HP Business Service Management vulnerabilities

5 CVEs affecting HP Business Service Management, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-4405, published 2018-08-06.

More from HP.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2015-3269, published 2015-08-25. Medium severity, CVSS 5.0. EPSS: 9.8% chance of exploitation in the next 30 days. Apache Flex BlazeDS, as used in flex-messaging-core.jar in Adobe LiveCycle Data Services (LCDS) 3.0.x before 3.0.0.354170, 4.5 before 4.5.1.354169, 4.6.2 before 4.6.2.354169, and 4.7 before…
• CVE-2012-2561, published 2012-05-21. High severity, CVSS 10.0. EPSS: 8.6% chance of exploitation in the next 30 days. HP Business Service Management (BSM) 9.12 does not properly restrict the uploading of .war files, which allows remote attackers to execute arbitrary JSP code within the JBOSS Application Server…
• CVE-2016-4405, published 2018-08-06. High severity, CVSS 8.8. EPSS: 4.9% chance of exploitation in the next 30 days. A remote code execution vulnerability was identified in HP Business Service Management (BSM) using Apache Commons Collection Java Deserialization versions v9.20-v9.26
• CVE-2011-0274, published 2011-01-24. Medium severity, CVSS 4.3. EPSS: 2.1% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in HP Business Availability Center (BAC) 7.x through 7.55 and 8.x through 8.05, and Business Service Management (BSM) through 9.01, allows remote attackers to…
• CVE-2016-4392, published 2018-08-06. Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days. A remote cross site scripting vulnerability has been identified in HP Business Service Management software v9.1x, v9.20 - v9.25IP1.