1625 matches found
Authentication flaw
Aruba ClearPass, all versions of 6.6.x prior to 6.6.9 are affected by an authentication bypass vulnerability, an attacker can leverage this vulnerability to gain administrator privileges on the system. The vulnerability is exposed only on ClearPass web interfaces, including administrative, guest...
Design/Logic Flaw
Aruba ClearPass 6.6.3 and later includes a feature called "SSH Lockout", which causes ClearPass to lock accounts with too many login failures through SSH. When this feature is enabled, an unauthenticated remote command execution vulnerability is present which could allow an unauthenticated user t...
CVE-2018-7058
Aruba ClearPass CVE-2018-7058 affects all 6.6.x versions before 6.6.9. The issue is an authentication bypass that can allow an attacker to gain administrator privileges via ClearPass web interfaces (administrative, guest captive portal, and API). Impact is high (CVE-2018-7058). Mitigation: upgrad...
CVE-2017-9002
CVE-2017-9002 concerns Aruba ClearPass prior to 6.6.8, where a reflected cross-site scripting (XSS) vulnerability exists. The flaw enables an attacker to leverage social engineering to trick a logged‑in ClearPass admin into clicking a malicious link within the same browser session, potentially ex...
CVE-2018-7059
Aruba ClearPass prior to 6.6.9 contains an API vulnerability that can be exploited by an authenticated user with the small‑set “mon” permission to obtain cluster credentials and escalate privileges. The issue specifically affects the API used to coordinate cluster actions; exploitation is limited...
CVE-2018-7060
Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 is vulnerable to CSRF attacks against authenticated users. An attacker could manipulate an authenticated user into performing actions on the web administrative interface...
CVE-2018-7058
Aruba ClearPass, all versions of 6.6.x prior to 6.6.9 are affected by an authentication bypass vulnerability, an attacker can leverage this vulnerability to gain administrator privileges on the system. The vulnerability is exposed only on ClearPass web interfaces, including administrative, guest...
CVE-2018-7059
Aruba ClearPass prior to 6.6.9 has a vulnerability in the API that helps to coordinate cluster actions. An authenticated user with the "mon" permission could use this vulnerability to obtain cluster credentials which could allow privilege escalation. This vulnerability is only present when...
CVE-2018-7060
CVE-2018-7060 concerns Aruba ClearPass CSRF on authenticated users. Connected sources (NVD/CNVD) confirm: affected products are Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1. The vulnerability enables CSRF attacks that could cause an authenticated user to perform actions on the we...
CVE-2017-9001
Aruba ClearPass 6.6.3 and later includes a feature called "SSH Lockout", which causes ClearPass to lock accounts with too many login failures through SSH. When this feature is enabled, an unauthenticated remote command execution vulnerability is present which could allow an unauthenticated user t...
CVE-2017-9002
All versions of Aruba ClearPass prior to 6.6.8 contain reflected cross-site scripting vulnerabilities. By exploiting this vulnerability, an attacker who can trick a logged-in ClearPass administrative user into clicking a link could obtain sensitive information, such as session cookies or password...
CVE-2017-9001
Aruba ClearPass 6.6.3 and later includes an optional SSH Lockout feature. When this feature is enabled, the system is vulnerable to an unauthenticated remote command execution that can grant root privileges on the underlying OS. The vulnerability only exists for systems where SSH Lockout is enabl...
CVE-2017-5827
A reflected cross site scripting vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found...
CVE-2017-5826
An authenticated remote code execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found...
CVE-2017-5829
An access restriction bypass vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found...
CVE-2017-5825
A privilege escalation vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found...
CVE-2017-5826
An authenticated remote code execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found...
CVE-2017-5824
An unauthenticated remote code execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found...