operations manager vulnerabilities and fixes

Recent CVEs affecting operations manager, with upgrade or downgrade steps. 19 tracked.

Also searched as: operationsmanager.

operations manager has 19 tracked vulnerabilities, 6 critical. A fixed release or vendor patch exists for 16. Most recent: 2020-07-31. Highest priority: CVE-2016-4373 (score 67/100).

• CVE-2020-5414 MEDIUM 5.7 UPGRADE UPGRADE VMware Tanzu Application Service for VMs (2.7.x versions prior to 2.7.19, 2.8.x versions prior to 2.8.13, and
• CVE-2019-3790 MEDIUM 6.1 UPGRADE The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior
• CVE-2019-3776 HIGH 7.2 UPGRADE Pivotal Operations Manager, 2.1.x versions prior to 2.1.20, 2.2.x versions prior to 2.2.16, 2.3.x versions pri
• CVE-2019-11292 MEDIUM 6.5 UPGRADE Pivotal Ops Manager, versions 2.4.x prior to 2.4.27, 2.5.x prior to 2.5.24, 2.6.x prior to 2.6.16, and 2.7.x p
• CVE-2019-11270 HIGH 7.5 UPGRADE UPGRADE Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'c
• CVE-2018-15762 CRITICAL 9.0 UPGRADE Pivotal Operations Manager, versions 2.0.x prior to 2.0.24, versions 2.1.x prior to 2.1.15, versions 2.2.x pri
• CVE-2018-11081 HIGH 7.9 UPGRADE Pivotal Operations Manager, versions 2.2.x prior to 2.2.1, 2.1.x prior to 2.1.11, 2.0.x prior to 2.0.16, and 1
• CVE-2018-11046 MEDIUM 6.5 UPGRADE Pivotal Operations Manager, versions 2.1.x prior to 2.1.6 and version 2.0.14, includes NGINX packages that lac
• CVE-2018-11045 MEDIUM 5.9 UPGRADE Pivotal Operations Manager, versions 2.1 prior to 2.1.6 and 2.0 prior to 2.0.15 and 1.12 prior to 1.12.22, con
• CVE-2016-4380 MEDIUM 5.4 UPGRADE UPGRADE Cross-site scripting (XSS) vulnerability in the AdminUI in HPE Operations Manager 9.21.x before 9.21.130 allow
• CVE-2016-4373 CRITICAL 9.8 UPGRADE UPGRADE The AdminUI in HPE Operations Manager (OM) before 9.21.130 on Linux, Unix, and Solaris allows remote attackers
• CVE-2016-1985 CRITICAL 10.0 DOWNGRADE HPE Operations Manager 8.x and 9.0 on Windows allows remote attackers to execute arbitrary commands via a craf
• CVE-2016-0930 CRITICAL 9.8 UPGRADE Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.19 and 1.7.x before 1.7.10, when vCloud or vSphere is used,
• CVE-2016-0897 CRITICAL 9.8 UPGRADE Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.17 and 1.7.x before 1.7.8, when vCloud or vSphere is used,
• CVE-2016-0883 CRITICAL 9.8 UPGRADE Pivotal Cloud Foundry (PCF) Ops Manager before 1.5.14 and 1.6.x before 1.6.9 uses the same cookie-encryption k
• CVE-2014-5073 HIGH 7.5 UPGRADE vmtadmin.cgi in VMTurbo Operations Manager before 4.6 build 28657 allows remote attackers to execute arbitrary
• CVE-2014-3806 MEDIUM 5.0 UPGRADE Directory traversal vulnerability in cgi-bin/help/doIt.cgi in VMTurbo Operations Manager before 4.6 allows rem
• CVE-2014-2649 HIGH 7.5 DOWNGRADE MITIGATE Unspecified vulnerability in HP Operations Manager 9.20 on UNIX allows remote attackers to execute arbitrary c
• CVE-2014-2648 HIGH 10.0 DOWNGRADE Unspecified vulnerability in HP Operations Manager 9.10 and 9.11 on UNIX allows remote attackers to execute ar

FAQ

How do I fix operations manager vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is operations manager being exploited right now?

None of the tracked operations manager CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which operations manager CVE should I patch first?

CVE-2016-4373 currently ranks highest (67/100): The AdminUI in HPE Operations Manager (OM) before 9.21.130 on Linux, Unix, and Solaris allows remote attackers.

RSS feed for operations manager · ← Back to latest CVEs