HP HP

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any HP product.

RSS Feeds for HP security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in HP products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by HP Sorted by Most Security Vulnerabilities since 2018

HP Instantos56 vulnerabilities

Hp Ux48 vulnerabilities

HP Oneview22 vulnerabilities

HP Support Assistant14 vulnerabilities

HP Icewall Federation Agent10 vulnerabilities

HP Arubaos8 vulnerabilities

HP Icewall File Manager7 vulnerabilities

HP Security Manager5 vulnerabilities

Hp Device Manager5 vulnerabilities

HP Airwave4 vulnerabilities

HP Pc Hardware Diagnostics3 vulnerabilities

HP Systems Insight Manager3 vulnerabilities

HP Omen Gaming Hub2 vulnerabilities

HP Server Migration Pack2 vulnerabilities

HP Image Assistant2 vulnerabilities

HP Print And Scan Doctor2 vulnerabilities

By the Year

In 2025 there have been 0 vulnerabilities in HP. Last year, in 2024 HP had 37 security vulnerabilities published. Right now, HP is on track to have less security vulnerabilities in 2025 than it did last year.




Year Vulnerabilities Average Score
2025 0 0.00
2024 37 8.00
2023 65 8.21
2022 35 7.78
2021 14 8.07
2020 88 8.99
2019 154 8.02
2018 76 6.63

It may take a day or so for new HP vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.

Recent HP Security Vulnerabilities

This vulnerability could be exploited

CVE-2024-42508 5.5 - Medium - October 18, 2024

This vulnerability could be exploited, leading to unauthorized disclosure of information to authenticated users.

HP Security Manager is potentially vulnerable to Remote Code Execution as a result of code vulnerability within the product's solution open-source libraries.

CVE-2024-7720 9.8 - Critical - August 27, 2024

HP Security Manager is potentially vulnerable to Remote Code Execution as a result of code vulnerability within the product's solution open-source libraries.

A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices

CVE-2024-41912 9.8 - Critical - August 07, 2024

A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly implement access controls.

Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol

CVE-2024-42400 5.3 - Medium - August 06, 2024

Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.

Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol

CVE-2024-42398 5.3 - Medium - August 06, 2024

Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.

Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol

CVE-2024-42399 5.3 - Medium - August 06, 2024

Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.

There is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an unauthenticated RCE attack

CVE-2024-42395 9.8 - Critical - August 06, 2024

There is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.

Memory Corruption

There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack

CVE-2024-42394 9.8 - Critical - August 06, 2024

There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.

Memory Corruption

There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack

CVE-2024-42393 9.8 - Critical - August 06, 2024

There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.

Memory Corruption

Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed

CVE-2024-42396 5.3 - Medium - August 06, 2024

Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.

Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed

CVE-2024-42397 5.3 - Medium - August 06, 2024

Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.

A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices

CVE-2024-41913 8.8 - High - August 06, 2024

A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly sanitize User input.

Unrestricted File Upload

A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices

CVE-2024-41911 5.4 - Medium - August 06, 2024

A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The flaw does not properly neutralize input during a web page generation.

XSS

A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices

CVE-2024-41910 6.1 - Medium - August 06, 2024

A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware contained multiple XSS vulnerabilities in the version of JavaScript used.

XSS

The vulnerability could be remotely exploited to bypass authentication.

CVE-2024-22442 9.8 - Critical - July 16, 2024

The vulnerability could be remotely exploited to bypass authentication.

Poly Plantronics Hub Link Following Local Privilege Escalation Vulnerability

CVE-2024-6147 7.8 - High - June 20, 2024

Poly Plantronics Hub Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Poly Plantronics Hub. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Spokes Update Service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18271.

insecure temporary file

There are buffer overflow vulnerabilities in the underlying CLI service

CVE-2024-31467 9.8 - Critical - May 14, 2024

There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.

There are buffer overflow vulnerabilities in the underlying Central Communications service

CVE-2024-31468 9.8 - Critical - May 14, 2024

There are buffer overflow vulnerabilities in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.

There are buffer overflow vulnerabilities in the underlying Central Communications service

CVE-2024-31469 9.8 - Critical - May 14, 2024

There are buffer overflow vulnerabilities in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.

There is a buffer overflow vulnerability in the underlying SAE (Simultaneous Authentication of Equals) service

CVE-2024-31470 9.8 - Critical - May 14, 2024

There is a buffer overflow vulnerability in the underlying SAE (Simultaneous Authentication of Equals) service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

There is a command injection vulnerability in the underlying Central Communications service

CVE-2024-31471 9.8 - Critical - May 14, 2024

There is a command injection vulnerability in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

There are command injection vulnerabilities in the underlying Soft AP Daemon service

CVE-2024-31472 9.8 - Critical - May 14, 2024

There are command injection vulnerabilities in the underlying Soft AP Daemon service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.

There is a command injection vulnerability in the underlying deauthentication service

CVE-2024-31473 9.8 - Critical - May 14, 2024

There is a command injection vulnerability in the underlying deauthentication service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

There is an arbitrary file deletion vulnerability in the CLI service accessed by PAPI (Aruba's Access Point management protocol)

CVE-2024-31474 8.2 - High - May 14, 2024

There is an arbitrary file deletion vulnerability in the CLI service accessed by PAPI (Aruba's Access Point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the affected Access Point

There is an arbitrary file deletion vulnerability in the Central Communications service accessed by PAPI (Aruba's access point management protocol)

CVE-2024-31475 8.2 - High - May 14, 2024

There is an arbitrary file deletion vulnerability in the Central Communications service accessed by PAPI (Aruba's access point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the affected Access Point.

Multiple authenticated command injection vulnerabilities exist in the command line interface

CVE-2024-31476 8.8 - High - May 14, 2024

Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

Multiple authenticated command injection vulnerabilities exist in the command line interface

CVE-2024-31477 8.8 - High - May 14, 2024

Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exists in the Soft AP daemon accessed via the PAPI protocol

CVE-2024-31478 7.5 - High - May 14, 2024

Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exists in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilites result in the ability to interrupt the normal operation of the affected Access Point.

Unauthenticated Denial of Service (DoS) vulnerabilities exist in the Central Communications service accessed via the PAPI protocol

CVE-2024-31479 7.5 - High - May 14, 2024

Unauthenticated Denial of Service (DoS) vulnerabilities exist in the Central Communications service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service.

Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol

CVE-2024-31480 7.5 - High - May 14, 2024

Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service.

Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol

CVE-2024-31481 7.5 - High - May 14, 2024

Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service.

An unauthenticated Denial-of-Service (DoS) vulnerability exists in the ANSI escape code service accessed via the PAPI protocol

CVE-2024-31482 7.5 - High - May 14, 2024

An unauthenticated Denial-of-Service (DoS) vulnerability exists in the ANSI escape code service accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected Access Point.

An authenticated sensitive information disclosure vulnerability exists in the CLI service accessed via the PAPI protocol

CVE-2024-31483 6.5 - Medium - May 14, 2024

An authenticated sensitive information disclosure vulnerability exists in the CLI service accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to read arbitrary files in the underlying operating system.

There are buffer overflow vulnerabilities in the underlying CLI service

CVE-2024-31466 9.8 - Critical - May 14, 2024

There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.

HPE OneView may have a missing passphrase during restore.

CVE-2023-6573 5.5 - Medium - January 23, 2024

HPE OneView may have a missing passphrase during restore.

HPE OneView may allow command injection with local privilege escalation.

CVE-2023-50274 7.8 - High - January 23, 2024

HPE OneView may allow command injection with local privilege escalation.

Command Injection

HPE OneView may allow clusterService Authentication Bypass resulting in denial of service.

CVE-2023-50275 7.5 - High - January 23, 2024

HPE OneView may allow clusterService Authentication Bypass resulting in denial of service.

authentification

There are arbitrary file deletion vulnerabilities in the AirWave client service accessed by PAPI (Aruba's access point management protocol)

CVE-2023-45618 8.2 - High - November 14, 2023

There are arbitrary file deletion vulnerabilities in the AirWave client service accessed by PAPI (Aruba's access point management protocol). Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the access point.

There are arbitrary file deletion vulnerabilities in the CLI service accessed by PAPI (Aruba's access point management protocol)

CVE-2023-45617 8.2 - High - November 14, 2023

There are arbitrary file deletion vulnerabilities in the CLI service accessed by PAPI (Aruba's access point management protocol). Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the access point.

There is a buffer overflow vulnerability in the underlying AirWave client service

CVE-2023-45616 9.8 - Critical - November 14, 2023

There is a buffer overflow vulnerability in the underlying AirWave client service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

Classic Buffer Overflow

An unauthenticated Denial-of-Service (DoS) vulnerability exists in the soft ap daemon accessed via the PAPI protocol

CVE-2023-45624 7.5 - High - November 14, 2023

An unauthenticated Denial-of-Service (DoS) vulnerability exists in the soft ap daemon accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected access point.

Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Wi-Fi Uplink service accessed via the PAPI protocol

CVE-2023-45623 7.5 - High - November 14, 2023

Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Wi-Fi Uplink service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected access point.

Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the BLE daemon service accessed via the PAPI protocol

CVE-2023-45622 7.5 - High - November 14, 2023

Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the BLE daemon service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected access point.

Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol

CVE-2023-45621 7.5 - High - November 14, 2023

Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected access point.

There is an arbitrary file deletion vulnerability in the RSSI service accessed by PAPI (Aruba's access point management protocol)

CVE-2023-45619 8.2 - High - November 14, 2023

There is an arbitrary file deletion vulnerability in the RSSI service accessed by PAPI (Aruba's access point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the access point.

An authenticated Denial-of-Service (DoS) vulnerability exists in the CLI service

CVE-2023-45627 6.5 - Medium - November 14, 2023

An authenticated Denial-of-Service (DoS) vulnerability exists in the CLI service. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected access point.

An authenticated vulnerability has been identified

CVE-2023-45626 7.2 - High - November 14, 2023

An authenticated vulnerability has been identified allowing an attacker to effectively establish highly privileged persistent arbitrary code execution across boot cycles.

Multiple authenticated command injection vulnerabilities exist in the command line interface

CVE-2023-45625 7.2 - High - November 14, 2023

Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

Command Injection

There are buffer overflow vulnerabilities in the underlying CLI service

CVE-2023-45614 9.8 - Critical - November 14, 2023

There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.

Classic Buffer Overflow

Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol

CVE-2023-45620 7.5 - High - November 14, 2023

Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected access point.

Built by Foundeo Inc., with data from the National Vulnerability Database (NVD). Privacy Policy. Use of this site is governed by the Legal Terms
Disclaimer
CONTENT ON THIS WEBSITE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. Always check with your vendor for the most up to date, and accurate information.