Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
71 results · page 1 of 2
May 20, 2026Cross-Site Request Forgery (CSRF) vulnerability in InfoScale v.9.1.3 Operations Manager (VIOM) allows an attacker to force the user with an active session into CVE-2026-44925 · Other software · Veritas · reported by MITREHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in InfoScale v.9.1.3 Operations Manager (VIOM) allows an attacker to force the user with an active session into clicking a malicious HTML link, which triggers unintended modifications on VIOM web application without the user's knowledge.
- Product
- Infoscale Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportinfoscale.cloud.comveritas.com
May 20, 2026InfoScale VIOM 9.1.3 allows XSS.CVE-2026-44924 · Other software · Veritas · reported by MITREMedium 5.4
InfoScale VIOM 9.1.3 allows XSS.
- Product
- Infoscale Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportinfoscale.cloud.comveritas.com
May 20, 2026SQL injection in InfoScale VIOM before v9.1.3 allows remote attackers to escalate privileges.CVE-2026-44923 · Other software · Veritas · reported by MITREMedium 6.5
SQL injection in InfoScale VIOM before v9.1.3 allows remote attackers to escalate privileges.
- Product
- Infoscale Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportinfoscale.cloud.comveritas.com
Mar 10, 2026Improper input validation in System Center Operations Manager allows an authorized attacker to elevate privileges over a network.CVE-2026-20967 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper input validation in System Center Operations Manager allows an authorized attacker to elevate privileges over a network.
- Product
- System Center Operations Manager 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2024Open Management Infrastructure (OMI) Remote Code Execution VulnerabilityCVE-2024-21334 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
- Product
- System Center Operations Manager (SCOM) 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 12, 2024Open Management Infrastructure (OMI) Elevation of Privilege VulnerabilityCVE-2024-21330 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability
- Product
- System Center Operations Manager (SCOM) 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 14, 2023Open Management Infrastructure Information Disclosure VulnerabilityCVE-2023-36043 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Open Management Infrastructure Information Disclosure Vulnerability
- Product
- System Center Operations Manager (SCOM) 2022
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 17, 2023The XPRTLD web application in Veritas InfoScale Operations Manager (VIOM) before 8.0.0.410 allows an authenticated attacker to upload all types of files to the CVE-2023-38404 · Other software · Veritas · reported by MITREHigh 7.2
The XPRTLD web application in Veritas InfoScale Operations Manager (VIOM) before 8.0.0.410 allows an authenticated attacker to upload all types of files to the server. An authenticated attacker can then execute the malicious file to perform command execution on the remote server.
- Product
- Infoscale Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordveritas.comveritas.com
May 10, 2023An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2.800 and 8.x before 8.0.410.CVE-2023-32569 · Other software · Veritas · reported by MITREHigh 7.2
An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2.800 and 8.x before 8.0.410. The InfoScale VIOM web application is vulnerable to SQL Injection in some of the areas of the application. This allows attackers (who must have admin credentials) to submit arbitrary SQL commands on the back-end database to create, read, update, or delete any sensitive data stored in the database.
- Product
- Infoscale Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordveritas.comveritas.com
May 10, 2023An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2.800 and 8.x before 8.0.410.CVE-2023-32568 · Other software · Veritas · reported by MITREHigh 7.2
An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2.800 and 8.x before 8.0.410. The VIOM web application does not validate user-supplied data and appends it to OS commands and internal binaries used by the application. An attacker with root/administrator level privileges can leverage this to read sensitive data stored on the servers, modify data or server configuration, and delete data or application configuration.
- Product
- Infoscale Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordveritas.comveritas.com
Aug 9, 2022System Center Operations Manager: Open Management Infrastructure (OMI) Elevation of Privilege VulnerabilityCVE-2022-33640 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
System Center Operations Manager: Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability
- Product
- Open Management Infrastructure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 4, 2022An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100.CVE-2022-26484 · Other software · Veritas · reported by MITREMedium 4.9
An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100. The web server fails to sanitize admin/cgi-bin/rulemgr.pl/getfile/ input data, allowing a remote authenticated administrator to read arbitrary files on the system via Directory Traversal. By manipulating the resource name in GET requests referring to files with absolute paths, it is possible to access arbitrary files stored on the filesystem, including application source code, configuration files, and critical system files.
- Product
- Infoscale Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordveritas.comveritas.com
Mar 4, 2022An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100.CVE-2022-26483 · Other software · Veritas · reported by MITREMedium 4.8
An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100. A reflected cross-site scripting (XSS) vulnerability in admin/cgi-bin/listdir.pl allows authenticated remote administrators to inject arbitrary web script or HTML into an HTTP GET parameter (which reflect the user input without sanitization).
- Product
- Infoscale Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordveritas.comveritas.com
Oct 12, 2021SCOM Information Disclosure VulnerabilityCVE-2021-41352 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
SCOM Information Disclosure Vulnerability
- Product
- System Center 2016 Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Aug 30, 2021The vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in an end point.CVE-2021-22027 · Other software · VMware · reported by security@vmware.comHigh 7.5
The vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in an end point. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack leading to information disclosure.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2021The vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in an end point.CVE-2021-22026 · Other software · VMware · reported by security@vmware.comHigh 7.5
The vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in an end point. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack leading to information disclosure.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2021The vRealize Operations Manager API (8.x prior to 8.5) contains a broken access control vulnerability leading to unauthenticated API access.CVE-2021-22025 · Other software · VMware · reported by security@vmware.comHigh 7.5
The vRealize Operations Manager API (8.x prior to 8.5) contains a broken access control vulnerability leading to unauthenticated API access. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can add new nodes to existing vROps cluster.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2021The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary log-file read vulnerability.CVE-2021-22024 · Other software · VMware · reported by security@vmware.comHigh 7.5
The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary log-file read vulnerability. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can read any log file resulting in sensitive information disclosure.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2021The vRealize Operations Manager API (8.x prior to 8.5) has insecure object reference vulnerability.CVE-2021-22023 · Other software · VMware · reported by security@vmware.comHigh 7.2
The vRealize Operations Manager API (8.x prior to 8.5) has insecure object reference vulnerability. A malicious actor with administrative access to vRealize Operations Manager API may be able to modify other users information leading to an account takeover.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2021The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary file read vulnerability.CVE-2021-22022 · Other software · VMware · reported by security@vmware.comMedium 4.9
The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary file read vulnerability. A malicious actor with administrative access to vRealize Operations Manager API can read any arbitrary file on server leading to information disclosure.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2021Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network acceCVE-2021-21983 · Other software · VMware · reported by security@vmware.comMedium 6.5
Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating system.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvmware.com
Mar 31, 2021VMware Server Side Request Forgery in vRealize Operations Manager APICVE-2021-21975 · Other software · VMware · reported by security@vmware.comExploitedRansomwareHigh 7.5
Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.
- Product
- vRealize Operations Manager API
- On CISA’s list since
- Jan 18, 2022 (federal fix deadline Feb 1, 2022)
- What to do
- Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comvmware.com
Feb 25, 2021System Center Operations Manager Elevation of Privilege VulnerabilityCVE-2021-1728 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
System Center Operations Manager Elevation of Privilege Vulnerability
- Product
- System Center 2019 Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jun 9, 2020A spoofing vulnerability exists when System Center Operations Manager (SCOM) does not properly sanitize a specially crafted web request to an affected SCOM instCVE-2020-1331 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.4
A spoofing vulnerability exists when System Center Operations Manager (SCOM) does not properly sanitize a specially crafted web request to an affected SCOM instance, aka 'System Center Operations Manager Spoofing Vulnerability'.
- Product
- System Center 2016 Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Mar 7, 2019Pivotal Operations Manager, 2.1.x versions prior to 2.1.20, 2.2.x versions prior to 2.2.16, 2.3.x versions prior to 2.3.10, 2.4.x versions prior to 2.4.3, contaCVE-2019-3776 · Other software · Pivotal · reported by security_alert@emc.comHigh 7.2
Pivotal Operations Manager, 2.1.x versions prior to 2.1.20, 2.2.x versions prior to 2.2.16, 2.3.x versions prior to 2.3.10, 2.4.x versions prior to 2.4.3, contains a reflected cross site scripting vulnerability. A remote user that is able to convince an Operations Manager user to interact with malicious content could execute arbitrary JavaScript in the user's browser.
- Product
- Pivotal Ops Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.compivotal.io
Nov 2, 2018Pivotal Operations Manager, versions 2.0.x prior to 2.0.24, versions 2.1.x prior to 2.1.15, versions 2.2.x prior to 2.2.7, and versions 2.3.x prior to 2.3.1, grCVE-2018-15762 · Other software · Pivotal Cloud Foundry · reported by security_alert@emc.comCritical 9
Pivotal Operations Manager, versions 2.0.x prior to 2.0.24, versions 2.1.x prior to 2.1.15, versions 2.2.x prior to 2.2.7, and versions 2.3.x prior to 2.3.1, grants all users a scope which allows for privilege escalation. A remote malicious user who has been authenticated may create a new client with administrator privileges for Opsman.
- Product
- Pivotal Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2018Pivotal Operations Manager, versions 2.2.x prior to 2.2.1, 2.1.x prior to 2.1.11, 2.0.x prior to 2.0.16, and 1.11.x prior to 2, fails to write the Operations MaCVE-2018-11081 · Other software · Pivotal · reported by security_alert@emc.comHigh 7.9
Pivotal Operations Manager, versions 2.2.x prior to 2.2.1, 2.1.x prior to 2.1.11, 2.0.x prior to 2.0.16, and 1.11.x prior to 2, fails to write the Operations Manager UAA config onto the temp RAM disk, thus exposing the configs directly onto disk. A remote user that has gained access to the Operations Manager VM, can now file search and find the UAA credentials for Operations Manager on the system disk..
- Product
- pivotal-ops-manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2018RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG releases have an uncontrolled search vulnerability.CVE-2018-11049 · Other software · Pivotal · reported by security_alert@emc.comHigh 7.3
RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG releases have an uncontrolled search vulnerability. The installation scripts set an environment variable in an unintended manner. A local authenticated malicious user could trick the root user to run malicious code on the targeted system.
- Product
- Pivotal Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsecurityfocus.com
Jul 11, 2018Pivotal Operations Manager, versions 2.1 prior to 2.1.6 and 2.0 prior to 2.0.15 and 1.12 prior to 1.12.22, contains a static Linux Random Number Generator (LRNGCVE-2018-11045 · Other software · Pivotal · reported by security_alert@emc.comMedium 5.9
Pivotal Operations Manager, versions 2.1 prior to 2.1.6 and 2.0 prior to 2.0.15 and 1.12 prior to 1.12.22, contains a static Linux Random Number Generator (LRNG) seed file embedded in the appliance image. An attacker with knowledge of the exact version and IaaS of a running OpsManager could get the contents of the corresponding seed from the published image and therefore infer the initial state of the LRNG.
- Product
- Pivotal Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2018Pivotal Operations Manager, versions 2.1.x prior to 2.1.6 and version 2.0.14, includes NGINX packages that lacks security vulnerability patches.CVE-2018-11046 · Other software · Pivotal · reported by security_alert@emc.comMedium 6.5
Pivotal Operations Manager, versions 2.1.x prior to 2.1.6 and version 2.0.14, includes NGINX packages that lacks security vulnerability patches. An attacker with access to the NGINX processes and knowledge of how to exploit the unpatched vulnerabilities may be able to impact Operations Manager
- Product
- Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.compivotal.io
Dec 21, 2017Cross-Site Scripting (XSS) vulnerability has been identified in Micro Focus Operations Manager i, versions 10.60, 10.61, 10.62.CVE-2017-14363 · Other software · Micro Focus · reported by security@opentext.comMedium 5.9
Cross-Site Scripting (XSS) vulnerability has been identified in Micro Focus Operations Manager i, versions 10.60, 10.61, 10.62. The vulnerability could be remotely exploited to allow Cross-Site Scripting (XSS).
- Product
- Operations Manager i
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsoftwaresupport.softwaregrp.comsoftwaresupport.softwaregrp.com
Sep 17, 2016Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.19 and 1.7.x before 1.7.10, when vCloud or vSphere is used, has a default password for compilation VMs, whichCVE-2016-0930 · Other software · Pivotal · reported by security_alert@emc.comCritical 9.8
Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.19 and 1.7.x before 1.7.10, when vCloud or vSphere is used, has a default password for compilation VMs, which allows remote attackers to obtain SSH access by connecting within an installation-time period during which these VMs exist.
- Product
- Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.compivotal.io
Sep 17, 2016Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.17 and 1.7.x before 1.7.8, when vCloud or vSphere is used, does not properly enable SSH access for operators,CVE-2016-0897 · Other software · Pivotal Software · reported by security_alert@emc.comCritical 9.8
Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.17 and 1.7.x before 1.7.8, when vCloud or vSphere is used, does not properly enable SSH access for operators, which has unspecified impact and remote attack vectors.
- Product
- Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2016Pivotal Cloud Foundry (PCF) Ops Manager before 1.5.14 and 1.6.x before 1.6.9 uses the same cookie-encryption key across different customers' installations, whicCVE-2016-0883 · Other software · Pivotal Software · reported by security_alert@emc.comCritical 9.8
Pivotal Cloud Foundry (PCF) Ops Manager before 1.5.14 and 1.6.x before 1.6.9 uses the same cookie-encryption key across different customers' installations, which allows remote attackers to bypass session authentication by leveraging knowledge of this key from another installation.
- Product
- Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2016Cross-site scripting (XSS) vulnerability in the AdminUI in HPE Operations Manager 9.21.x before 9.21.130 allows remote authenticated users to inject arbitrary wCVE-2016-4380 · Other software · HP · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in the AdminUI in HPE Operations Manager 9.21.x before 9.21.130 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jul 31, 2016The AdminUI in HPE Operations Manager (OM) before 9.21.130 on Linux, Unix, and Solaris allows remote attackers to execute arbitrary commands via a crafted seriaCVE-2016-4373 · Other software · HP · reported by MITRECritical 9.8
The AdminUI in HPE Operations Manager (OM) before 9.21.130 on Linux, Unix, and Solaris allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
- Product
- Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comh20566.www2.hpe.com
Jan 30, 2016HPE Operations Manager 8.x and 9.0 on Windows allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache CVE-2016-1985 · Other software · HP · reported by MITRECritical 10
HPE Operations Manager 8.x and 9.0 on Windows allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
- Product
- Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comh20566.www2.hpe.com
Aug 22, 2015Unspecified vulnerability in HP Operations Manager i (OMi) 9.22, 9.23, 9.24, 9.25, 10.00, and 10.01 allows remote attackers to execute arbitrary code via unknowCVE-2015-2137 · Other software · HP · reported by hp-security-alert@hp.comHigh 10
Unspecified vulnerability in HP Operations Manager i (OMi) 9.22, 9.23, 9.24, 9.25, 10.00, and 10.01 allows remote attackers to execute arbitrary code via unknown vectors.
- Product
- Operations Manager I
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comh20564.www2.hpe.com
Aug 22, 2015Unspecified vulnerability in the execve system-call implementation in HP HP-UX B.11.11, B.11.23, and B.11.31 allows local users to gain privileges via unknown vCVE-2015-2132 · Other software · HP · reported by hp-security-alert@hp.comMedium 4.4
Unspecified vulnerability in the execve system-call implementation in HP HP-UX B.11.11, B.11.23, and B.11.31 allows local users to gain privileges via unknown vectors.
- Product
- Operations Manager I
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordh20564.www2.hpe.comh20564.www2.hpe.com
Aug 14, 2015Cross-site scripting (XSS) vulnerability in Microsoft System Center 2012 Operations Manager Gold before Rollup 8, SP1 before Rollup 10, and R2 before Rollup 7 aCVE-2015-2420 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Cross-site scripting (XSS) vulnerability in Microsoft System Center 2012 Operations Manager Gold before Rollup 8, SP1 before Rollup 10, and R2 before Rollup 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "System Center Operations Manager Web Console XSS Vulnerability."
- Product
- System Center Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comdocs.microsoft.com
Mar 13, 2015HP Operations Manager i Management Pack 1.x before 1.01 for SAP allows local users to execute OS commands by leveraging SAP administrative privileges.CVE-2015-2107 · Other software · HP · reported by hp-security-alert@hp.comMedium 6.8
HP Operations Manager i Management Pack 1.x before 1.01 for SAP allows local users to execute OS commands by leveraging SAP administrative privileges.
- Product
- Operations Manager I Management Pack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordh20564.www2.hp.comsecuritytracker.com
Oct 18, 2014Cross-site scripting (XSS) vulnerability in HP Operations Agent in HP Operations Manager (formerly OpenView Communications Broker) before 11.14 allows remote atCVE-2014-2647 · Other software · HP · reported by hp-security-alert@hp.comMedium 4.3
Cross-site scripting (XSS) vulnerability in HP Operations Agent in HP Operations Manager (formerly OpenView Communications Broker) before 11.14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Operations Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comh20564.www2.hp.com
Oct 9, 2014Unspecified vulnerability in HP Operations Manager 9.20 on UNIX allows remote attackers to execute arbitrary code via unknown vectors.CVE-2014-2649 · Other software · HP · reported by hp-security-alert@hp.comHigh 7.5
Unspecified vulnerability in HP Operations Manager 9.20 on UNIX allows remote attackers to execute arbitrary code via unknown vectors.
- Product
- Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordh20564.www2.hp.comh20564.www2.hp.com
Oct 9, 2014Unspecified vulnerability in HP Operations Manager 9.10 and 9.11 on UNIX allows remote attackers to execute arbitrary code via unknown vectors.CVE-2014-2648 · Other software · HP · reported by hp-security-alert@hp.comHigh 10
Unspecified vulnerability in HP Operations Manager 9.10 and 9.11 on UNIX allows remote attackers to execute arbitrary code via unknown vectors.
- Product
- Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordh20564.www2.hp.comh20564.www2.hp.com
Aug 29, 2014vmtadmin.cgi in VMTurbo Operations Manager before 4.6 build 28657 allows remote attackers to execute arbitrary commands via shell metacharacters in the fileDateCVE-2014-5073 · Other software · Vmturbo · reported by MITREHigh 7.5
vmtadmin.cgi in VMTurbo Operations Manager before 4.6 build 28657 allows remote attackers to execute arbitrary commands via shell metacharacters in the fileDate parameter in a DOWN call.
- Product
- Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddisse.cting.orgpacketstormsecurity.com
Aug 14, 2014Cross-site scripting (XSS) vulnerability in Fujitsu ServerView Operations Manager 5.00.09 through 6.30.05 allows remote attackers to inject arbitrary web scriptCVE-2014-3898 · Other software · Fujitsu · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in Fujitsu ServerView Operations Manager 5.00.09 through 6.30.05 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Serverview Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjp.fujitsu.comjp.fujitsu.com
May 25, 2014Unspecified vulnerability in HP Operations Manager i 9.1 through 9.13 and 9.2 through 9.24 allows remote authenticated users to execute arbitrary code by leveraCVE-2014-2607 · Other software · HP · reported by hp-security-alert@hp.comHigh 8.5
Unspecified vulnerability in HP Operations Manager i 9.1 through 9.13 and 9.2 through 9.24 allows remote authenticated users to execute arbitrary code by leveraging the OMi operator role.
- Product
- Operations Manager I
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordh20564.www2.hp.comh20564.www2.hp.com
May 21, 2014Directory traversal vulnerability in cgi-bin/help/doIt.cgi in VMTurbo Operations Manager before 4.6 allows remote attackers to read arbitrary files via a ..CVE-2014-3806 · Other software · Vmturbo · reported by MITREMedium 5
Directory traversal vulnerability in cgi-bin/help/doIt.cgi in VMTurbo Operations Manager before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the xml_path parameter.
- Product
- Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.com
Jan 23, 2014Cisco Video Surveillance Operations Manager (VSOM) does not require authentication for MySQL database connections, which allows remote attackers to obtain sensiCVE-2014-0674 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.8
Cisco Video Surveillance Operations Manager (VSOM) does not require authentication for MySQL database connections, which allows remote attackers to obtain sensitive information, modify data, or cause a denial of service by leveraging network connectivity from a client system with a crafted host name, aka Bug ID CSCud10992.
- Product
- Video Surveillance Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2013The administrative web interface in Cisco Video Surveillance Operations Manager does not properly perform authentication, which allows remote attackers to watchCVE-2013-3417 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5
The administrative web interface in Cisco Video Surveillance Operations Manager does not properly perform authentication, which allows remote attackers to watch video feeds via a crafted URL, aka Bug ID CSCtg72262.
- Product
- Video Surveillance Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.