9107 matches found
PT-2026-96999
Name of the Vulnerable Software and Affected Versions Analytics and Location Engine affected versions not specified Description An administrative component is susceptible to a man-in-the-middle MitM attack, which is a technique where an attacker intercepts and potentially alters communication...
CVE-2026-76708: Use of Hard-coded Credentials
A vulnerability exists in the Analytics and Location Engine ALE where the application and underlying operating system use default, hard-coded credentials for several administrative and system accounts. An unauthenticated remote attacker could exploit this vulnerability by attempting to log in usi...
CVE-2026-76709: Improper Access Control
A vulnerability exists in the internal administrative component of Analytics and Location Engine ALE. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to gain unauthorized write access to the file system with elevated privileges, potentially resulting i...
PT-2026-96996
Name of the Vulnerable Software and Affected Versions Analytics and Location Engine ALE affected versions not specified Description An issue in the Analytics and Location Engine ALE allows an unauthenticated remote attacker to gain unauthorized access, disclose sensitive information, or cause a...
CVE-2026-76711: Improper Input Validation
A vulnerability exists in an Analytics and Location Engine ALE component where the impacted process improperly processes incoming socket connections. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input during the connection process. Successful...
PT-2026-96993
Name of the Vulnerable Software and Affected Versions HPE Analytics and Location Engine versions 5.0.0.0 and earlier Description A flaw in the internal administrative component allows an unauthenticated remote attacker to obtain unauthorized write access to the file system with elevated privilege...
CVE-2026-76712: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability exists in the Analytics and Location Engine ALE that may allow for unauthorized access, information disclosure, or denial of service. An unauthenticated remote attacker could exploit the vulnerable system by sending specially crafted input or intercepting network communications...
CVE-2026-76715: Channel Accessible by Non-Endpoint
A vulnerability in an administrative component of Analytics and Location Engine ALE is vulnerable to a man-in-the-middle MitM attack. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the affected applian...
HPESBNW05137 rev.1 - Multiple Vulnerabilities in HPE Networking Analytics and Location Engine (ALE)
Potential Security Impact: Local: Access Restriction Bypass SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. ArubaOS Wi-Fi Controllers and Gateways ALE 5.0.0.0 and below CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2026-76708 |...
CVE-2026-76716: Allocation of Resources Without Limits or Throttling
Multiple vulnerabilities exist in the Analytics and Location Engine ALE that may allow for unauthorized access or denial of service. An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted input or leveraging improper security configurations. Successful...
CVE-2026-76714: Improper Neutralization of Special Elements used in an OS Command
Vulnerabilities in the Analytics and Location Engine web interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system...
CVE-2026-76717: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability exists in the Analytics and Location Engine ALE API that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input to a specific API endpoint. Successful exploitation could result...
PT-2026-97000
Name of the Vulnerable Software and Affected Versions Analytics and Location Engine affected versions not specified Description Multiple issues exist that may allow for unauthorized access or denial of service. An unauthenticated remote attacker could exploit these by sending specially crafted...
PT-2026-96992
Name of the Vulnerable Software and Affected Versions Analytics and Location Engine affected versions not specified Description The Analytics and Location Engine ALE and its underlying operating system utilize default, hard-coded credentials for multiple system and administrative accounts. An...
PT-2026-96998
Name of the Vulnerable Software and Affected Versions Analytics and Location Engine affected versions not specified Description The web interface contains a flaw that allows remote authenticated users to execute arbitrary commands on the underlying host. A successful exploit could enable an...
CVE-2026-76710: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability exists in the Analytics and Location Engine ALE management interface that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted requests to certain internal endpoints. Successful...
PT-2026-96994
Name of the Vulnerable Software and Affected Versions Analytics and Location Engine ALE affected versions not specified Description The management interface contains a flaw that allows an unauthenticated remote attacker to disclose sensitive information. By sending specially crafted requests to...
Open Web Analytics 1.7.3 - Remote Code Execution
Open Web Analytics OWA before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '?php instead of the intended "?php sequence aren't handled by the PH...
CVE-2026-93982: Insertion of Sensitive Information into Log File
OpenPanel through commit bad75bdd writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP requests...
