HP Palm Webos vulnerabilities

8 CVEs affecting HP Palm Webos, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2011-2409, published 2011-08-11.

More from HP.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2010-4025, published 2010-10-28. High severity, CVSS 9.3. EPSS: 6.9% chance of exploitation in the next 30 days. Unspecified vulnerability in Doc Viewer in HP Palm webOS 1.4.1 allows remote attackers to execute arbitrary code via a crafted document, as demonstrated by a Word document.
• CVE-2011-1737, published 2011-05-13. Medium severity, CVSS 4.3. EPSS: 1.7% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in the Email application in HP Palm webOS 1.4.5 and 1.4.5.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
• CVE-2010-4109, published 2010-12-08. Medium severity, CVSS 4.3. EPSS: 1.7% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the Contacts Application in HP Palm webOS before 2.0 allows remote attackers to inject arbitrary web script or HTML via a crafted vCard file.
• CVE-2011-2409, published 2011-08-11. Medium severity, CVSS 4.3. EPSS: 1.5% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the Calendar application in HP Palm webOS 3.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
• CVE-2011-2408, published 2011-08-11. Medium severity, CVSS 4.3. EPSS: 1.5% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the Contacts application in HP Palm webOS 3.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
• CVE-2010-4027, published 2010-10-28. Medium severity, CVSS 5.6. EPSS: 1.2% chance of exploitation in the next 30 days. Unspecified vulnerability in the camera application in HP Palm webOS 1.4.1 allows local users to overwrite arbitrary files via unknown vectors.
• CVE-2011-1738, published 2011-05-13. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. HP Palm webOS 1.4.5 and 1.4.5.1 does not properly restrict Plug-in Development Kit (PDK) applications, which allows local users to gain privileges by leveraging unintended filesystem write access.
• CVE-2010-4026, published 2010-10-28. Medium severity, CVSS 6.2. EPSS: 0.4% chance of exploitation in the next 30 days. Unspecified vulnerability in the service API in HP Palm webOS 1.4.1 allows local users to gain privileges by leveraging the ability to perform certain service calls.