HP Openvms vulnerabilities

23 CVEs affecting HP Openvms, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-17482, published 2018-02-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-5477: ISC BIND Data Processing Errors Vulnerability, published 2015-07-29. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2026-10-08. EPSS: 99.4% chance of exploitation in the next 30 days. named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.
CVE-2008-5120, published 2008-11-18. High severity, CVSS 10.0. EPSS: 9.9% chance of exploitation in the next 30 days. Stack-based buffer overflow in the Process Software MultiNet finger service (aka FINGERD) for HP OpenVMS 8.3 allows remote attackers to execute arbitrary code via a long request string.
CVE-2006-3686, published 2006-07-21. Medium severity, CVSS 5.0. EPSS: 2.5% chance of exploitation in the next 30 days. Unspecified vulnerability in [SYSEXE]SMPUTIL.EXE in HP OpenVMS 7.3-2 allows local users and "remote users" to cause a denial of service (crash).
CVE-2007-5241, published 2007-10-06. Medium severity, CVSS 5.0. EPSS: 2.4% chance of exploitation in the next 30 days. Buffer overflow in NET$CSMACD.EXE in HP OpenVMS 8.3 and earlier allows local users to cause a denial of service (machine crash) via the "MCR MCL SHOW CSMA-CD Port * All" command, which overwrites a…
CVE-2012-3277, published 2012-12-13. Medium severity, CVSS 5.0. EPSS: 2.4% chance of exploitation in the next 30 days. HP OpenVMS 8.3, 8.3-1H1, and 8.4 on the Itanium platform and 7.3-2, 8.2, 8.3, and 8.4 on the Alpha platform does not properly implement the LOGIN and ACME_SERVER ACMELOGIN programs, which allows…
CVE-2007-0139, published 2007-01-09. High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days. Unspecified vulnerability in the DECnet-Plus 7.3-2 feature in DECnet/OSI 7.3-2 for OpenVMS ALPHA, and the DECnet-Plus 7.3 feature in DECnet/OSI 7.3 for OpenVMS VAX, allows attackers to obtain…
CVE-2007-5242, published 2007-10-06. Medium severity, CVSS 4.3. EPSS: 2.1% chance of exploitation in the next 30 days. Unspecified vulnerability in (1) SYS$EI1000.EXE and (2) SYS$EI1000_MON.EXE in HP OpenVMS 8.3 and earlier allows remote attackers to cause a denial of service (machine crash) via an "oversize" packet,…
CVE-2007-3729, published 2007-07-12. Medium severity, CVSS 5.0. EPSS: 2% chance of exploitation in the next 30 days. The default configuration of the POP server in TCP/IP Services 5.6 for HP OpenVMS 8.3 generates different responses depending on whether or not a username is valid, which allows remote attackers to…
CVE-2007-3730, published 2007-07-12. Medium severity, CVSS 5.0. EPSS: 1.9% chance of exploitation in the next 30 days. The default configuration of the POP server in TCP/IP Services 5.6 for HP OpenVMS 8.3 does not log the source IP address or attempted username for login attempts, which might help remote attackers to…
CVE-2017-17482, published 2018-02-07. High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days. An issue was discovered in OpenVMS through V8.4-2L2 on Alpha and through V8.4-2L1 on IA64, and VAX/VMS 4.0 and later. A malformed DCL command table may result in a buffer overflow allowing a local…

Latest

CVE-2012-3276, published 2012-12-13. Low severity, CVSS 2.1. EPSS: 0.5% chance of exploitation in the next 30 days. HP OpenVMS 8.3, 8.3-1H1, and 8.4 on the Itanium platform and 7.3-2, 8.2, 8.3, and 8.4 on the Alpha platform does not properly implement the LOGIN and ACME_SERVER ACMELOGIN programs, which allows…
CVE-2012-2010, published 2012-05-18. Medium severity, CVSS 6.9. EPSS: 0.4% chance of exploitation in the next 30 days. The ACMELOGIN implementation in HP OpenVMS 8.3 and 8.4 on the Alpha platform, and 8.3, 8.3-1H1, and 8.4 on the Itanium platform, when the SYS$ACM system service is enabled, allows local users to gain…
CVE-2012-0134, published 2012-04-19. Medium severity, CVSS 4.9. EPSS: 0.4% chance of exploitation in the next 30 days. Unspecified vulnerability in HP OpenVMS 7.3-2 on the Alpha platform, 8.3 and 8.4 on the Alpha and IA64 platforms, and 8.3-1h1 on the IA64 platform allows local users to cause a denial of service via…
CVE-2010-4110, published 2010-12-22. Medium severity, CVSS 5.7. EPSS: 0.3% chance of exploitation in the next 30 days. Unspecified vulnerability in HP OpenVMS 8.3, 8.3-1H1, and 8.4 on the Itanium platform on Integrity servers allows local users to gain privileges or cause a denial of service via unknown vectors.
CVE-2010-1973, published 2010-07-22. Medium severity, CVSS 6.8. EPSS: 0.3% chance of exploitation in the next 30 days. Unspecified vulnerability in the Auditing subsystem in HP OpenVMS 8.3, 8.2, 7.3-2, and earlier on the ALPHA platform, and 8.3-1H1, 8.3, 8.2-1, and earlier on the Itanium platform, allows local users…
CVE-2010-2612, published 2010-07-02. Low severity, CVSS 2.1. EPSS: 0.5% chance of exploitation in the next 30 days. Unspecified vulnerability in the HP OpenVMS Auditing feature in OpenVMS ALPHA 7.3-2, 8.2, and 8.3; and OpenVMS for Integrity Servers 8.3 AND 8.3-1H1; allows local users to obtain sensitive…