CVE-2016-8526

Aruba AirWave is affected by CVE-2016-8526 (XXE) in all versions up to 8.2.3.1. The vulnerability arises from an XML External Entity injection that allows an XML processor with access to the local filesystem (running with web server permissions) to read files and potentially exfiltrate password-c...

PT-2018-17876

Name of the Vulnerable Software and Affected Versions Aruba ClearPass versions 6.6.x prior to 6.6.9 Description The issue allows an attacker to bypass authentication and gain administrator privileges on the system. It is exposed through ClearPass web interfaces, including administrative, guest...

CVE-2017-9002: Improper Neutralization of Input During Web Page Generation

All versions of Aruba ClearPass prior to 6.6.8 contain reflected cross-site scripting vulnerabilities. By exploiting this vulnerability, an attacker who can trick a logged-in ClearPass administrative user into clicking a link could obtain sensitive information, such as session cookies or password...

CVE-2017-9001: Undefined Security Weakness

Aruba ClearPass 6.6.3 and later includes a feature called "SSH Lockout", which causes ClearPass to lock accounts with too many login failures through SSH. When this feature is enabled, an unauthenticated remote command execution vulnerability is present which could allow an unauthenticated user t...

CVE-2018-7060: Cross-Site Request Forgery (CSRF)

Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 is vulnerable to CSRF attacks against authenticated users. An attacker could manipulate an authenticated user into performing actions on the web administrative interface...

CVE-2018-7058: Improper Authentication

Aruba ClearPass, all versions of 6.6.x prior to 6.6.9 are affected by an authentication bypass vulnerability, an attacker can leverage this vulnerability to gain administrator privileges on the system. The vulnerability is exposed only on ClearPass web interfaces, including administrative, guest...

CVE-2016-8527: Improper Neutralization of Input During Web Page Generation

Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site scripting XSS. The vulnerability is present in the VisualRF component of AirWave. By exploiting this vulnerability, an attacker who can trick a logged-in AirWave administrative user into clicking ...

PT-2018-17877

Name of the Vulnerable Software and Affected Versions Aruba ClearPass versions prior to 6.6.9 Description The issue affects the API that coordinates cluster actions, allowing an authenticated user with the mon permission to potentially obtain cluster credentials. This could lead to privilege...

PT-2018-17878

Name of the Vulnerable Software and Affected Versions Aruba ClearPass versions 6.6.x prior to 6.6.9 Aruba ClearPass versions 6.7.x prior to 6.7.1 Description The issue allows for CSRF attacks against authenticated users. An attacker could manipulate an authenticated user into performing actions o...

CVE-2016-8526: Improper Restriction of XML External Entity Reference

Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to an XML external entities XXE. XXEs are a way to permit XML parsers to access storage that exist on external systems. If an unprivileged user is permitted to control the contents of XML files, XXE can be used as an attac...

PT-2018-8488

Name of the Vulnerable Software and Affected Versions Aruba ClearPass versions 6.6.3 and later Description The issue is related to the "SSH Lockout" feature, which when enabled, introduces an unauthenticated remote command execution issue. This could allow an unauthenticated user to execute...

PT-2018-8489

Name of the Vulnerable Software and Affected Versions Aruba ClearPass versions prior to 6.6.8 Description The issue allows an attacker to obtain sensitive information, such as session cookies or passwords, by tricking a logged-in administrative user into clicking a malicious link. This can happen...

PT-2018-5020

Name of the Vulnerable Software and Affected Versions Aruba Airwave versions up to, but not including, 8.2.3.1 Description The issue is related to a reflected cross-site scripting XSS vulnerability present in the VisualRF component. This vulnerability can be exploited by an attacker who tricks a...

CVE-2018-7059: Improper Input Validation

Aruba ClearPass prior to 6.6.9 has a vulnerability in the API that helps to coordinate cluster actions. An authenticated user with the "mon" permission could use this vulnerability to obtain cluster credentials which could allow privilege escalation. This vulnerability is only present when...

PT-2018-5019

Name of the Vulnerable Software and Affected Versions Aruba Airwave versions up to, but not including, 8.2.3.1 Description The issue allows an unprivileged user to control the contents of XML files, which can be used as an attack vector. This is due to the XML parser's ability to access storage o...

PT-2018-1870

Name of the Vulnerable Software and Affected Versions Texas Instruments Bluetooth Low Energy versions affected versions not specified Aruba Access points affected versions not specified Description The issue is caused by a repeated memory release in the OAD mechanism of Texas Instruments Bluetoot...

Unrestricted file upload

Unrestricted file upload vulnerability in Aruba Web Management portal allows remote attackers to execute arbitrary code by uploading a file with an executable extension...

CVE-2014-2592

Unrestricted file upload vulnerability in Aruba Web Management portal allows remote attackers to execute arbitrary code by uploading a file with an executable extension...

CVE-2014-2592

Unrestricted file upload vulnerability in Aruba Web Management portal allows remote attackers to execute arbitrary code by uploading a file with an executable extension...

CVE-2014-2592

The CVE-2014-2592 entry concerns Aruba Web Management portal with an unrestricted file upload vulnerability that could allow remote attackers to execute arbitrary code by uploading a file with an executable extension. The NVD entry confirms a high-severity issue (CVSS v2/9.8 in v3) with network a...