HP Data Protector vulnerabilities

14 CVEs affecting HP Data Protector, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-5809, published 2018-02-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-2004, published 2016-04-21. Critical severity, CVSS 9.8. EPSS: 94.3% chance of exploitation in the next 30 days. HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary code via unspecified vectors related to lack of authentication. NOTE: this…
CVE-2011-0923, published 2011-02-09. High severity, CVSS 10.0. EPSS: 81.1% chance of exploitation in the next 30 days. The client in HP Data Protector does not properly validate EXEC_CMD arguments, which allows remote attackers to execute arbitrary Perl code via a crafted command, related to the "local bin directory."
CVE-2011-0922, published 2011-02-09. High severity, CVSS 10.0. EPSS: 64.2% chance of exploitation in the next 30 days. The client in HP Data Protector allows remote attackers to execute arbitrary programs via an EXEC_SETUP command that references a UNC share pathname.
CVE-2014-5160, published 2014-08-01. Medium severity, CVSS 6.4. EPSS: 34.8% chance of exploitation in the next 30 days. Multiple directory traversal vulnerabilities in crs.exe in the Cell Request Service in HP Data Protector allow remote attackers to create arbitrary files via an opcode-1091 request, or create or…
CVE-2017-5807, published 2018-02-15. Critical severity, CVSS 9.8. EPSS: 21.9% chance of exploitation in the next 30 days. A Remote Arbitrary Code Execution vulnerability in HPE Data Protector version prior to 8.17 and 9.09 was found.
CVE-2016-2007, published 2016-04-21. Critical severity, CVSS 9.8. EPSS: 20.4% chance of exploitation in the next 30 days. HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-3354.
CVE-2016-2006, published 2016-04-21. Critical severity, CVSS 9.8. EPSS: 20.4% chance of exploitation in the next 30 days. HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-3353.
CVE-2016-2005, published 2016-04-21. Critical severity, CVSS 9.8. EPSS: 20.4% chance of exploitation in the next 30 days. HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-3352.
CVE-2017-5808, published 2018-02-15. High severity, CVSS 7.5. EPSS: 16.1% chance of exploitation in the next 30 days. A Remote Arbitrary Code Execution vulnerability in HPE Data Protector version prior to 8.17 and 9.09 was found.
CVE-2011-0921, published 2011-02-09. High severity, CVSS 10.0. EPSS: 11.3% chance of exploitation in the next 30 days. crs.exe in the Cell Manager Service in the client in HP Data Protector does not properly validate credentials associated with the hostname, domain, and username, which allows remote attackers to…

Latest

CVE-2017-5809, published 2018-02-15. Medium severity, CVSS 5.5. EPSS: 1.6% chance of exploitation in the next 30 days. A Remote Arbitrary Code Execution vulnerability in HPE Data Protector version prior to 8.17 and 9.09 was found.
CVE-2016-2008, published 2016-04-21. Critical severity, CVSS 9.8. EPSS: 10.5% chance of exploitation in the next 30 days. HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2011-2399, published 2011-08-01. High severity, CVSS 7.8. EPSS: 4.5% chance of exploitation in the next 30 days. Unspecified vulnerability in the Media Management Daemon (mmd) in HP Data Protector 6.11 and earlier allows remote attackers to cause a denial of service via unknown vectors.