HP Application Lifecycle Management vulnerabilities

4 CVEs affecting HP Application Lifecycle Management, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2014-2631, published 2014-08-12.

More from HP.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2013-4810: HP Multiple Products Remote Code Execution Vulnerability, published 2013-09-16. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 79.5% chance of exploitation in the next 30 days. HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled…
• CVE-2013-4834, published 2013-11-04. High severity, CVSS 7.5. EPSS: 5.5% chance of exploitation in the next 30 days. Unspecified vulnerability in the client component in HP Application LifeCycle Management (ALM) before 11 p11 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1327.
• CVE-2013-4802, published 2013-07-29. Medium severity, CVSS 4.3. EPSS: 2.1% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in HP Application Lifecycle Management (ALM) Quality Center before 11.51 allows remote attackers to inject arbitrary web script or HTML via unspecified…
• CVE-2014-2631, published 2014-08-12. Medium severity, CVSS 4.6. EPSS: 0.6% chance of exploitation in the next 30 days. Unspecified vulnerability in HP Application Lifecycle Management (aka Quality Center) 11.5x and 12.0x allows local users to gain privileges via unknown vectors, aka ZDI-CAN-2138.