Jp1 Automatic Job Management System 3 Manager
Monthly
A heap-based buffer overflow (CWE-122) in Hitachi JP1/Automatic Job Management System 3 - Manager and 3 - Agent, covering versions from 11-00 up to but not including 13-50-31, is rated 9.8 with a network vector (AV:N/AC:L/PR:N/UI:N) - meaning successful exploitation could give remote, unauthenticated attackers full compromise of confidentiality, integrity and availability of the job-management service. Hitachi has released fixed builds at 13-50-31, but the available sources do not describe the specific feature, protocol or input that triggers the overflow, so no particular enabling configuration can be named. No public exploit code is confirmed, EPSS is low (0.52%, 44th percentile), and there is no KEV listing, yet the vuln.today decision label is act_now given the severity and the fact that this is an unauthenticated network-reachable memory-corruption flaw in infrastructure software.
Stack-based buffer overflow in Hitachi JP1/AJS3 Manager (versions 10-00 before 13-50-31) could let remote, unauthenticated attackers trigger memory corruption with high confidentiality and integrity impact and limited availability impact (CVSS 9.4). The vendor CVSS vector is AV:N/AC:L/PR:N/UI:N, so no credentials or user interaction are required, but the sources do not identify the specific network interface or input that reaches the vulnerable code. No public exploit identified at time of analysis and EPSS is low at 0.45% (39th percentile), while a vendor fix is available in 13-50-31.
Heap-based buffer overflow in Hitachi JP1/Automatic Job Management System 3 - Manager (versions 10-00 through builds prior to 13-50-31) is reachable over the network with no authentication or user interaction required under the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N), giving a worst-case impact of high confidentiality and integrity loss plus limited availability impact (CVSS 9.4). No public exploit code or CISA KEV entry is associated with the issue, and EPSS is low at 0.45% (39th percentile), yet the vuln.today decision label is act_now, driven by the maximum-severity, pre-authentication, network-reachable profile against an enterprise job-scheduling manager; the notable tension is that low observed exploitation likelihood sits alongside a maximum-severity rating and the absence of a published trigger description. The vendor has released a fix, and deployments on 13-50-31 or later are not affected.
Authentication bypass in Hitachi JP1/Automatic Job Management System 3 - Manager (versions 10-00 up to but not including 13-50-31) lets remote attackers reach the management service without credentials and, per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N), potentially take full control of confidentiality, integrity and availability. The flaw is rated 9.8 and flagged act_now by vuln.today, while EPSS is modest at 0.64% (51st percentile) and it is not in CISA KEV; no public exploit code has been confirmed. Exposure is greatest where the JP1/AJS3 Manager service is reachable from untrusted networks, since it is normally an internal management server.
Stack-based buffer overflow in Hitachi JP1/Automatic Job Management System 3 - Manager (versions from 10-00 up to but not including 13-50-31) gives remote, unauthenticated attackers who can reach the manager service a memory-corruption primitive that the CVSS 3.1 vector rates at 9.4 with high confidentiality and integrity impact and limited availability impact. No privileges and no user interaction are required per CVSS:3.1/AV:N/AC:L/PR:N/UI:N, and the concrete service, protocol or malformed input that overflows the stack buffer is not described in the available sources. No public exploit has been identified at time of analysis and the EPSS score is low (0.45%, 39th percentile); the act_now priority label is driven by the unauthenticated network-reachable attack surface rather than by observed exploitation. Vendor-released patch: 13-50-31.
Stack-based buffer overflow (CWE-121) in Hitachi JP1/Automatic Job Management System 3 - Manager, - Agent, and - Agent Minimal Edition lets remote attackers crash or potentially execute code in the context of the JP1/AJS3 service, with a vendor-assigned CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N). Affected builds are Manager and Agent from 10-00/11-00 up to, but not including, 13-50-31, plus Agent Minimal Edition from 11-50 before 13-50-31; Hitachi has released 13-50-31 as the fix for all three branches. Severity signals and exploitation signals diverge: EPSS is only 0.52% (44th percentile) and no public exploit or KEV listing was identified at time of analysis, yet the vulnerability is remotely reachable with no authentication or user interaction, so vuln.today priority is act_now - the practical exposure limiter being that JP1/AJS3 components normally sit on segmented internal operations networks rather than the internet.
Stack-based buffer overflow in Hitachi JP1/Automatic Job Management System 3 Manager, Agent, and Agent Minimal Edition before 13-50-31 allows remote, unauthenticated attackers to corrupt memory over the network with no user interaction, potentially compromising confidentiality and integrity and causing limited availability impact (CVSS 9.4). Hitachi reports affected Manager and Agent branches from 11-00 before 13-50-31, while EUVD also maps 10-00 branches and Agent Minimal Edition 11-50 to versions below 13-50-31. A vendor patch is available; no public exploit was identified at time of analysis (EPSS 0.45%), and CISA KEV does not list this CVE.
Heap-based buffer overflow in Hitachi JP1/Automatic Job Management System 3 Manager, Agent, and Agent Minimal Edition before 13-50-31 can be reached over the network without authentication or user interaction under the vendor CVSS vector (CVSS 9.4, AV:N/AC:L/PR:N/UI:N), yielding high confidentiality and integrity impact and low availability impact. Hitachi has released fixed version 13-50-31, and the vuln.today priority is act_now. No CISA KEV entry or public exploit code was identified at time of analysis; EPSS is 0.45% (39th percentile), so the priority reflects severity and network exposure rather than observed exploitation.
A remote out-of-bounds write in Hitachi's JP1 operations-management suite lets an unauthenticated network attacker corrupt memory in affected JP1 service processes, with the vendor-assigned CVSS 3.1 score of 9.4 reflecting high confidentiality and integrity impact and a partial availability impact (AV:N/AC:L/PR:N/UI:N). Affected are JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 - Manager, Agent and Agent Minimal Edition from 13-00 before 13-50-31, and JP1/Base from 11-00 before 12-50-54. Hitachi has released fixed versions, no public exploit code or KEV entry was identified at time of analysis, and EPSS is modest at 0.46% (39th percentile), though the vuln.today decision signal is act_now given the unauthenticated network vector and memory-corruption class.
Heap-based buffer overflow (CWE-122) in Hitachi JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 - Manager, Agent and Agent Minimal Edition (13-00 before 13-50-31), and JP1/Base (11-00 before 12-50-54), rated CVSS 3.1 9.4 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L - remote, low-complexity, no privileges and no user interaction, with high confidentiality and integrity impact and low availability impact. The vulnerability is unauthenticated per the PR:N vector, and the specific service, port, or crafted input that triggers the overflow is not described in the available sources. Hitachi has released fixed versions (13-50-31 for the 13-00 branch products, 12-50-54 for JP1/Base), there is no CISA KEV entry or confirmed exploitation, and no public exploit was identified at time of analysis; EPSS is 0.45% (39th percentile) - the main real-world limiter is whether the JP1 service is network-reachable by an attacker.
Stack-based buffer overflow in Hitachi JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 (Manager, Agent, and Agent Minimal Edition) 13-00 through 13-50-30, and JP1/Base 11-00 through 12-50-53 lets remote unauthenticated attackers corrupt stack memory, carrying high confidentiality and integrity impact alongside a lower availability impact (CVSS 3.1 base 9.4, AV:N/AC:L/PR:N/UI:N). No public exploit code has been identified at time of analysis and EPSS is low at 0.45% (39th percentile), but the vendor-reported severity and the absence of any privilege or user-interaction prerequisite place this at act_now priority for the listed versions. Vendor-released fixes exist: 13-50-31 for all 13-00 JP1 branches and 12-50-54 for JP1/Base.
A heap-based buffer overflow (CWE-122) in Hitachi JP1/Automatic Job Management System 3 - Manager and 3 - Agent, covering versions from 11-00 up to but not including 13-50-31, is rated 9.8 with a network vector (AV:N/AC:L/PR:N/UI:N) - meaning successful exploitation could give remote, unauthenticated attackers full compromise of confidentiality, integrity and availability of the job-management service. Hitachi has released fixed builds at 13-50-31, but the available sources do not describe the specific feature, protocol or input that triggers the overflow, so no particular enabling configuration can be named. No public exploit code is confirmed, EPSS is low (0.52%, 44th percentile), and there is no KEV listing, yet the vuln.today decision label is act_now given the severity and the fact that this is an unauthenticated network-reachable memory-corruption flaw in infrastructure software.
Stack-based buffer overflow in Hitachi JP1/AJS3 Manager (versions 10-00 before 13-50-31) could let remote, unauthenticated attackers trigger memory corruption with high confidentiality and integrity impact and limited availability impact (CVSS 9.4). The vendor CVSS vector is AV:N/AC:L/PR:N/UI:N, so no credentials or user interaction are required, but the sources do not identify the specific network interface or input that reaches the vulnerable code. No public exploit identified at time of analysis and EPSS is low at 0.45% (39th percentile), while a vendor fix is available in 13-50-31.
Heap-based buffer overflow in Hitachi JP1/Automatic Job Management System 3 - Manager (versions 10-00 through builds prior to 13-50-31) is reachable over the network with no authentication or user interaction required under the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N), giving a worst-case impact of high confidentiality and integrity loss plus limited availability impact (CVSS 9.4). No public exploit code or CISA KEV entry is associated with the issue, and EPSS is low at 0.45% (39th percentile), yet the vuln.today decision label is act_now, driven by the maximum-severity, pre-authentication, network-reachable profile against an enterprise job-scheduling manager; the notable tension is that low observed exploitation likelihood sits alongside a maximum-severity rating and the absence of a published trigger description. The vendor has released a fix, and deployments on 13-50-31 or later are not affected.
Authentication bypass in Hitachi JP1/Automatic Job Management System 3 - Manager (versions 10-00 up to but not including 13-50-31) lets remote attackers reach the management service without credentials and, per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N), potentially take full control of confidentiality, integrity and availability. The flaw is rated 9.8 and flagged act_now by vuln.today, while EPSS is modest at 0.64% (51st percentile) and it is not in CISA KEV; no public exploit code has been confirmed. Exposure is greatest where the JP1/AJS3 Manager service is reachable from untrusted networks, since it is normally an internal management server.
Stack-based buffer overflow in Hitachi JP1/Automatic Job Management System 3 - Manager (versions from 10-00 up to but not including 13-50-31) gives remote, unauthenticated attackers who can reach the manager service a memory-corruption primitive that the CVSS 3.1 vector rates at 9.4 with high confidentiality and integrity impact and limited availability impact. No privileges and no user interaction are required per CVSS:3.1/AV:N/AC:L/PR:N/UI:N, and the concrete service, protocol or malformed input that overflows the stack buffer is not described in the available sources. No public exploit has been identified at time of analysis and the EPSS score is low (0.45%, 39th percentile); the act_now priority label is driven by the unauthenticated network-reachable attack surface rather than by observed exploitation. Vendor-released patch: 13-50-31.
Stack-based buffer overflow (CWE-121) in Hitachi JP1/Automatic Job Management System 3 - Manager, - Agent, and - Agent Minimal Edition lets remote attackers crash or potentially execute code in the context of the JP1/AJS3 service, with a vendor-assigned CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N). Affected builds are Manager and Agent from 10-00/11-00 up to, but not including, 13-50-31, plus Agent Minimal Edition from 11-50 before 13-50-31; Hitachi has released 13-50-31 as the fix for all three branches. Severity signals and exploitation signals diverge: EPSS is only 0.52% (44th percentile) and no public exploit or KEV listing was identified at time of analysis, yet the vulnerability is remotely reachable with no authentication or user interaction, so vuln.today priority is act_now - the practical exposure limiter being that JP1/AJS3 components normally sit on segmented internal operations networks rather than the internet.
Stack-based buffer overflow in Hitachi JP1/Automatic Job Management System 3 Manager, Agent, and Agent Minimal Edition before 13-50-31 allows remote, unauthenticated attackers to corrupt memory over the network with no user interaction, potentially compromising confidentiality and integrity and causing limited availability impact (CVSS 9.4). Hitachi reports affected Manager and Agent branches from 11-00 before 13-50-31, while EUVD also maps 10-00 branches and Agent Minimal Edition 11-50 to versions below 13-50-31. A vendor patch is available; no public exploit was identified at time of analysis (EPSS 0.45%), and CISA KEV does not list this CVE.
Heap-based buffer overflow in Hitachi JP1/Automatic Job Management System 3 Manager, Agent, and Agent Minimal Edition before 13-50-31 can be reached over the network without authentication or user interaction under the vendor CVSS vector (CVSS 9.4, AV:N/AC:L/PR:N/UI:N), yielding high confidentiality and integrity impact and low availability impact. Hitachi has released fixed version 13-50-31, and the vuln.today priority is act_now. No CISA KEV entry or public exploit code was identified at time of analysis; EPSS is 0.45% (39th percentile), so the priority reflects severity and network exposure rather than observed exploitation.
A remote out-of-bounds write in Hitachi's JP1 operations-management suite lets an unauthenticated network attacker corrupt memory in affected JP1 service processes, with the vendor-assigned CVSS 3.1 score of 9.4 reflecting high confidentiality and integrity impact and a partial availability impact (AV:N/AC:L/PR:N/UI:N). Affected are JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 - Manager, Agent and Agent Minimal Edition from 13-00 before 13-50-31, and JP1/Base from 11-00 before 12-50-54. Hitachi has released fixed versions, no public exploit code or KEV entry was identified at time of analysis, and EPSS is modest at 0.46% (39th percentile), though the vuln.today decision signal is act_now given the unauthenticated network vector and memory-corruption class.
Heap-based buffer overflow (CWE-122) in Hitachi JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 - Manager, Agent and Agent Minimal Edition (13-00 before 13-50-31), and JP1/Base (11-00 before 12-50-54), rated CVSS 3.1 9.4 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L - remote, low-complexity, no privileges and no user interaction, with high confidentiality and integrity impact and low availability impact. The vulnerability is unauthenticated per the PR:N vector, and the specific service, port, or crafted input that triggers the overflow is not described in the available sources. Hitachi has released fixed versions (13-50-31 for the 13-00 branch products, 12-50-54 for JP1/Base), there is no CISA KEV entry or confirmed exploitation, and no public exploit was identified at time of analysis; EPSS is 0.45% (39th percentile) - the main real-world limiter is whether the JP1 service is network-reachable by an attacker.
Stack-based buffer overflow in Hitachi JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 (Manager, Agent, and Agent Minimal Edition) 13-00 through 13-50-30, and JP1/Base 11-00 through 12-50-53 lets remote unauthenticated attackers corrupt stack memory, carrying high confidentiality and integrity impact alongside a lower availability impact (CVSS 3.1 base 9.4, AV:N/AC:L/PR:N/UI:N). No public exploit code has been identified at time of analysis and EPSS is low at 0.45% (39th percentile), but the vendor-reported severity and the absence of any privilege or user-interaction prerequisite place this at act_now priority for the listed versions. Vendor-released fixes exist: 13-50-31 for all 13-00 JP1 branches and 12-50-54 for JP1/Base.