Tenable Research

Dell KACE K2000 Systems Deployment Appliance installs with default credentials for an account designed for third-party reporting applications. The 'report' account has a password of 'box747', which is publicly known and documented.

HP OpenView Performance Insight contains a flaw that allows for a reflected cross-site scripting (XSS) attack. This flaw exists because the sendEmail.jsp script does not validate input to the 'bgcolor' parameter before returning it to users.

IBM Tivoli Management Framework Endpoint contains an overflow condition in the lcfd.exe program. The issue is triggered as user-supplied input is not properly validated when handling the 'opts' field.

IBM solidDB contains a flaw related to the solid.exe process failing to verify password hash lengths properly. This may allow a remote attacker to specify the password hash length, allowing them to bypass authentication via a crafted request which contains the first few bytes of the password hash.

HP Power Manager is prone to an overflow condition. The management server suffers from a boundary error when processing URL parameters passed to the login form, resulting in a stack-based buffer overflow. With a specially crafted 'Login' variable, a remote attacker can potentially execute arbitrary code with SYSTEM privileges.