HP OpenView Performance Insight Server 5.2 5.3 5.31 5.4 and 5.41 contains a \hidden account\ in the com.trinagy.security.XMLUserManager Java class which allows remote attackers to execute arbitrary code via the doPost method in the com.trinagy.servlet.HelpManagerServlet class.