Tenable Research

Dell KACE K2000 System Deployment Appliance contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate input to the 'log' parameter of the /settings_logs facility and the 'network_test_name' parameter of the /support_troubleshooting facility before returning it to the user.

Dell KACE K2000 Systems Deployment Appliance installs with default credentials for an account designed for third-party reporting applications. The 'report' account has a password of 'box747', which is publicly known and documented.

HP OpenView Performance Insight contains a flaw that allows for a reflected cross-site scripting (XSS) attack. This flaw exists because the sendEmail.jsp script does not validate input to the 'bgcolor' parameter before returning it to users.

IBM Tivoli Management Framework Endpoint contains an overflow condition in the lcfd.exe program. The issue is triggered as user-supplied input is not properly validated when handling the 'opts' field.

IBM solidDB contains a flaw related to the solid.exe process failing to verify password hash lengths properly. This may allow a remote attacker to specify the password hash length, allowing them to bypass authentication via a crafted request which contains the first few bytes of the password hash.