511.101.0.
CVE-2025-13492 Medium 2025-12-03 Not applicable No public exploit A potential security vulnerability has been identified in HP Image Assistant for versions prior to 5.3.3. The vulnerability could potentially allow a local attacker to escalate privileges via a race condition when installing packages.
CVE-2025-12785 Medium 2025-11-13 Not applicable No public exploit Certain HP LaserJet Pro printers may be vulnerable to information disclosure leading to credential exposure by altering the scan/send destination address and/or modifying the LDAP Server.
CVE-2025-12784 Medium 2025-11-13 Not applicable No public exploit Certain HP LaserJet Pro printers may be vulnerable to information disclosure leading to credential exposure by altering the scan/send destination address and/or modifying the LDAP Server.
CVE-2025-11761 High 2025-11-03 Not applicable No public exploit A potential security vulnerability has been identified in the HP Client Management Script Library software, which might allow escalation of privilege during the installation process. HP is releasing software updates to mitigate the potential vulnerability.
CVE-2025-43024 Medium 2025-10-28 Not applicable No public exploit A GUI dialog of an application allows to view what files are in the file system without proper authorization.
CVE-2025-43017 High 2025-10-28 Not applicable No public exploit HP ThinPro 8.1 System management application failed to verify user's true id. HP has released HP ThinPro 8.1 SP8, which includes updates to mitigate potential vulnerabilities.
CVE-2025-10578 Medium 2025-10-01 Not applicable No public exploit A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.47.41.0. The vulnerability could potentially allow a local attacker to escalate privileges via an arbitrary file write.
CVE-2025-43491 High 2025-09-09 Not applicable No public exploit A vulnerability in the Poly Lens Desktop application running on the Windows platform might allow modifications to the filesystem, which might lead to SYSTEM level privileges being granted.
CVE-2025-43018 Medium 2025-07-30 Not applicable No public exploit Certain HP LaserJet Pro printers may be vulnerable to information disclosure when a non-authenticated user queries a device’s local address book.
CVE-2025-43023 Medium 2025-07-28 Not applicable No public exploit A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software documentation. This potential vulnerability is due to the use of a weak code signing key, Digital Signature Algorithm (DSA).
CVE-2025-3508 Medium 2025-07-25 Not applicable No public exploit Certain HP DesignJet products may be vulnerable to information disclosure though printer's web interface allowing unauthenticated users to view sensitive print job information.
CVE-2025-43489 Low 2025-07-23 Not applicable No public exploit A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vulnerability could deserialize untrusted data without validation. HP has addressed the issue in the latest software update.
CVE-2025-43488 Low 2025-07-23 Not applicable No public exploit A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The vulnerability could allow a bypass of the application's XSS filter by submitting untrusted characters. HP has addressed the issue in the latest software update.
CVE-2025-43487 Medium 2025-07-23 Not applicable No public exploit A potential privilege escalation through Sudo vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The firmware flaw does not properly implement access controls. HP has addressed the issue in the latest software update.
CVE-2025-43486 Medium 2025-07-23 Not applicable No public exploit A potential stored cross-site scripting vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The website allows user input to be stored and rendered without proper sanitization. HP has addressed the issue in the latest software update.
CVE-2025-43485 Medium 2025-07-23 Not applicable No public exploit A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The vulnerability could potentially allow a privileged user to retrieve credentials from the log files. HP has addressed the issue in the latest software update.
CVE-2025-43484 Medium 2025-07-23 Not applicable No public exploit A potential reflected cross-site scripting vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The website does not validate or sanitize the user input before rendering it in the response. HP has addressed the issue in the latest software update.
CVE-2025-43483 Medium 2025-07-23 Not applicable No public exploit A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vulnerability could allow the retrieval of hardcoded cryptographic keys. HP has addressed the issue in the latest software update.
CVE-2025-43022 High 2025-07-22 Not applicable No public exploit A potential SQL injection vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vulnerability could allow a privileged user to execute SQL commands. HP has addressed the issue in the latest software update.
CVE-2025-43021 Medium 2025-07-22 Not applicable No public exploit A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vulnerability could allow the use and retrieval of the default password. HP has addressed the issue in the latest software update.
CVE-2025-43020 Medium 2025-07-22 Not applicable No public exploit A potential command injection vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The vulnerability could allow a privileged user to submit arbitrary input. HP has addressed the issue in the latest software update.
CVE-2025-43019 Medium 2025-07-08 Not applicable No public exploit A potential security vulnerability has been identified in the HP Support Assistant, which allows a local attacker to escalate privileges via an arbitrary file deletion.
CVE-2025-43025 Medium 2025-07-02 Not applicable No public exploit HP Universal Print Driver is potentially vulnerable to denial of service due to buffer overflow in versions of UPD 7.4 or older (e.g., v7.3.x, v7.2.x, v7.1.x, etc.).
CVE-2025-43026 High 2025-06-05 Not applicable No public exploit A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.44.18.0. The vulnerability could potentially allow a local attacker to escalate privileges via an arbitrary file write.
CVE-2025-1697 Medium 2025-04-18 Not applicable No public exploit A potential security vulnerability has been identified in the HP Touchpoint Analytics Service for certain HP PC products with versions prior to 4.2.2439. This vulnerability could potentially allow a local attacker to escalate privileges. HP is providing software updates to mitigate this potential vulnerability.
CVE-2025-2268 Medium 2025-03-14 Not applicable No public exploit The HP LaserJet MFP M232-M237 Printer Series may be vulnerable to a denial of service attack when a specially crafted request message is sent via Internet Printing Protocol (IPP).
CVE-2025-26508 High 2025-02-14 Not applicable No public exploit Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers may potentially be vulnerable to Remote Code Execution and Elevation of Privilege when processing a PostScript print job.
CVE-2025-26507 Medium 2025-02-14 Not applicable No public exploit Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers may potentially be vulnerable to Remote Code Execution and Elevation of Privilege when processing a PostScript print job.
CVE-2025-26506 Critical 2025-02-14 Not applicable No public exploit Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers may potentially be vulnerable to Remote Code Execution and Elevation of Privilege when processing a PostScript print job.
CVE-2025-1004 Medium 2025-02-06 Not applicable No public exploit Certain HP LaserJet Pro printers may potentially experience a denial of service when a user sends a raw JPEG file to the printer via IPP (Internet Printing Protocol).
CVE-2024-9579 High 2024-11-05 Not applicable No public exploit A potential vulnerability was discovered in certain Poly video conferencing devices. The firmware flaw does not properly sanitize user input. The exploitation of this vulnerability is dependent on a layered attack and cannot be exploited by itself.
CVE-2024-9419 Critical 2024-10-30 Not applicable No public exploit Client / Server PCs with the HP Smart Universal Printing Driver installed are potentially vulnerable to Remote Code Execution and/or Elevation of Privilege. A client using the HP Smart Universal Printing Driver that sends a print job comprised of a malicious XPS file could potentially lead to Remote Code Execution and/or Elevation of Privilege on the PC.
CVE-2024-5749 High 2024-10-15 Not applicable No public exploit Certain HP DesignJet products may be vulnerable to credential reflection which allow viewing SMTP server credentials.
CVE-2024-9423 Medium 2024-10-02 Not applicable No public exploit Certain HP LaserJet printers may potentially experience a denial of service when a user sends a raw JPEG file to the printer. The printer displays a “JPEG Unsupported” message which may not clear, potentially blocking queued print jobs.
CVE-2024-7720 Critical 2024-08-27 Not applicable No public exploit HP Security Manager is potentially vulnerable to Remote Code Execution as a result of code vulnerability within the product's solution open-source libraries.
CVE-2024-41912 Critical 2024-08-07 Not applicable No public exploit A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly implement access controls.
CVE-2024-42400 Medium 2024-08-06 Not applicable No public exploit Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.
CVE-2024-42399 Medium 2024-08-06 Not applicable No public exploit Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.
CVE-2024-42398 Medium 2024-08-06 Not applicable No public exploit Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.
CVE-2024-42397 Medium 2024-08-06 Not applicable No public exploit Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.
CVE-2024-42396 Medium 2024-08-06 Not applicable No public exploit Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.
CVE-2024-42395 Critical 2024-08-06 Not applicable No public exploit There is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.
CVE-2024-42394 Critical 2024-08-06 Not applicable No public exploit There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.
CVE-2024-42393 Critical 2024-08-06 Not applicable No public exploit There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.
CVE-2024-41913 High 2024-08-06 Not applicable No public exploit A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly sanitize User input.
CVE-2024-41911 Medium 2024-08-06 Not applicable No public exploit A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The flaw does not properly neutralize input during a web page generation.
CVE-2024-41910 Medium 2024-08-06 Not applicable No public exploit A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware contained multiple XSS vulnerabilities in the version of JavaScript used.
CVE-2024-22442 Critical 2024-07-16 Not applicable No public exploit The vulnerability could be remotely exploited to bypass authentication.
CVE-2022-27540 High 2024-06-28 Not applicable No public exploit A potential Time-of-Check to Time-of Use (TOCTOU) vulnerability has been identified in the HP BIOS for certain HP PC products, which might allow arbitrary code execution, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate the potential vulnerability.
CVE-2024-6147 High 2024-06-20 Not applicable No public exploit Poly Plantronics Hub Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Poly Plantronics Hub. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Spokes Update Service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18271.
CVE-2022-37020 Medium 2024-06-10 Not applicable No public exploit Potential vulnerabilities have been identified in the system BIOS for certain HP PC products, which might allow escalation of privileges and code execution. HP is releasing firmware updates to mitigate the potential vulnerabilities.
CVE-2022-37019 Medium 2024-06-10 Not applicable No public exploit Potential vulnerabilities have been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and code execution. HP is releasing firmware updates to mitigate the potential vulnerabilities.
CVE-2024-5143 Medium 2024-05-23 Not applicable No public exploit A user with device administrative privileges can change existing SMTP server settings on the device, without having to re-enter SMTP server credentials. By redirecting send-to-email traffic to the new server, the original SMTP server credentials may potentially be exposed.
CVE-2024-2301 High 2024-05-23 Not applicable No public exploit Certain HP LaserJet Pro devices are potentially vulnerable to a Cross-Site Scripting (XSS) attack via the web management interface of the device.
CVE-2024-31483 Medium 2024-05-14 Not applicable No public exploit An authenticated sensitive information disclosure vulnerability exists in the CLI service accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to read arbitrary files in the underlying operating system.
CVE-2024-31482 High 2024-05-14 Not applicable No public exploit An unauthenticated Denial-of-Service (DoS) vulnerability exists in the ANSI escape code service accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected Access Point.
CVE-2024-31481 High 2024-05-14 Not applicable No public exploit Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service.
CVE-2024-31480 High 2024-05-14 Not applicable No public exploit Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service.
CVE-2024-31479 High 2024-05-14 Not applicable No public exploit Unauthenticated Denial of Service (DoS) vulnerabilities exist in the Central Communications service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service.
CVE-2024-31478 High 2024-05-14 Not applicable No public exploit Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exists in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilites result in the ability to interrupt the normal operation of the affected Access Point.
CVE-2024-31477 High 2024-05-14 Not applicable No public exploit Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
CVE-2024-31476 High 2024-05-14 Not applicable No public exploit Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
CVE-2024-31475 High 2024-05-14 Not applicable No public exploit There is an arbitrary file deletion vulnerability in the Central Communications service accessed by PAPI (Aruba's access point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the affected Access Point.
CVE-2024-31474 High 2024-05-14 Not applicable No public exploit There is an arbitrary file deletion vulnerability in the CLI service accessed by PAPI (Aruba's Access Point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the affected Access Point
CVE-2024-31473 Critical 2024-05-14 Not applicable No public exploit There is a command injection vulnerability in the underlying deauthentication service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVE-2024-31472 Critical 2024-05-14 Not applicable No public exploit There are command injection vulnerabilities in the underlying Soft AP Daemon service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVE-2024-31471 Critical 2024-05-14 Not applicable No public exploit There is a command injection vulnerability in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVE-2024-31470 Critical 2024-05-14 Not applicable No public exploit There is a buffer overflow vulnerability in the underlying SAE (Simultaneous Authentication of Equals) service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVE-2024-31469 Critical 2024-05-14 Not applicable No public exploit There are buffer overflow vulnerabilities in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVE-2024-31468 Critical 2024-05-14 Not applicable No public exploit There are buffer overflow vulnerabilities in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVE-2024-31467 Critical 2024-05-14 Not applicable No public exploit There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVE-2024-31466 Critical 2024-05-14 Not applicable No public exploit There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVE-2024-27460 Medium 2024-05-14 Not applicable Proof of concept only A privilege escalation exists in the updater for Plantronics Hub 3.25.1 and below.
CVE-2024-28893 High 2024-05-01 Not applicable No public exploit Certain HP software packages (SoftPaqs) are potentially vulnerable to arbitrary code execution when the SoftPaq configuration file has been modified after extraction. HP has released updated software packages (SoftPaqs).
CVE-2024-3281 High 2024-04-09 Not applicable No public exploit A vulnerability was discovered in the firmware builds after 8.0.2.3267 and prior to 8.1.3.1301 in CCX devices. A flaw in the firmware build process did not properly restrict access to a resource from an unauthorized actor.
CVE-2024-2209 Medium 2024-03-27 Not applicable No public exploit A user with administrative privileges can create a compromised dll file of the same name as the original dll within the HP printer’s Firmware Update Utility (FUU) bundle and place it in the Microsoft Windows default downloads directory which can lead to potential arbitrary code execution.
CVE-2023-4063 Medium 2024-03-22 Not applicable No public exploit Certain HP OfficeJet Pro printers are potentially vulnerable to a Denial of Service when using an improper eSCL URL GET request.
CVE-2024-1869 High 2024-03-01 Not applicable No public exploit Certain HP DesignJet print products are potentially vulnerable to information disclosure related to accessing memory out-of-bounds when using the general-purpose gateway (GGW) over port 9220.
CVE-2024-0407 Medium 2024-02-21 Not applicable No public exploit Certain HP Enterprise LaserJet, and HP LaserJet Managed Printers are potentially vulnerable to information disclosure, when connections made by the device back to services enabled by some solutions may have been trusted without the appropriate CA certificate in the device's certificate store.
CVE-2023-6138 High 2024-02-14 Not applicable No public exploit A potential security vulnerability has been identified in the system BIOS for certain HP Workstation PCs, which might allow escalation of privilege, arbitrary code execution, or denial of service. HP is releasing mitigation for the potential vulnerability.
CVE-2022-48220 Medium 2024-02-14 Not applicable No public exploit Potential vulnerabilities have been identified in certain HP Desktop PC products using the HP TamperLock feature, which might allow intrusion detection bypass via a physical attack. HP is releasing firmware and guidance to mitigate these potential vulnerabilities.
CVE-2022-48219 Medium 2024-02-14 Not applicable No public exploit Potential vulnerabilities have been identified in certain HP Desktop PC products using the HP TamperLock feature, which might allow intrusion detection bypass via a physical attack. HP is releasing firmware and guidance to mitigate these potential vulnerabilities.
‹ prev page 1 of 24 next ›