Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
10 vulnerabilities by hp_inc
CVE-2024-8733 (GCVE-0-2024-8733)
Vulnerability from nvd – Published: 2024-10-02 19:12 – Updated: 2024-10-02 19:56
VLAI
EPSS
VEX
Title
HP One Agent Software – Potential Privilege Escalation
Summary
A potential security vulnerability
has been identified in the HP One Agent for certain HP PC products, which might
allow for escalation of privilege. HP is releasing software updates to mitigate
this potential vulnerability.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-02 19:54 UTC
CWE
- CWE-426 - Untrusted Search Path
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| HP, Inc. | HP One Agent Software |
Affected:
See HP security bulletin reference for affected versions
|
|
| hp_inc | hp_one_agent_software |
Unknown:
0
cpe:2.3:a:hp_inc:hp_one_agent_software:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:hp_inc:hp_one_agent_software:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "hp_one_agent_software",
"vendor": "hp_inc",
"versions": [
{
"status": "unknown",
"version": "0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-8733",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-02T19:54:59.090436Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-02T19:56:16.845Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "HP One Agent Software",
"vendor": "HP, Inc.",
"versions": [
{
"status": "affected",
"version": "See HP security bulletin reference for affected versions"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA potential security vulnerability\nhas been identified in the HP One Agent for certain HP PC products, which might\nallow for escalation of privilege. HP is releasing software updates to mitigate\nthis potential vulnerability. \u003c/p\u003e"
}
],
"value": "A potential security vulnerability\nhas been identified in the HP One Agent for certain HP PC products, which might\nallow for escalation of privilege. HP is releasing software updates to mitigate\nthis potential vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-426",
"description": "CWE-426 Untrusted Search Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-02T19:12:41.452Z",
"orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
"shortName": "hp"
},
"references": [
{
"url": "https://support.hp.com/us-en/document/ish_11270215-11270239-16"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "HP One Agent Software \u2013 Potential Privilege Escalation",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
"assignerShortName": "hp",
"cveId": "CVE-2024-8733",
"datePublished": "2024-10-02T19:12:41.452Z",
"dateReserved": "2024-09-11T20:32:46.648Z",
"dateUpdated": "2024-10-02T19:56:16.845Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-5760 (GCVE-0-2024-5760)
Vulnerability from nvd – Published: 2024-09-11 15:18 – Updated: 2024-09-11 17:22
VLAI
EPSS
VEX
Summary
The Samsung Universal Print Driver for Windows is potentially vulnerable to escalation of privilege allowing the creation of a reverse shell in the tool. This is only applicable for products in the application released or manufactured before 2018.
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-11 17:18 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| HP Inc. | Samsung Universal Print Driver |
Affected:
3.00.16.0101
|
|
| hp_inc | samsung_universal_print_driver |
Affected:
3.00.16.0101
cpe:2.3:a:hp_inc:samsung_universal_print_driver:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:hp_inc:samsung_universal_print_driver:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "samsung_universal_print_driver",
"vendor": "hp_inc",
"versions": [
{
"status": "affected",
"version": "3.00.16.0101"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-5760",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-11T17:18:53.606382Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-11T17:22:27.985Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Samsung Universal Print Driver",
"vendor": "HP Inc.",
"versions": [
{
"status": "affected",
"version": "3.00.16.0101"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Samsung Universal Print Driver for Windows is potentially vulnerable to escalation of privilege allowing the creation of a reverse shell in the tool. This is only applicable for products in the application released or manufactured before 2018."
}
],
"providerMetadata": {
"dateUpdated": "2024-09-11T15:18:31.777Z",
"orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
"shortName": "hp"
},
"references": [
{
"url": "https://support.hp.com/us-en/document/ish_11159589-11159645-16/hpsbpi03970"
}
],
"x_generator": {
"engine": "cveClient/1.0.15"
}
}
},
"cveMetadata": {
"assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
"assignerShortName": "hp",
"cveId": "CVE-2024-5760",
"datePublished": "2024-09-11T15:18:31.777Z",
"dateReserved": "2024-06-07T18:46:22.706Z",
"dateUpdated": "2024-09-11T17:22:27.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-27460 (GCVE-0-2024-27460)
Vulnerability from nvd – Published: 2024-05-10 20:23 – Updated: 2024-08-27 15:10
VLAI
EPSS
VEX
Summary
A privilege escalation exists in the updater for Plantronics Hub 3.25.1 and below.
Severity
6.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-13 18:14 UTC
CWE
- CWE-266 - Incorrect Privilege Assignment
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| HP Inc. | Plantronics Hub |
Affected:
3.25.1
|
|
| hp_inc | plantronics_hub |
Affected:
3.25.1
cpe:2.3:a:hp_inc:plantronics_hub:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:34:52.265Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://support.hp.com/us-en/document/ish_9869257-9869285-16/hpsbpy03895"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:hp_inc:plantronics_hub:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "plantronics_hub",
"vendor": "hp_inc",
"versions": [
{
"status": "affected",
"version": "3.25.1"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-27460",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-13T18:14:08.112317Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "CWE-266 Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-27T15:10:24.958Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Plantronics Hub",
"vendor": "HP Inc.",
"versions": [
{
"status": "affected",
"version": "3.25.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A privilege escalation exists in the updater for Plantronics Hub 3.25.1 and below."
}
],
"providerMetadata": {
"dateUpdated": "2024-05-10T20:23:40.777Z",
"orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
"shortName": "hp"
},
"references": [
{
"url": "https://support.hp.com/us-en/document/ish_9869257-9869285-16/hpsbpy03895"
}
],
"x_generator": {
"engine": "cveClient/1.0.15"
}
}
},
"cveMetadata": {
"assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
"assignerShortName": "hp",
"cveId": "CVE-2024-27460",
"datePublished": "2024-05-10T20:23:40.777Z",
"dateReserved": "2024-04-05T19:28:44.304Z",
"dateUpdated": "2024-08-27T15:10:24.958Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-2209 (GCVE-0-2024-2209)
Vulnerability from nvd – Published: 2024-03-26 23:49 – Updated: 2024-08-06 18:48
VLAI
EPSS
VEX
Title
HP Printer Firmware Update Utility for Certain HP DeskJet Printers - Potential Execution of Arbitrary Code
Summary
A user with administrative privileges can create a compromised dll file of the same name as the original dll within the HP printer’s Firmware Update Utility (FUU) bundle and place it in the Microsoft Windows default downloads directory which can lead to potential arbitrary code execution.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-06 18:40 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| HP, Inc. | HP Printer Firmware Update Utility |
Unknown:
See HP security bulletin reference for affected versions
|
|
| hp_inc | hp_printer_firmware_update_utility |
Unknown:
0
cpe:2.3:a:hp_inc:hp_printer_firmware_update_utility:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T19:03:39.393Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://support.hp.com/us-en/document/ish_10354903-10354932-16"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:hp_inc:hp_printer_firmware_update_utility:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "hp_printer_firmware_update_utility",
"vendor": "hp_inc",
"versions": [
{
"status": "unknown",
"version": "0"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-2209",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-06T18:40:34.729273Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-06T18:48:35.083Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "HP Printer Firmware Update Utility",
"vendor": "HP, Inc.",
"versions": [
{
"status": "unknown",
"version": "See HP security bulletin reference for affected versions"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A user with administrative privileges can create a compromised dll file of the same name as the original dll within the HP printer\u2019s Firmware Update Utility (FUU) bundle and place it in the Microsoft Windows default downloads directory which can lead to potential arbitrary code execution."
}
],
"providerMetadata": {
"dateUpdated": "2024-03-26T23:49:12.512Z",
"orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
"shortName": "hp"
},
"references": [
{
"url": "https://support.hp.com/us-en/document/ish_10354903-10354932-16"
}
],
"title": "HP Printer Firmware Update Utility for Certain HP DeskJet Printers - Potential Execution of Arbitrary Code",
"x_generator": {
"engine": "cveClient/1.0.15"
}
}
},
"cveMetadata": {
"assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
"assignerShortName": "hp",
"cveId": "CVE-2024-2209",
"datePublished": "2024-03-26T23:49:12.512Z",
"dateReserved": "2024-03-05T22:45:36.860Z",
"dateUpdated": "2024-08-06T18:48:35.083Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-5410 (GCVE-0-2023-5410)
Vulnerability from nvd – Published: 2024-03-12 20:01 – Updated: 2024-11-12 20:34
VLAI
EPSS
VEX
Summary
A potential security vulnerability has been reported in the system BIOS of certain HP PC products, which might allow memory tampering. HP is releasing mitigation for the potential vulnerability.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-23 14:04 UTC
CWE
- CWE-203 - Observable Discrepancy
Assigner
References
1 reference
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| HP Inc. | HP PC BIOS |
Affected:
See HP Security Bulletin reference for affected versions
|
|
| hp_inc | business_notebook_pcs |
Affected:
1.03.01 , ≤ 1.15.01
(custom)
cpe:2.3:o:hp_inc:business_notebook_pcs:*:*:*:*:*:*:*:* |
|
| hp_inc | business_desktop_pcs |
Affected:
2.12.02 , ≤ 2.12.03
(custom)
cpe:2.3:o:hp_inc:business_desktop_pcs:*:*:*:*:*:*:*:* |
|
| hp_inc | workstations |
Affected:
2.04.02
cpe:2.3:o:hp_inc:workstations:*:*:*:*:*:*:*:* |
|
| hp_inc | thin_client |
Affected:
1.09.01 , ≤ 1.15.01
(custom)
cpe:2.3:o:hp_inc:thin_client:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:hp_inc:business_notebook_pcs:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "business_notebook_pcs",
"vendor": "hp_inc",
"versions": [
{
"lessThanOrEqual": "1.15.01",
"status": "affected",
"version": "1.03.01",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:hp_inc:business_desktop_pcs:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "business_desktop_pcs",
"vendor": "hp_inc",
"versions": [
{
"lessThanOrEqual": "2.12.03",
"status": "affected",
"version": "2.12.02",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:hp_inc:workstations:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "workstations",
"vendor": "hp_inc",
"versions": [
{
"status": "affected",
"version": "2.04.02"
}
]
},
{
"cpes": [
"cpe:2.3:o:hp_inc:thin_client:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "thin_client",
"vendor": "hp_inc",
"versions": [
{
"lessThanOrEqual": "1.15.01",
"status": "affected",
"version": "1.09.01",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-5410",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-23T14:04:36.871281Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-203",
"description": "CWE-203 Observable Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-12T20:34:15.291Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T07:59:44.777Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://support.hp.com/us-en/document/ish_10290255-10290279-16/hpsbhf03924"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "HP PC BIOS",
"vendor": "HP Inc.",
"versions": [
{
"status": "affected",
"version": "See HP Security Bulletin reference for affected versions"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A potential security vulnerability has been reported in the system BIOS of certain HP PC products, which might allow memory tampering. HP is releasing mitigation for the potential vulnerability."
}
],
"providerMetadata": {
"dateUpdated": "2024-03-12T20:01:46.531Z",
"orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
"shortName": "hp"
},
"references": [
{
"url": "https://support.hp.com/us-en/document/ish_10290255-10290279-16/hpsbhf03924"
}
],
"x_generator": {
"engine": "cveClient/1.0.15"
}
}
},
"cveMetadata": {
"assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
"assignerShortName": "hp",
"cveId": "CVE-2023-5410",
"datePublished": "2024-03-12T20:01:46.531Z",
"dateReserved": "2023-10-04T18:22:43.127Z",
"dateUpdated": "2024-11-12T20:34:15.291Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-8733 (GCVE-0-2024-8733)
Vulnerability from cvelistv5 – Published: 2024-10-02 19:12 – Updated: 2024-10-02 19:56
VLAI
EPSS
VEX
Title
HP One Agent Software – Potential Privilege Escalation
Summary
A potential security vulnerability
has been identified in the HP One Agent for certain HP PC products, which might
allow for escalation of privilege. HP is releasing software updates to mitigate
this potential vulnerability.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-02 19:54 UTC
CWE
- CWE-426 - Untrusted Search Path
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| HP, Inc. | HP One Agent Software |
Affected:
See HP security bulletin reference for affected versions
|
|
| hp_inc | hp_one_agent_software |
Unknown:
0
cpe:2.3:a:hp_inc:hp_one_agent_software:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:hp_inc:hp_one_agent_software:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "hp_one_agent_software",
"vendor": "hp_inc",
"versions": [
{
"status": "unknown",
"version": "0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-8733",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-02T19:54:59.090436Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-02T19:56:16.845Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "HP One Agent Software",
"vendor": "HP, Inc.",
"versions": [
{
"status": "affected",
"version": "See HP security bulletin reference for affected versions"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA potential security vulnerability\nhas been identified in the HP One Agent for certain HP PC products, which might\nallow for escalation of privilege. HP is releasing software updates to mitigate\nthis potential vulnerability. \u003c/p\u003e"
}
],
"value": "A potential security vulnerability\nhas been identified in the HP One Agent for certain HP PC products, which might\nallow for escalation of privilege. HP is releasing software updates to mitigate\nthis potential vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-426",
"description": "CWE-426 Untrusted Search Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-02T19:12:41.452Z",
"orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
"shortName": "hp"
},
"references": [
{
"url": "https://support.hp.com/us-en/document/ish_11270215-11270239-16"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "HP One Agent Software \u2013 Potential Privilege Escalation",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
"assignerShortName": "hp",
"cveId": "CVE-2024-8733",
"datePublished": "2024-10-02T19:12:41.452Z",
"dateReserved": "2024-09-11T20:32:46.648Z",
"dateUpdated": "2024-10-02T19:56:16.845Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-5760 (GCVE-0-2024-5760)
Vulnerability from cvelistv5 – Published: 2024-09-11 15:18 – Updated: 2024-09-11 17:22
VLAI
EPSS
VEX
Summary
The Samsung Universal Print Driver for Windows is potentially vulnerable to escalation of privilege allowing the creation of a reverse shell in the tool. This is only applicable for products in the application released or manufactured before 2018.
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-11 17:18 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| HP Inc. | Samsung Universal Print Driver |
Affected:
3.00.16.0101
|
|
| hp_inc | samsung_universal_print_driver |
Affected:
3.00.16.0101
cpe:2.3:a:hp_inc:samsung_universal_print_driver:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:hp_inc:samsung_universal_print_driver:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "samsung_universal_print_driver",
"vendor": "hp_inc",
"versions": [
{
"status": "affected",
"version": "3.00.16.0101"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-5760",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-11T17:18:53.606382Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-11T17:22:27.985Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Samsung Universal Print Driver",
"vendor": "HP Inc.",
"versions": [
{
"status": "affected",
"version": "3.00.16.0101"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Samsung Universal Print Driver for Windows is potentially vulnerable to escalation of privilege allowing the creation of a reverse shell in the tool. This is only applicable for products in the application released or manufactured before 2018."
}
],
"providerMetadata": {
"dateUpdated": "2024-09-11T15:18:31.777Z",
"orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
"shortName": "hp"
},
"references": [
{
"url": "https://support.hp.com/us-en/document/ish_11159589-11159645-16/hpsbpi03970"
}
],
"x_generator": {
"engine": "cveClient/1.0.15"
}
}
},
"cveMetadata": {
"assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
"assignerShortName": "hp",
"cveId": "CVE-2024-5760",
"datePublished": "2024-09-11T15:18:31.777Z",
"dateReserved": "2024-06-07T18:46:22.706Z",
"dateUpdated": "2024-09-11T17:22:27.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-27460 (GCVE-0-2024-27460)
Vulnerability from cvelistv5 – Published: 2024-05-10 20:23 – Updated: 2024-08-27 15:10
VLAI
EPSS
VEX
Summary
A privilege escalation exists in the updater for Plantronics Hub 3.25.1 and below.
Severity
6.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-13 18:14 UTC
CWE
- CWE-266 - Incorrect Privilege Assignment
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| HP Inc. | Plantronics Hub |
Affected:
3.25.1
|
|
| hp_inc | plantronics_hub |
Affected:
3.25.1
cpe:2.3:a:hp_inc:plantronics_hub:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:34:52.265Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://support.hp.com/us-en/document/ish_9869257-9869285-16/hpsbpy03895"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:hp_inc:plantronics_hub:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "plantronics_hub",
"vendor": "hp_inc",
"versions": [
{
"status": "affected",
"version": "3.25.1"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-27460",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-13T18:14:08.112317Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "CWE-266 Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-27T15:10:24.958Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Plantronics Hub",
"vendor": "HP Inc.",
"versions": [
{
"status": "affected",
"version": "3.25.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A privilege escalation exists in the updater for Plantronics Hub 3.25.1 and below."
}
],
"providerMetadata": {
"dateUpdated": "2024-05-10T20:23:40.777Z",
"orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
"shortName": "hp"
},
"references": [
{
"url": "https://support.hp.com/us-en/document/ish_9869257-9869285-16/hpsbpy03895"
}
],
"x_generator": {
"engine": "cveClient/1.0.15"
}
}
},
"cveMetadata": {
"assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
"assignerShortName": "hp",
"cveId": "CVE-2024-27460",
"datePublished": "2024-05-10T20:23:40.777Z",
"dateReserved": "2024-04-05T19:28:44.304Z",
"dateUpdated": "2024-08-27T15:10:24.958Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-2209 (GCVE-0-2024-2209)
Vulnerability from cvelistv5 – Published: 2024-03-26 23:49 – Updated: 2024-08-06 18:48
VLAI
EPSS
VEX
Title
HP Printer Firmware Update Utility for Certain HP DeskJet Printers - Potential Execution of Arbitrary Code
Summary
A user with administrative privileges can create a compromised dll file of the same name as the original dll within the HP printer’s Firmware Update Utility (FUU) bundle and place it in the Microsoft Windows default downloads directory which can lead to potential arbitrary code execution.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-06 18:40 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| HP, Inc. | HP Printer Firmware Update Utility |
Unknown:
See HP security bulletin reference for affected versions
|
|
| hp_inc | hp_printer_firmware_update_utility |
Unknown:
0
cpe:2.3:a:hp_inc:hp_printer_firmware_update_utility:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T19:03:39.393Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://support.hp.com/us-en/document/ish_10354903-10354932-16"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:hp_inc:hp_printer_firmware_update_utility:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "hp_printer_firmware_update_utility",
"vendor": "hp_inc",
"versions": [
{
"status": "unknown",
"version": "0"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-2209",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-06T18:40:34.729273Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-06T18:48:35.083Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "HP Printer Firmware Update Utility",
"vendor": "HP, Inc.",
"versions": [
{
"status": "unknown",
"version": "See HP security bulletin reference for affected versions"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A user with administrative privileges can create a compromised dll file of the same name as the original dll within the HP printer\u2019s Firmware Update Utility (FUU) bundle and place it in the Microsoft Windows default downloads directory which can lead to potential arbitrary code execution."
}
],
"providerMetadata": {
"dateUpdated": "2024-03-26T23:49:12.512Z",
"orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
"shortName": "hp"
},
"references": [
{
"url": "https://support.hp.com/us-en/document/ish_10354903-10354932-16"
}
],
"title": "HP Printer Firmware Update Utility for Certain HP DeskJet Printers - Potential Execution of Arbitrary Code",
"x_generator": {
"engine": "cveClient/1.0.15"
}
}
},
"cveMetadata": {
"assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
"assignerShortName": "hp",
"cveId": "CVE-2024-2209",
"datePublished": "2024-03-26T23:49:12.512Z",
"dateReserved": "2024-03-05T22:45:36.860Z",
"dateUpdated": "2024-08-06T18:48:35.083Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-5410 (GCVE-0-2023-5410)
Vulnerability from cvelistv5 – Published: 2024-03-12 20:01 – Updated: 2024-11-12 20:34
VLAI
EPSS
VEX
Summary
A potential security vulnerability has been reported in the system BIOS of certain HP PC products, which might allow memory tampering. HP is releasing mitigation for the potential vulnerability.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-23 14:04 UTC
CWE
- CWE-203 - Observable Discrepancy
Assigner
References
1 reference
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| HP Inc. | HP PC BIOS |
Affected:
See HP Security Bulletin reference for affected versions
|
|
| hp_inc | business_notebook_pcs |
Affected:
1.03.01 , ≤ 1.15.01
(custom)
cpe:2.3:o:hp_inc:business_notebook_pcs:*:*:*:*:*:*:*:* |
|
| hp_inc | business_desktop_pcs |
Affected:
2.12.02 , ≤ 2.12.03
(custom)
cpe:2.3:o:hp_inc:business_desktop_pcs:*:*:*:*:*:*:*:* |
|
| hp_inc | workstations |
Affected:
2.04.02
cpe:2.3:o:hp_inc:workstations:*:*:*:*:*:*:*:* |
|
| hp_inc | thin_client |
Affected:
1.09.01 , ≤ 1.15.01
(custom)
cpe:2.3:o:hp_inc:thin_client:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:hp_inc:business_notebook_pcs:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "business_notebook_pcs",
"vendor": "hp_inc",
"versions": [
{
"lessThanOrEqual": "1.15.01",
"status": "affected",
"version": "1.03.01",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:hp_inc:business_desktop_pcs:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "business_desktop_pcs",
"vendor": "hp_inc",
"versions": [
{
"lessThanOrEqual": "2.12.03",
"status": "affected",
"version": "2.12.02",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:hp_inc:workstations:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "workstations",
"vendor": "hp_inc",
"versions": [
{
"status": "affected",
"version": "2.04.02"
}
]
},
{
"cpes": [
"cpe:2.3:o:hp_inc:thin_client:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "thin_client",
"vendor": "hp_inc",
"versions": [
{
"lessThanOrEqual": "1.15.01",
"status": "affected",
"version": "1.09.01",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-5410",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-23T14:04:36.871281Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-203",
"description": "CWE-203 Observable Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-12T20:34:15.291Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T07:59:44.777Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://support.hp.com/us-en/document/ish_10290255-10290279-16/hpsbhf03924"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "HP PC BIOS",
"vendor": "HP Inc.",
"versions": [
{
"status": "affected",
"version": "See HP Security Bulletin reference for affected versions"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A potential security vulnerability has been reported in the system BIOS of certain HP PC products, which might allow memory tampering. HP is releasing mitigation for the potential vulnerability."
}
],
"providerMetadata": {
"dateUpdated": "2024-03-12T20:01:46.531Z",
"orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
"shortName": "hp"
},
"references": [
{
"url": "https://support.hp.com/us-en/document/ish_10290255-10290279-16/hpsbhf03924"
}
],
"x_generator": {
"engine": "cveClient/1.0.15"
}
}
},
"cveMetadata": {
"assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
"assignerShortName": "hp",
"cveId": "CVE-2023-5410",
"datePublished": "2024-03-12T20:01:46.531Z",
"dateReserved": "2023-10-04T18:22:43.127Z",
"dateUpdated": "2024-11-12T20:34:15.291Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}