Aruba Networks IT Edge Networking
Products by Aruba Networks Sorted by Most Security Vulnerabilities since 2018
By the Year
In 2023 there have been 118 vulnerabilities in Aruba Networks with an average score of 7.5 out of ten. Last year Aruba Networks had 68 security vulnerabilities published. That is, 50 more vulnerabilities have already been reported in 2023 as compared to last year. Last year, the average CVE base score was greater by 0.34
Year | Vulnerabilities | Average Score |
---|---|---|
2023 | 118 | 7.48 |
2022 | 68 | 7.83 |
2021 | 116 | 7.21 |
2020 | 18 | 7.82 |
2019 | 8 | 7.65 |
2018 | 8 | 7.69 |
It may take a day or so for new Aruba Networks vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Aruba Networks Security Vulnerabilities
Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol
CVE-2023-45620
7.5 - High
- November 14, 2023
Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected access point.
Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol
CVE-2023-45621
7.5 - High
- November 14, 2023
Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected access point.
Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the BLE daemon service accessed via the PAPI protocol
CVE-2023-45622
7.5 - High
- November 14, 2023
Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the BLE daemon service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected access point.
Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Wi-Fi Uplink service accessed via the PAPI protocol
CVE-2023-45623
7.5 - High
- November 14, 2023
Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Wi-Fi Uplink service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected access point.
An unauthenticated Denial-of-Service (DoS) vulnerability exists in the soft ap daemon accessed via the PAPI protocol
CVE-2023-45624
7.5 - High
- November 14, 2023
An unauthenticated Denial-of-Service (DoS) vulnerability exists in the soft ap daemon accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected access point.
There is a buffer overflow vulnerability in the underlying AirWave client service
CVE-2023-45616
9.8 - Critical
- November 14, 2023
There is a buffer overflow vulnerability in the underlying AirWave client service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Classic Buffer Overflow
There are arbitrary file deletion vulnerabilities in the CLI service accessed by PAPI (Aruba's access point management protocol)
CVE-2023-45617
8.2 - High
- November 14, 2023
There are arbitrary file deletion vulnerabilities in the CLI service accessed by PAPI (Aruba's access point management protocol). Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the access point.
There are arbitrary file deletion vulnerabilities in the AirWave client service accessed by PAPI (Aruba's access point management protocol)
CVE-2023-45618
8.2 - High
- November 14, 2023
There are arbitrary file deletion vulnerabilities in the AirWave client service accessed by PAPI (Aruba's access point management protocol). Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the access point.
There is an arbitrary file deletion vulnerability in the RSSI service accessed by PAPI (Aruba's access point management protocol)
CVE-2023-45619
8.2 - High
- November 14, 2023
There is an arbitrary file deletion vulnerability in the RSSI service accessed by PAPI (Aruba's access point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the access point.
There are buffer overflow vulnerabilities in the underlying CLI service
CVE-2023-45614
9.8 - Critical
- November 14, 2023
There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Classic Buffer Overflow
There are buffer overflow vulnerabilities in the underlying CLI service
CVE-2023-45615
9.8 - Critical
- November 14, 2023
There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Classic Buffer Overflow
Multiple authenticated command injection vulnerabilities exist in the command line interface
CVE-2023-45625
7.2 - High
- November 14, 2023
Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Command Injection
An authenticated vulnerability has been identified
CVE-2023-45626
7.2 - High
- November 14, 2023
An authenticated vulnerability has been identified allowing an attacker to effectively establish highly privileged persistent arbitrary code execution across boot cycles.
An authenticated Denial-of-Service (DoS) vulnerability exists in the CLI service
CVE-2023-45627
6.5 - Medium
- November 14, 2023
An authenticated Denial-of-Service (DoS) vulnerability exists in the CLI service. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected access point.
A vulnerability in the web-based management interface of ClearPass Policy Manager could
CVE-2023-43507
8.8 - High
- October 25, 2023
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit this vulnerability to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the ClearPass Policy Manager cluster.
SQL Injection
Vulnerabilities in the web-based management interface of ClearPass Policy Manager allow an attacker with read-only privileges to perform actions
CVE-2023-43508
6.5 - Medium
- October 25, 2023
Vulnerabilities in the web-based management interface of ClearPass Policy Manager allow an attacker with read-only privileges to perform actions that change the state of the ClearPass Policy Manager instance. Successful exploitation of these vulnerabilities allow an attacker to complete state-changing actions in the web-based management interface that should not be allowed by their current level of authorization on the platform.
AuthZ
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to send notifications to computers
CVE-2023-43509
5.8 - Medium
- October 25, 2023
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to send notifications to computers that are running ClearPass OnGuard. These notifications can then be used to phish users or trick them into downloading malicious software.
A vulnerability in the ClearPass Policy Manager web-based management interface
CVE-2023-43510
6.3 - Medium
- October 25, 2023
A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as a non-privileged user on the underlying operating system leading to partial system compromise.
Command Injection
A vulnerability exists which
CVE-2023-4896
6.5 - Medium
- October 17, 2023
A vulnerability exists which allows an authenticated attacker to access sensitive information on the AirWave Management Platform web-based management interface. Successful exploitation allows the attacker to gain access to some data that could be further exploited to laterally access devices managed and monitored by the AirWave server.
Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7
CVE-2015-2201
7.2 - High
- September 05, 2023
Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows VisualRF remote OS command execution and file disclosure by administrative users.
Shell injection
Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7
CVE-2015-2202
7.2 - High
- September 05, 2023
Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows administrative users to escalate privileges to root on the underlying OS.
Improper Input Validation
EdgeConnect SD-WAN Orchestrator instances prior to the versions resolved in this advisory were found to have shared static SSH host keys for all installations
CVE-2023-37426
7.5 - High
- August 22, 2023
EdgeConnect SD-WAN Orchestrator instances prior to the versions resolved in this advisory were found to have shared static SSH host keys for all installations. This vulnerability could allow an attacker to spoof the SSH host signature and thereby masquerade as a legitimate Orchestrator host.
Use of Hard-coded Credentials
A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could
CVE-2023-37425
6.1 - Medium
- August 22, 2023
A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
XSS
A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could
CVE-2023-37427
7.2 - High
- August 22, 2023
A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
A vulnerability in the EdgeConnect SD-WAN Orchestrator web-based management interface
CVE-2023-37428
7.2 - High
- August 22, 2023
A vulnerability in the EdgeConnect SD-WAN Orchestrator web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
Directory traversal
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could
CVE-2023-37429
8.1 - High
- August 22, 2023
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to the exposure and corruption of sensitive data controlled by the EdgeConnect SD-WAN Orchestrator host.
SQL Injection
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could
CVE-2023-37430
8.1 - High
- August 22, 2023
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to the exposure and corruption of sensitive data controlled by the EdgeConnect SD-WAN Orchestrator host.
SQL Injection
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could
CVE-2023-37431
8.1 - High
- August 22, 2023
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to the exposure and corruption of sensitive data controlled by the EdgeConnect SD-WAN Orchestrator host.
SQL Injection
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could
CVE-2023-37432
8.1 - High
- August 22, 2023
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to the exposure and corruption of sensitive data controlled by the EdgeConnect SD-WAN Orchestrator host.
SQL Injection
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could
CVE-2023-37433
8.1 - High
- August 22, 2023
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to the exposure and corruption of sensitive data controlled by the EdgeConnect SD-WAN Orchestrator host.
SQL Injection
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could
CVE-2023-37434
8.1 - High
- August 22, 2023
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to the exposure and corruption of sensitive data controlled by the EdgeConnect SD-WAN Orchestrator host.
SQL Injection
Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could
CVE-2023-37422
5.4 - Medium
- August 22, 2023
Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
XSS
Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could
CVE-2023-37423
5.4 - Medium
- August 22, 2023
Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
XSS
A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could
CVE-2023-37424
8.1 - High
- August 22, 2023
A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.
Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could
CVE-2023-37421
5.4 - Medium
- August 22, 2023
Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
XSS
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could
CVE-2023-37438
6.5 - Medium
- August 22, 2023
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to the exposure and corruption of sensitive data controlled by the EdgeConnect SD-WAN Orchestrator host.
SQL Injection
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could
CVE-2023-37439
6.1 - Medium
- August 22, 2023
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to the exposure and corruption of sensitive data controlled by the EdgeConnect SD-WAN Orchestrator host.
XSS
A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could
CVE-2023-37440
5.3 - Medium
- August 22, 2023
A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to conduct a server-side request forgery (SSRF) attack. A successful exploit allows an attacker to enumerate information about the internal structure of the EdgeConnect SD-WAN Orchestrator host leading to potential disclosure of sensitive information.
XSPA
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could
CVE-2023-37435
6.5 - Medium
- August 22, 2023
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to the exposure and corruption of sensitive data controlled by the EdgeConnect SD-WAN Orchestrator host.
SQL Injection
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could
CVE-2023-37436
6.5 - Medium
- August 22, 2023
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to the exposure and corruption of sensitive data controlled by the EdgeConnect SD-WAN Orchestrator host.
SQL Injection
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could
CVE-2023-37437
6.5 - Medium
- August 22, 2023
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to the exposure and corruption of sensitive data controlled by the EdgeConnect SD-WAN Orchestrator host.
SQL Injection
There are buffer overflow vulnerabilities in multiple underlying services
CVE-2023-35980
9.8 - Critical
- July 25, 2023
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Classic Buffer Overflow
There are buffer overflow vulnerabilities in multiple underlying services
CVE-2023-35981
9.8 - Critical
- July 25, 2023
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Classic Buffer Overflow
There are buffer overflow vulnerabilities in multiple underlying services
CVE-2023-35982
9.8 - Critical
- July 25, 2023
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Classic Buffer Overflow
Vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface
CVE-2023-30501
8.8 - High
- May 16, 2023
Vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface that allow remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
Vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface
CVE-2023-30502
8.8 - High
- May 16, 2023
Vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface that allow remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
Vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface
CVE-2023-30503
8.8 - High
- May 16, 2023
Vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface that allow remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
Vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface
CVE-2023-30504
8.8 - High
- May 16, 2023
Vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface that allow remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
Vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface
CVE-2023-30505
8.8 - High
- May 16, 2023
Vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface that allow remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
Vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface
CVE-2023-30506
8.8 - High
- May 16, 2023
Vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface that allow remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
Multiple authenticated path traversal vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface
CVE-2023-30507
6.5 - Medium
- May 16, 2023
Multiple authenticated path traversal vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface. Successful exploitation of these vulnerabilities result in the ability to read arbitrary files on the underlying operating system, including sensitive system files.
Directory traversal
Multiple authenticated path traversal vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface
CVE-2023-30508
6.5 - Medium
- May 16, 2023
Multiple authenticated path traversal vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface. Successful exploitation of these vulnerabilities result in the ability to read arbitrary files on the underlying operating system, including sensitive system files.
Directory traversal
Multiple authenticated path traversal vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface
CVE-2023-30509
6.5 - Medium
- May 16, 2023
Multiple authenticated path traversal vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface. Successful exploitation of these vulnerabilities result in the ability to read arbitrary files on the underlying operating system, including sensitive system files.
Directory traversal
A vulnerability exists in the Aruba EdgeConnect Enterprise web management interface
CVE-2023-30510
4.3 - Medium
- May 16, 2023
A vulnerability exists in the Aruba EdgeConnect Enterprise web management interface that allows remote authenticated users to issue arbitrary URL requests from the Aruba EdgeConnect Enterprise instance. The impact of this vulnerability is limited to a subset of URLs which can result in the possible disclosure of data due to the network position of the Aruba EdgeConnect Enterprise instance.
Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface
CVE-2023-22788
8.8 - High
- May 08, 2023
Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Command Injection
Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface
CVE-2023-22789
8.8 - High
- May 08, 2023
Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Command Injection
Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface
CVE-2023-22790
8.8 - High
- May 08, 2023
Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Command Injection
A vulnerability exists in Aruba InstantOS and ArubaOS 10 where an edge-case combination of network configuration, a specific WLAN environment and an attacker already possessing valid user credentials on
CVE-2023-22791
4.8 - Medium
- May 08, 2023
A vulnerability exists in Aruba InstantOS and ArubaOS 10 where an edge-case combination of network configuration, a specific WLAN environment and an attacker already possessing valid user credentials on that WLAN can lead to sensitive information being disclosed via the WLAN. The scenarios in which this disclosure of potentially sensitive information can occur are complex and depend on factors that are beyond the control of the attacker.
An unauthenticated Denial of Service (DoS) vulnerability exists in a service accessed
CVE-2023-22787
7.5 - High
- May 08, 2023
An unauthenticated Denial of Service (DoS) vulnerability exists in a service accessed via the PAPI protocol provided by Aruba InstantOS and ArubaOS 10. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected access point.
Vulnerabilities within the web-based management interface of ClearPass Policy Manager could
CVE-2023-25592
6.1 - Medium
- March 22, 2023
Vulnerabilities within the web-based management interface of ClearPass Policy Manager could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
XSS
A vulnerability exists in the ClearPass OnGuard Ubuntu agent
CVE-2023-25595
5.5 - Medium
- March 22, 2023
A vulnerability exists in the ClearPass OnGuard Ubuntu agent that allows for an attacker with local Ubuntu instance access to potentially obtain sensitive information. Successful Exploitation of this vulnerability allows an attacker to retrieve information that is of a sensitive nature to the ClearPass/OnGuard environment.
A vulnerability exists in ClearPass Policy Manager
CVE-2023-25596
4.9 - Medium
- March 22, 2023
A vulnerability exists in ClearPass Policy Manager that allows for an attacker with administrative privileges to access sensitive information in a cleartext format. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager.
Cleartext Storage of Sensitive Information
A vulnerability in the web-based management interface of ClearPass Policy Manager could
CVE-2023-25591
6.5 - Medium
- March 22, 2023
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further privileges on the ClearPass instance.
A vulnerability in the web-based management interface of ClearPass Policy Manager could
CVE-2023-25589
9.8 - Critical
- March 22, 2023
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to create arbitrary users on the platform. A successful exploit allows an attacker to achieve total cluster compromise.
A vulnerability in the web-based management interface of ClearPass Policy Manager allows an attacker with read-only privileges to perform actions
CVE-2023-25594
8.8 - High
- March 22, 2023
A vulnerability in the web-based management interface of ClearPass Policy Manager allows an attacker with read-only privileges to perform actions that change the state of the ClearPass Policy Manager instance. Successful exploitation of this vulnerability allows an attacker to complete state-changing actions in the web-based management interface that should not be allowed by their current level of authorization on the platform.
AuthZ
Vulnerabilities within the web-based management interface of ClearPass Policy Manager could
CVE-2023-25593
6.1 - Medium
- March 22, 2023
Vulnerabilities within the web-based management interface of ClearPass Policy Manager could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
XSS
A vulnerability in the ArubaOS web management interface could
CVE-2023-22778
4.8 - Medium
- March 01, 2023
A vulnerability in the ArubaOS web management interface could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
XSS
An authenticated path traversal vulnerability exists in the ArubaOS command line interface
CVE-2023-22776
4.9 - Medium
- March 01, 2023
An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability results in the ability to read arbitrary files on the underlying operating system, including sensitive system files.
Directory traversal
Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface
CVE-2023-22774
6.5 - Medium
- March 01, 2023
Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files in the underlying operating system.
Directory traversal
Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface
CVE-2023-22773
6.5 - Medium
- March 01, 2023
Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files in the underlying operating system.
Directory traversal
An insufficient session expiration vulnerability exists in the ArubaOS command line interface
CVE-2023-22771
2.4 - Low
- March 01, 2023
An insufficient session expiration vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability allows an attacker to keep a session running on an affected device after the removal of the impacted account
Insufficient Session Expiration
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface
CVE-2023-22770
7.2 - High
- March 01, 2023
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Command Injection
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface
CVE-2023-22769
7.2 - High
- March 01, 2023
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Command Injection
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface
CVE-2023-22768
7.2 - High
- March 01, 2023
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Command Injection
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface
CVE-2023-22767
7.2 - High
- March 01, 2023
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Command Injection
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface
CVE-2023-22766
7.2 - High
- March 01, 2023
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Command Injection
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface
CVE-2023-22765
7.2 - High
- March 01, 2023
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Command Injection
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface
CVE-2023-22764
7.2 - High
- March 01, 2023
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Command Injection
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface
CVE-2023-22763
7.2 - High
- March 01, 2023
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Command Injection
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface
CVE-2023-22762
7.2 - High
- March 01, 2023
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Command Injection
There are multiple command injection vulnerabilities
CVE-2023-22747
9.8 - Critical
- March 01, 2023
There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Command Injection
Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface
CVE-2023-22758
7.2 - High
- March 01, 2023
Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying operating system on the device running ArubaOS.
Command Injection
A vulnerability exists which allows an authenticated attacker to access sensitive information on the ArubaOS command line interface
CVE-2023-22775
6.5 - Medium
- March 01, 2023
A vulnerability exists which allows an authenticated attacker to access sensitive information on the ArubaOS command line interface. Successful exploitation could allow access to data beyond what is authorized by the users existing privilege level.
Exposure of Resource to Wrong Sphere
There are multiple command injection vulnerabilities
CVE-2023-22748
9.8 - Critical
- March 01, 2023
There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Command Injection
There are multiple command injection vulnerabilities
CVE-2023-22749
9.8 - Critical
- March 01, 2023
There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Command Injection
There are multiple command injection vulnerabilities
CVE-2023-22750
9.8 - Critical
- March 01, 2023
There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Command Injection
There are stack-based buffer overflow vulnerabilities
CVE-2023-22751
9.8 - Critical
- March 01, 2023
There are stack-based buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Memory Corruption
There are stack-based buffer overflow vulnerabilities
CVE-2023-22752
9.8 - Critical
- March 01, 2023
There are stack-based buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Memory Corruption
There are buffer overflow vulnerabilities in multiple underlying operating system processes
CVE-2023-22753
9.8 - Critical
- March 01, 2023
There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthenticated remote code execution by sending specially crafted packets via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Classic Buffer Overflow
There are buffer overflow vulnerabilities in multiple underlying operating system processes
CVE-2023-22754
9.8 - Critical
- March 01, 2023
There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthenticated remote code execution by sending specially crafted packets via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Classic Buffer Overflow
There are buffer overflow vulnerabilities in multiple underlying operating system processes
CVE-2023-22755
9.8 - Critical
- March 01, 2023
There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthenticated remote code execution by sending specially crafted packets via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Classic Buffer Overflow
There are buffer overflow vulnerabilities in multiple underlying operating system processes
CVE-2023-22757
9.8 - Critical
- March 01, 2023
There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthenticated remote code execution by sending specially crafted packets via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Classic Buffer Overflow
There are buffer overflow vulnerabilities in multiple underlying operating system processes
CVE-2023-22756
9.8 - Critical
- March 01, 2023
There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthenticated remote code execution by sending specially crafted packets via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Classic Buffer Overflow
An authenticated information disclosure vulnerability exists in the ArubaOS web-based management interface
CVE-2023-22777
6.5 - Medium
- March 01, 2023
An authenticated information disclosure vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in the ability to read arbitrary files in the underlying operating system.
Exposure of Resource to Wrong Sphere
An authenticated path traversal vulnerability exists in the ArubaOS web-based management interface
CVE-2023-22772
6.5 - Medium
- March 01, 2023
An authenticated path traversal vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in the ability to delete arbitrary files in the underlying operating system.
Directory traversal
Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface
CVE-2023-22760
7.2 - High
- March 01, 2023
Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying operating system on the device running ArubaOS.
Command Injection
Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface
CVE-2023-22761
7.2 - High
- March 01, 2023
Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying operating system on the device running ArubaOS.
Command Injection
Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface
CVE-2023-22759
7.2 - High
- March 01, 2023
Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying operating system on the device running ArubaOS.
Command Injection
A vulnerability exists in the ClearPass Policy Manager cluster communications
CVE-2022-43539
4.5 - Medium
- January 05, 2023
A vulnerability exists in the ClearPass Policy Manager cluster communications that allow for an attacker in a privileged network position to potentially obtain sensitive information. A successful exploit could allow an attacker to retrieve information that allows for unauthorized actions as a privileged user on the ClearPass Policy Manager cluster in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x: 6.10.7 and below and ClearPass Policy Manager 6.9.x: 6.9.12 and below.
Vulnerabilities in the ClearPass Policy Manager web-based management interface
CVE-2022-43538
7.2 - High
- January 05, 2023
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. Successful exploits could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x: 6.10.7 and below and ClearPass Policy Manager 6.9.x: 6.9.12 and below.
Shell injection