Two vulnerabilities have been reported in HP Service Manager and Service Center, which can be exploited by malicious people to conduct cross-site scripting attacks and cause a DoS (Denial of Service).

1) Certain unspecified input in Web Tier is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) An unspecified error can be exploited to cause a DoS. No further information is currently available.

The vulnerabilities are reported in the following products:
* HP Service Manager Server versions 9.30, 9.21, and 7.11.
* HP Service Center Server version 6.28.

Solution
Apply patches (please see the vendor's advisories for details).

Provided and/or discovered by
Reported by the vendor.

Original Advisory
HPSBMU02800 SSRT100921:
http://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03447828

HPSBMU02803 SSRT100926:
http://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03450382

Deep Links
Links available to Secunia VIM customers