Microfocus

Vulnerability in HP OpenView Network Node Manager (NMM) version 6.1 related to passwords.

Vulnerability in newgrp command in HP-UX 11.0 allows local users to gain privileges.

Vulnerability in HP TurboIMAGE DBUTIL allows local users to gain additional privileges via DBUTIL.PUB.SYS.

Buffer overflow in HP Openview Network Node Manager 6.1 allows remote attackers to execute arbitrary commands via the Alarm service (OVALARMSRV) on port 2345.

Vulnerability in shutdown command for HP-UX 11.X and 10.X allows allows local users to gain privileges via malformed input variables.

HP asecure creates the Audio Security File audio.sec with insecure permissions, which allows local users to cause a denial of service or gain additional privileges.

HP-UX 11.04 VirtualVault (VVOS) sends data to unprivileged processes via an interface that has multiple aliased IP addresses.

HP Ignite-UX does not save /etc/passwd when it creates an image of a trusted system, which can set the password field to a blank and allow an attacker to gain privileges.

The PMTU discovery procedure used by HP-UX 10.30 and 11.00 for determining the optimum MTU generates large amounts of traffic in response to small packets, allowing remote attackers to cause the system to be used as a packet amplifier.

HP VirtualVault with the PHSS_17692 patch allows unprivileged processes to bypass access restrictions via the Trusted Gateway Proxy (TGP).

The June 1999 version of the HP-UX aserver program allows local users to gain privileges by specifying an alternate PATH which aserver uses to find the awk command.

Multiple unknown vulnerabilities in the "r-cmnds" (1) remshd, (2) rexecd, (3) rlogind, (4) rlogin, (5) remsh, (6) rcp, (7) rexec, and (8) rdist for HP-UX 10.00 through 11.00 allow attackers to gain privileges or access files.

Vulnerability in HP Series 800 S/X/V Class servers allows remote attackers to gain access to the S/X/V Class console via the Service Support Processor (SSP) Teststation.

HP Secure Web Console uses weak encryption.

Buffer overflows in HP Software Distributor (SD) for HPUX 10.x and 11.x.

The default FTP configuration in HP Visualize Conference allows conference users to send a file to other participants without authorization.

HP CDE program includes the current directory in root's PATH variable.

Denial of service in Netscape Enterprise Server (NES) in HP Virtual Vault (VVOS) via a long URL.

Denial of service in Sendmail 8.8.6 in HPUX.

Local users can gain privileges using the debug utility in the MPE/iX operating system.

Domain Enterprise Server Management System (DESMS) in HP-UX allows local users to gain privileges.

Denial of service Netscape Enterprise Server with VirtualVault on HP-UX VVOS systems.

MC/ServiceGuard and MC/LockManager in HP-UX allows local users to gain privileges through SAM.

ftp on HP-UX 11.00 allows local users to gain privileges.

Vulnerability in HP Camera component of HP DCE/9000 in HP-UX 9.x allows attackers to gain root privileges.

rpc.pcnfsd in HP gives remote root access by changing the permissions on the main printer spool directory.

HP-UX aserver program allows local users to gain privileges via a symlink attack.

Denial of service in HP-UX sendmail 8.8.6 related to accepting connections.

A hidden SNMP community string in HP OpenView allows remote attackers to modify MIB tables and obtain sensitive information.

Denial of service in HP-UX SharedX recserv program.

Vulnerability in Predictive on HP-UX 11.0 and earlier, and MPE/iX 5.5 and earlier, allows attackers to compromise data transfer for Predictive messages (using e-mail or modem) between customer and Response Center Predictive systems.

Buffer overflow in NIS+, in Sun's rpc.nisd program.

HP OpenMail can be misconfigured to allow users to run arbitrary commands using malicious print requests.

MIME buffer overflow in email clients, e.g. Solaris mailtool and Outlook.

Denial of service of inetd on Linux through SYN and RST packets.

The AIX FTP client can be forced to execute commands from a malicious server through shell metacharacters (e.g. a pipe character).

HP Laserjet printers with JetDirect cards, when configured with TCP/IP, allow remote attackers to bypass print filters by directly sending PostScript documents to TCP ports 9099 and 9100.

HP Laserjet printers with JetDirect cards, when configured with TCP/IP, can be configured without a password, which allows remote attackers to connect to the printer and change its IP address or disable logging.

Vulnerability in telnet service in HP-UX 10.30 allows attackers to cause a denial of service.

Vulnerability in HP-UX mediainit program.

HP-UX 9.x and 10.x running X windows may allow local attackers to gain privileges via (1) vuefile, (2) vuepad, (3) dtfile, or (4) dtpad, which do not authenticate users.

Character-Terminal User Environment (CUE) in HP-UX 11.0 and earlier allows local users to overwrite arbitrary files and gain root privileges via a symlink attack on the IOERROR.mytty file.

Certain programs in HP-UX 10.20 do not properly handle large user IDs (UID) or group IDs (GID) over 60000, which could allow local users to gain privileges.

Buffer overflow in HPUX passwd command allows local users to gain root privileges via a command line option.

Buffer overflow in xmcd 2.0p12 allows local users to gain access through an environmental variable.

Vulnerability in ftpd/kftpd in HP-UX 10.x and 9.x allows local and possibly remote users to gain root privileges.

HP-UX vgdisplay program gives root access to local users.

Certain files in MPower in HP-UX 10.x are installed with insecure permissions, which allows local users to gain privileges.

Vulnerability in chsh command in HP-UX 9.X through 10.20 allows local users to gain privileges.

Vulnerability in Glance programs in GlancePlus for HP-UX 10.20 and earlier allows local users to access arbitrary files and gain privileges.