Multiple vulnerabilities have been reported in HP Systems Insight Manager, which can be exploited by malicious users to gain escalated privileges and by malicious people to conduct cross-site scripting, cross-site request forgery, click-jacking attacks, or compromise a user's system.

1) The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform an unspecified action if a logged-in user visits a malicious web site.

2) Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

3) An unspecified error can be exploited by authenticated users to escalate privileges.

NOTE: Additionally, multiple vulnerabilities have been acknowledged in the bundled version of Adobe Flash player.

For more information:
SA40907

The vulnerabilities are reported in versions prior to 6.2 running on HP-UX, Linux, and Windows platforms.

Solution
Update to version 6.2.

Provided and/or discovered by
Reported by the vendor.

Original Advisory
HPSBMA02591 SSRT100299:
https://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02549477

HPSBMA02592 SSRT100300:
http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02549485

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers