HP Operations Manager vulnerabilities

9 CVEs affecting HP Operations Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-4380, published 2016-09-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2009-3843, published 2009-11-24. High severity, CVSS 10.0. EPSS: 79% chance of exploitation in the next 30 days. HP Operations Manager 8.10 on Windows contains a "hidden account" in the XML file that specifies Tomcat users, which allows remote attackers to conduct unrestricted file upload attacks, and thereby…
CVE-2009-4189, published 2009-12-03. High severity, CVSS 10.0. EPSS: 78.5% chance of exploitation in the next 30 days. HP Operations Manager has a default password of OvW*busr1 for the ovwebusr account, which allows remote attackers to execute arbitrary code via a session that uses the manager role to conduct…
CVE-2010-1033, published 2010-04-21. High severity, CVSS 9.3. EPSS: 12.4% chance of exploitation in the next 30 days. Multiple stack-based buffer overflows in a certain Tetradyne ActiveX control in HP Operations Manager 7.5, 8.10, and 8.16 might allow remote attackers to execute arbitrary code via a long string…
CVE-2009-3099, published 2009-09-08. High severity, CVSS 10.0. EPSS: 9.6% chance of exploitation in the next 30 days. Unspecified vulnerability in HP OpenView Operations Manager 8.1 on Windows Server 2003 SP2 allows remote attackers to have an unknown impact, related to a "Remote exploit," as demonstrated by a…
CVE-2014-2648, published 2014-10-10. High severity, CVSS 10.0. EPSS: 8.9% chance of exploitation in the next 30 days. Unspecified vulnerability in HP Operations Manager 9.10 and 9.11 on UNIX allows remote attackers to execute arbitrary code via unknown vectors.
CVE-2016-1985, published 2016-01-30. Critical severity, CVSS 10.0. EPSS: 6.6% chance of exploitation in the next 30 days. HPE Operations Manager 8.x and 9.0 on Windows allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
CVE-2014-2649, published 2014-10-10. High severity, CVSS 7.5. EPSS: 6.4% chance of exploitation in the next 30 days. Unspecified vulnerability in HP Operations Manager 9.20 on UNIX allows remote attackers to execute arbitrary code via unknown vectors.
CVE-2016-4373, published 2016-08-01. Critical severity, CVSS 9.8. EPSS: 4.4% chance of exploitation in the next 30 days. The AdminUI in HPE Operations Manager (OM) before 9.21.130 on Linux, Unix, and Solaris allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the…
CVE-2016-4380, published 2016-09-08. Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the AdminUI in HPE Operations Manager 9.21.x before 9.21.130 allows remote authenticated users to inject arbitrary web script or HTML via unspecified…