Threat database

The following HP Card Readers B Models (X3D03B & Y7C05B) are potentially vulnerable to information disclosure, allowing prior user identity to be inherited under certain conditions —e.g., when an NFC device (such as a smartphone/smartwatches) is in proximity during a card swipe event.

EPSS 0.2%VulnerabilityHP Inc.#cwe-200Germany+5

HP ThinPro 8.1 System management application failed to verify user's true id. HP has released HP ThinPro 8.1 SP8, which includes updates to mitigate potential vulnerabilities.

EPSS 0.3%VulnerabilityHP Inc.#cwe-250United States+9

A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.47.41.0. The vulnerability could potentially allow a local attacker to escalate privileges via an arbitrary file write.

EPSS 0.1%VulnerabilityHP Inc.#cwe-269United States+9

HyperX NGENUITY software is potentially vulnerable to arbitrary code execution. HP is releasing updated software to address the potential vulnerability.

EPSS 0.3%VulnerabilityHP Inc.#cwe-78Germany+7

Certain HP DesignJet products may be vulnerable to information disclosure though printer's web interface allowing unauthenticated users to view sensitive print job information.

EPSS 1.0%VulnerabilityHP Inc.#cwe-200Germany+7

A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vulnerability could deserialize untrusted data without validation. HP has addressed the issue in the latest software update.

EPSS 0.3%VulnerabilityHP Inc.#cwe-502Germany+6

A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The vulnerability could allow a bypass of the application's XSS filter by submitting untrusted characters. HP has addressed the issue in the latest software update.

EPSS 0.2%VulnerabilityHP Inc.#cwe-79Germany+6

A potential privilege escalation through Sudo vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The firmware flaw does not properly implement access controls. HP has addressed the issue in the latest software update.

EPSS 0.3%VulnerabilityHP Inc.#cwe-250Germany+6

A potential stored cross-site scripting vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The website allows user input to be stored and rendered without proper sanitization. HP has addressed the issue in the latest software update.

EPSS 0.2%VulnerabilityHP Inc.#cwe-79Germany+5

A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The vulnerability could potentially allow a privileged user to retrieve credentials from the log files. HP has addressed the issue in the latest software update.

EPSS 0.2%VulnerabilityHP Inc.#cwe-532Germany+6

A potential reflected cross-site scripting vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The website does not validate or sanitize the user input before rendering it in the response. HP has addressed the issue in the latest software update.

EPSS 0.2%VulnerabilityHP Inc.#cwe-79Germany+6

A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vulnerability could allow the retrieval of hardcoded cryptographic keys. HP has addressed the issue in the latest software update.

EPSS 0.2%VulnerabilityHP Inc.#cwe-321Germany+6

A potential SQL injection vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vulnerability could allow a privileged user to execute SQL commands. HP has addressed the issue in the latest software update.

EPSS 0.4%VulnerabilityHP Inc.#cwe-89Germany+6

A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vulnerability could allow the use and retrieval of the default password. HP has addressed the issue in the latest software update.

EPSS 0.2%VulnerabilityHP Inc.#cwe-1393Germany+7

A potential command injection vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The vulnerability could allow a privileged user to submit arbitrary input. HP has addressed the issue in the latest software update.

EPSS 0.3%VulnerabilityHP Inc.#cwe-78Germany+6

A potential security vulnerability has been identified in the HP Support Assistant, which allows a local attacker to escalate privileges via an arbitrary file deletion.

EPSS 0.1%VulnerabilityHP Inc.#cwe-269Germany+9

HP Universal Print Driver is potentially vulnerable to denial of service due to buffer overflow in versions of UPD 7.4 or older (e.g., v7.3.x, v7.2.x, v7.1.x, etc.).

EPSS 0.3%VulnerabilityHP Inc.#cwe-121Germany+9