Hitachi It Operations Director vulnerabilities

6 CVEs affecting Hitachi It Operations Director, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-29645, published 2021-10-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-29644, published 2021-10-12. Critical severity, CVSS 9.8. EPSS: 2.5% chance of exploitation in the next 30 days. Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 contains a remote code execution vulnerability because of an Integer Overflow. An attacker with network access to port 31016 may exploit this…
CVE-2013-4697, published 2013-07-31. High severity, CVSS 9.0. EPSS: 1.9% chance of exploitation in the next 30 days. Multiple unspecified vulnerabilities in Hitachi JP1/IT Desktop Management - Manager 09-50 through 09-50-03, 09-51 through 09-51-05, 10-00 through 10-00-02, and 10-01 through 10-01-02; Hitachi Job…
CVE-2012-0919, published 2012-01-24. Medium severity, CVSS 4.3. EPSS: 1.1% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Hitachi IT Operations Director 02-50-01 through 02-50-07, 03-00 through 03-00-04, and possibly other versions before 03-00-06, allows remote attackers to…
CVE-2012-4276, published 2012-08-13. Medium severity, CVSS 5.0. EPSS: 1% chance of exploitation in the next 30 days. Unspecified vulnerability in Hitachi IT Operations Director 02-50-01 through 02-50-07, 03-00 before 03-00-08 allows attackers to cause a denial of service via unknown attack vectors.
CVE-2012-4275, published 2012-08-13. Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Hitachi IT Operations Director 02-50-01 through 02-50-07, 03-00 before 03-00-08 allows remote attackers to inject arbitrary web script or HTML via…
CVE-2021-29645, published 2021-10-12. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 calls the SendMessageTimeoutW API with arbitrary arguments via a local pipe, leading to a local privilege escalation vulnerability. An attacker…