2122 matches found
CVE-2017-9002
All versions of Aruba ClearPass prior to 6.6.8 contain reflected cross-site scripting vulnerabilities. By exploiting this vulnerability, an attacker who can trick a logged-in ClearPass administrative user into clicking a link could obtain sensitive information, such as session cookies or password...
CVE-2018-7059
Aruba ClearPass prior to 6.6.9 contains an API vulnerability that can be exploited by an authenticated user with the small‑set “mon” permission to obtain cluster credentials and escalate privileges. The issue specifically affects the API used to coordinate cluster actions; exploitation is limited...
CVE-2018-7060
CVE-2018-7060 concerns Aruba ClearPass CSRF on authenticated users. Connected sources (NVD/CNVD) confirm: affected products are Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1. The vulnerability enables CSRF attacks that could cause an authenticated user to perform actions on the we...
CVE-2017-9002
CVE-2017-9002 concerns Aruba ClearPass prior to 6.6.8, where a reflected cross-site scripting (XSS) vulnerability exists. The flaw enables an attacker to leverage social engineering to trick a logged‑in ClearPass admin into clicking a malicious link within the same browser session, potentially ex...
CVE-2017-9001
Aruba ClearPass 6.6.3 and later includes a feature called "SSH Lockout", which causes ClearPass to lock accounts with too many login failures through SSH. When this feature is enabled, an unauthenticated remote command execution vulnerability is present which could allow an unauthenticated user t...
CVE-2017-9001
Aruba ClearPass 6.6.3 and later includes an optional SSH Lockout feature. When this feature is enabled, the system is vulnerable to an unauthenticated remote command execution that can grant root privileges on the underlying OS. The vulnerability only exists for systems where SSH Lockout is enabl...
CVE-2018-7058
Aruba ClearPass CVE-2018-7058 affects all 6.6.x versions before 6.6.9. The issue is an authentication bypass that can allow an attacker to gain administrator privileges via ClearPass web interfaces (administrative, guest captive portal, and API). Impact is high (CVE-2018-7058). Mitigation: upgrad...
CVE-2018-7058
Aruba ClearPass, all versions of 6.6.x prior to 6.6.9 are affected by an authentication bypass vulnerability, an attacker can leverage this vulnerability to gain administrator privileges on the system. The vulnerability is exposed only on ClearPass web interfaces, including administrative, guest...
PT-2018-17876
Name of the Vulnerable Software and Affected Versions Aruba ClearPass versions 6.6.x prior to 6.6.9 Description The issue allows an attacker to bypass authentication and gain administrator privileges on the system. It is exposed through ClearPass web interfaces, including administrative, guest...
CVE-2017-9002: Improper Neutralization of Input During Web Page Generation
All versions of Aruba ClearPass prior to 6.6.8 contain reflected cross-site scripting vulnerabilities. By exploiting this vulnerability, an attacker who can trick a logged-in ClearPass administrative user into clicking a link could obtain sensitive information, such as session cookies or password...
CVE-2017-9001: Undefined Security Weakness
Aruba ClearPass 6.6.3 and later includes a feature called "SSH Lockout", which causes ClearPass to lock accounts with too many login failures through SSH. When this feature is enabled, an unauthenticated remote command execution vulnerability is present which could allow an unauthenticated user t...
CVE-2018-7060: Cross-Site Request Forgery (CSRF)
Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 is vulnerable to CSRF attacks against authenticated users. An attacker could manipulate an authenticated user into performing actions on the web administrative interface...
CVE-2018-7058: Improper Authentication
Aruba ClearPass, all versions of 6.6.x prior to 6.6.9 are affected by an authentication bypass vulnerability, an attacker can leverage this vulnerability to gain administrator privileges on the system. The vulnerability is exposed only on ClearPass web interfaces, including administrative, guest...
PT-2018-17877
Name of the Vulnerable Software and Affected Versions Aruba ClearPass versions prior to 6.6.9 Description The issue affects the API that coordinates cluster actions, allowing an authenticated user with the mon permission to potentially obtain cluster credentials. This could lead to privilege...
PT-2018-8489
Name of the Vulnerable Software and Affected Versions Aruba ClearPass versions prior to 6.6.8 Description The issue allows an attacker to obtain sensitive information, such as session cookies or passwords, by tricking a logged-in administrative user into clicking a malicious link. This can happen...
PT-2018-17878
Name of the Vulnerable Software and Affected Versions Aruba ClearPass versions 6.6.x prior to 6.6.9 Aruba ClearPass versions 6.7.x prior to 6.7.1 Description The issue allows for CSRF attacks against authenticated users. An attacker could manipulate an authenticated user into performing actions o...
PT-2018-8488
Name of the Vulnerable Software and Affected Versions Aruba ClearPass versions 6.6.3 and later Description The issue is related to the "SSH Lockout" feature, which when enabled, introduces an unauthenticated remote command execution issue. This could allow an unauthenticated user to execute...
CVE-2018-7059: Improper Input Validation
Aruba ClearPass prior to 6.6.9 has a vulnerability in the API that helps to coordinate cluster actions. An authenticated user with the "mon" permission could use this vulnerability to obtain cluster credentials which could allow privilege escalation. This vulnerability is only present when...
