Loading story…
HP released bulletin HPSBMA02535 (SSRT100029 rev.1) to remediate nine vulnerabilities in HP Performance Manager versions 8.10, 8.20, and 8.21 for HP-UX, Linux, Solaris, and Windows. The flaws could enable remote unauthorized access, cross-site scripting, and denial-of-service conditions; CVE-2009-3548 was rated highest, with a CVSS v2 base score of 7.5 and potential impact to confidentiality, integrity, and availability.
HP issued platform-specific updates: HPPM8CPI_00001 for HP-UX IA, HPPM8CPP_00001 for HP-UX PA, HPPM8CPL_00001 for Linux, HPPM8CPS_00001 for Solaris, and HPPM8CPW_00001 for Windows. Related Apache Tomcat advisories also addressed CVE-2009-0580, a FORM-authentication user-enumeration flaw in Tomcat 4.1.x, 5.5.x, and 6.0.x that lets remote attackers identify valid usernames through malformed URL-encoded password input to /j_security_check.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Hewlett-Packard published HPSBMA02535 (SSRT100029 rev.1) addressing nine remote-access, cross-site-scripting, and denial-of-service vulnerabilities in HP Performance Manager 8.10, 8.20, and 8.21. HP released platform-specific patches for HP-UX, Linux, Solaris, and Windows, including fixes for CVE-2009-3548 and the other listed CVEs.
CVE-2009-0580 was published for an Apache Tomcat FORM-authentication flaw that lets remote attackers distinguish valid usernames through malformed URL-encoded passwords sent to /j_security_check. It affects specified Tomcat 4.1.x, 5.5.x, and 6.0.x versions using the affected authentication realms.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
cve.mitre.org
Open sourcemarc.info
Open sourcemandriva.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
HP released security bulletin **HPSBUX03337** (`SSRT102066 rev.1`) for HP-UX B.11.31 systems running the HP-UX Apache Web Server Suite, Apache Web Server, Tomcat Servlet Engine, or PHP. The 14 addressed CVEs could enable remote denial of service, man-in-the-middle attacks, remote data modification, and local data modification, with CVSS v2 base scores ranging from 4.3 to 7.5. HP directed customers to upgrade to **HP-UX Web Server Suite v4.05 or later**, which updates the bundled Apache, Tomcat, and PHP components to remediated versions. One tracked issue, `CVE-2013-5704`, affects Apache HTTP Server 2.2.22's `mod_headers` module and allows remote attackers to bypass configured `RequestHeader unset` rules by supplying headers in chunked-request trailer fields; Apache stated that this behavior was not a security issue in httpd itself, although downstream vendors issued advisories for affected distributions.
Aug 29, 2026
Hewlett-Packard released security bulletins **HPSBUX03102** and **HPSBUX03150** for multiple vulnerabilities in the HP-UX Apache Web Server Suite, affecting bundled Apache HTTP Server, Tomcat Servlet Engine, and PHP components. Impacted systems could be vulnerable to remote code execution, denial of service, HTTP request smuggling, access-control bypass, man-in-the-middle attacks, and unauthorized file or data access; the most severe cited issue, PHP `CVE-2014-3515`, carries a CVSS v2 score of 7.5 and permits remote arbitrary code execution. For HP-UX B.11.31, HP advised upgrading Web Server Suite to version 4.02 or later, including Apache 2.2.15.20, Tomcat 6.0.39.02, and PHP 5.4.11.04. For HP-UX B.11.23 systems using Web Server Suite 3.29 or earlier, Tomcat 5.5.36.01 or earlier, or PHP 5.2.17.03 or earlier, HP recommended Web Server Suite 3.30 or later, with Apache 2.2.15.21, Tomcat 5.5.36.02, and PHP 5.2.17.04.
Aug 29, 2026
HP disclosed that **Network Node Manager i (NNMi) 9.0x** deployments on HP-UX, Linux, Solaris, and Windows were affected by numerous vulnerabilities in the bundled or supported Java Development Kit. Remote attackers could exploit the flaws to disclose or modify information and cause denial of service; the affected CVE range includes `CVE-2009-3555` through `CVE-2012-0508`. Several vulnerabilities—including `CVE-2010-0886`, `CVE-2010-0887`, `CVE-2011-0802`, and `CVE-2012-0497` through `CVE-2012-0500`—were rated CVSS v2 10.0. HP issued operating-system-specific JDK hotfixes under bulletin **HPSBMU02799** (`SSRT100867`) and required customers to install NNMi 9.0x Patch 5 before applying the updates.
Aug 29, 2026