CVE-2022-43532

The CVE-2022-43532 issue affects Aruba ClearPass Policy Manager web-based management interface. A stored XSS vulnerability exists for authenticated users, enabling an attacker to inject script in the admin’s browser. Affected versions: ClearPass Policy Manager 6.10.x ≤ 6.10.7 and 6.9.x ≤ 6.9.12. ...

CVE-2022-43530

CVE-2022-43530 concerns Aruba ClearPass Policy Manager, where vulnerabilities in the web-based management interface could allow an authenticated remote attacker to perform SQL injection against the underlying database. The impact described across sources is potential exposure and modification of ...

CVE-2022-44535

A vulnerability in the Aruba EdgeConnect Enterprise Orchestrator web-based management interface allows remote low-privileged authenticated users to escalate their privileges to those of an administrative user. A successful exploit could allow an attacker to achieve administrative privilege on the...

CVE-2022-43527

CVE-2022-43527 concerns multiple XSS vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator. Affected are on-premises and cloud variants of Aruba EdgeConnect Enterprise Orchestrator and related deployments, with vulnerable versions including 9.2.1.40179...

CVE-2022-43526

Multiple vulnerabilities within the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow a remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary...

CVE-2022-43525

Multiple vulnerabilities within the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow a remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary...

CVE-2022-43524

A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting XSS attack against an administrative user of the interface. A successful exploit allows an attacker to execute...

CVE-2022-43523

Multiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the Aruba EdgeConnect Enterprise Orchestrator instance. An attacker could exploit these vulnerabilities...

CVE-2022-43522

Multiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the Aruba EdgeConnect Enterprise Orchestrator instance. An attacker could exploit these vulnerabilities...

PT-2023-14241 · Aruba · Aruba Clearpass Policy Manager

Name of the Vulnerable Software and Affected Versions: Aruba ClearPass Policy Manager versions 6.10.7 and below Aruba ClearPass Policy Manager versions 6.9.12 and below Description: Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remo...

Cisco Identity Services Engine Vulnerabilities (cisco-sa-ise-7Q4TNYUx)

According to its self-reported version, Cisco Identity Services Engine is affected by multiple vulnerabilities. - A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system...

Nokia FastMile 3TG00118ABAD52 信任管理问题漏洞

Nokia FastMile 3TG00118ABAD52 is a fixed wireless access from Nokia Finland. A security vulnerability exists in the Nokia FastMile 3TG00118ABAD52 that originates from the included default hardcoded administrator account, which can be used locally to access the web management interface...

CVE-2022-37919

A vulnerability exists in the API of Aruba EdgeConnect Enterprise. An unauthenticated attacker can exploit this condition via the web-based management interface to create a denial-of-service condition which prevents the appliance from properly responding to API requests in Aruba EdgeConnect...

Design/Logic Flaw

A vulnerability exists in the API of Aruba EdgeConnect Enterprise. An unauthenticated attacker can exploit this condition via the web-based management interface to create a denial-of-service condition which prevents the appliance from properly responding to API requests in Aruba EdgeConnect...

The vulnerability of the management interface of the Fortinet FortiDeceptor, which enables attackers to carry out spoofing attacks against external and internal security threats.

The vulnerability of the management interface for detecting and responding to external and internal security threats in Fortinet’s FortiDeceptor involves the lack of protective measures taken during the creation of the web page structure. Exploiting this vulnerability allows a malicious actor to...

CVE-2022-37918

Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access to sensitive information and/or change network...

CVE-2022-37917

CVE-2022-37917 affects Aruba AirWave Management Platform, exposing some web-based management URLs to broken access control. An attacker with limited privileges could access sensitive information or modify network configurations with higher-privilege effects. Impact is tied to AirWave versions 8.2...

rabbitmq-server: improper neutralization of script-related HTML tags in a web page (basic XSS) in federation management plugin

RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI via the rabbitmqfederationmanagement plugin, its consumer tag was rendered without proper tag sanitization. This potentially allows for...

Security Bulletin: This Power System update is being released to address CVE 2021-45486

Summary A security problem was fixed for the Virtualization Management Interface VMI for vulnerability CVE-2021-45486 that could allow a remote attacker to reveal sensitive information Vulnerability Details CVEID:CVE-2021-45486 DESCRIPTION: Linux Kernel could allow a local attacker to obtain...

Vulnerabilities fixed in Sophos firewall

Sophos has fixed several vulnerabilities in Sophos firewall. A malicious party could exploit the vulnerabilities to obtain system data through API calls and Cross-Site-Scripting XSS attacks. In addition, arbitrary code can be executed if the malicious party has gained management rights or gained...