HP Network Automation vulnerabilities

17 CVEs affecting HP Network Automation, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-6493, published 2018-05-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-5811, published 2018-02-15. High severity, CVSS 7.5. EPSS: 17% chance of exploitation in the next 30 days. A remote code execution vulnerability in HPE Network Automation version 9.1x, 9.2x, 10.0x, 10.1x and 10.2x were found.
CVE-2016-8511, published 2018-02-15. Critical severity, CVSS 9.8. EPSS: 15.3% chance of exploitation in the next 30 days. A Remote Code Execution vulnerability in HPE Network Automation using RPCServlet and Java Deserialization version v9.1x, v9.2x, v10.00, v10.00.01, v10.00.02, v10.10, v10.11, v10.11.01, v10.20 was…
CVE-2016-1989, published 2016-03-15. Critical severity, CVSS 9.8. EPSS: 10.6% chance of exploitation in the next 30 days. HPE Network Automation 9.22 through 9.22.02 and 10.x before 10.00.02 allows remote attackers to execute arbitrary code or obtain sensitive information via unspecified vectors, a different…
CVE-2016-1988, published 2016-03-15. Critical severity, CVSS 9.8. EPSS: 10.6% chance of exploitation in the next 30 days. HPE Network Automation 9.22 through 9.22.02 and 10.x before 10.00.02 allows remote attackers to execute arbitrary code or obtain sensitive information via unspecified vectors, a different…
CVE-2011-4790, published 2012-02-02. High severity, CVSS 9.3. EPSS: 9% chance of exploitation in the next 30 days. Unspecified vulnerability in HP Network Automation 7.5x, 7.6x, 9.0, and 9.10 allows remote attackers to execute arbitrary code via unknown vectors.
CVE-2017-5814, published 2018-02-15. Critical severity, CVSS 9.8. EPSS: 8.7% chance of exploitation in the next 30 days. A remote sql injection authentication bypass in HPE Network Automation version 9.1x, 9.2x, 10.0x, 10.1x and 10.2x were found.
CVE-2017-5812, published 2018-02-15. High severity, CVSS 7.5. EPSS: 5.3% chance of exploitation in the next 30 days. A remote sql information disclosure vulnerability in HPE Network Automation version 9.1x, 9.2x, 10.0x, 10.1x and 10.2x were found.
CVE-2017-5810, published 2018-02-15. Critical severity, CVSS 9.8. EPSS: 4.7% chance of exploitation in the next 30 days. A remote sql injection vulnerability in HPE Network Automation version 9.1x, 9.2x, 10.0x, 10.1x and 10.2x were found.
CVE-2016-4385, published 2016-09-29. High severity, CVSS 7.3. EPSS: 4.4% chance of exploitation in the next 30 days. The RMI service in HP Network Automation Software 9.1x, 9.2x, 10.0x before 10.00.02.01, and 10.1x before 10.11.00.01 allows remote attackers to execute arbitrary commands via a crafted serialized…
CVE-2011-2402, published 2011-08-01. Medium severity, CVSS 4.3. EPSS: 3.1% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in HP Network Automation 7.2x, 7.5x, 7.6x, 9.0, and 9.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Latest

CVE-2018-6493, published 2018-05-22. High severity, CVSS 8.8. EPSS: 2% chance of exploitation in the next 30 days. SQL Injection in HP Network Operations Management Ultimate, version 2017.07, 2017.11, 2018.02 and in Network Automation, version 10.00, 10.10, 10.11, 10.20, 10.30, 10.40, 10.50. This vulnerability…
CVE-2018-6492, published 2018-05-22. Medium severity, CVSS 6.1. EPSS: 1.6% chance of exploitation in the next 30 days. Persistent Cross-Site Scripting, and non-persistent HTML Injection in HP Network Operations Management Ultimate, version 2017.07, 2017.11, 2018.02 and in Network Automation, version 10.00, 10.10,…
CVE-2017-5813, published 2018-02-15. Medium severity, CVSS 6.3. EPSS: 1.9% chance of exploitation in the next 30 days. A remote unauthenticated access vulnerability in HPE Network Automation version 9.1x, 9.2x, 10.0x, 10.1x and 10.2x were found.
CVE-2016-4386, published 2016-09-29. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. HPE Network Automation Software 10.10 allows local users to write to arbitrary files via unspecified vectors.