CVE-2016-8527

Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site scripting XSS. The vulnerability is present in the VisualRF component of AirWave. By exploiting this vulnerability, an attacker who can trick a logged-in AirWave administrative user into clicking ...

Cross site request forgery (csrf)

Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 is vulnerable to CSRF attacks against authenticated users. An attacker could manipulate an authenticated user into performing actions on the web administrative interface...

Xxe

Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to an XML external entities XXE. XXEs are a way to permit XML parsers to access storage that exist on external systems. If an unprivileged user is permitted to control the contents of XML files, XXE can be used as an attac...

Cross site scripting

Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site scripting XSS. The vulnerability is present in the VisualRF component of AirWave. By exploiting this vulnerability, an attacker who can trick a logged-in AirWave administrative user into clicking ...

Authentication flaw

Aruba ClearPass, all versions of 6.6.x prior to 6.6.9 are affected by an authentication bypass vulnerability, an attacker can leverage this vulnerability to gain administrator privileges on the system. The vulnerability is exposed only on ClearPass web interfaces, including administrative, guest...

CVE-2016-8527

Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site scripting XSS. The vulnerability is present in the VisualRF component of AirWave. By exploiting this vulnerability, an attacker who can trick a logged-in AirWave administrative user into clicking ...

CVE-2016-8526

Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to an XML external entities XXE. XXEs are a way to permit XML parsers to access storage that exist on external systems. If an unprivileged user is permitted to control the contents of XML files, XXE can be used as an attac...

Design/Logic Flaw

Aruba ClearPass 6.6.3 and later includes a feature called "SSH Lockout", which causes ClearPass to lock accounts with too many login failures through SSH. When this feature is enabled, an unauthenticated remote command execution vulnerability is present which could allow an unauthenticated user t...

CVE-2018-7058

Aruba ClearPass CVE-2018-7058 affects all 6.6.x versions before 6.6.9. The issue is an authentication bypass that can allow an attacker to gain administrator privileges via ClearPass web interfaces (administrative, guest captive portal, and API). Impact is high (CVE-2018-7058). Mitigation: upgrad...

CVE-2018-7059

Aruba ClearPass prior to 6.6.9 contains an API vulnerability that can be exploited by an authenticated user with the small‑set “mon” permission to obtain cluster credentials and escalate privileges. The issue specifically affects the API used to coordinate cluster actions; exploitation is limited...

CVE-2017-9002

CVE-2017-9002 concerns Aruba ClearPass prior to 6.6.8, where a reflected cross-site scripting (XSS) vulnerability exists. The flaw enables an attacker to leverage social engineering to trick a logged‑in ClearPass admin into clicking a malicious link within the same browser session, potentially ex...

CVE-2018-7058

Aruba ClearPass, all versions of 6.6.x prior to 6.6.9 are affected by an authentication bypass vulnerability, an attacker can leverage this vulnerability to gain administrator privileges on the system. The vulnerability is exposed only on ClearPass web interfaces, including administrative, guest...

CVE-2018-7059

Aruba ClearPass prior to 6.6.9 has a vulnerability in the API that helps to coordinate cluster actions. An authenticated user with the "mon" permission could use this vulnerability to obtain cluster credentials which could allow privilege escalation. This vulnerability is only present when...

CVE-2016-8527

Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site scripting XSS. The vulnerability is present in the VisualRF component of AirWave. By exploiting this vulnerability, an attacker who can trick a logged-in AirWave administrative user into clicking ...

CVE-2018-7060

Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 is vulnerable to CSRF attacks against authenticated users. An attacker could manipulate an authenticated user into performing actions on the web administrative interface...

CVE-2016-8527

Aruba AirWave (VisualRF) before version 8.2.3.1 is affected by CVE-2016-8527, a reflected XSS vulnerability. An attacker can exploit a malicious link to trick a logged-in AirWave admin into clicking it, potentially leaking session cookies or passwords. Root cause is a reflected XSS in the VisualR...

CVE-2017-9001

Aruba ClearPass 6.6.3 and later includes a feature called "SSH Lockout", which causes ClearPass to lock accounts with too many login failures through SSH. When this feature is enabled, an unauthenticated remote command execution vulnerability is present which could allow an unauthenticated user t...

EUVD-2016-9374

Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to an XML external entities XXE. XXEs are a way to permit XML parsers to access storage that exist on external systems. If an unprivileged user is permitted to control the contents of XML files, XXE can be used as an attac...

CVE-2018-7060

CVE-2018-7060 concerns Aruba ClearPass CSRF on authenticated users. Connected sources (NVD/CNVD) confirm: affected products are Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1. The vulnerability enables CSRF attacks that could cause an authenticated user to perform actions on the we...

CVE-2016-8526

Aruba AirWave is affected by CVE-2016-8526 (XXE) in all versions up to 8.2.3.1. The vulnerability arises from an XML External Entity injection that allows an XML processor with access to the local filesystem (running with web server permissions) to read files and potentially exfiltrate password-c...