CVE-2025-37164-PoC

CVE-2025-37164 - HPE OneView 인증되지 않은 RCE PoC CVE-2025-37164에 대한 PoC 익스플로잇입니다. 이는 HPE OneView의 치명적인 CVSS 10.0 인증되지 않은 원격 코드 실행 취약점입니다. 면책 조항 본 소프트웨어는 교육 및 승인된 보안 테스트 목적으로만 제공됩니다. 자신이 소유하거나 명시적 서면 허가를 받은 시스템에서만 사용하십시오. 컴퓨터 시스템에 대한 무단 접근은 불법입니다. 저자는 본 도구로 인한 오용이나 손해에 대해 책임지지 않습니다. 본 도구는 통제된 환경에서의 방어...

CVE-2025-37164

CVE-2025-37164 HPE OneView にリモートコード実行の問題が存在します。 この検出方法はどのように動作しますか？ このテンプレートは、OneView の title タグにマッチングし、JavaScript の artifactVersion 変数からバージョンを抽出し、バージョン 11.00 未満のインスタンスを潜在的に脆弱なものとしてフラグ付けします。 注意: このテンプレートによってフラグ付けされたインスタンスは脆弱である可能性があります。検出方法では、Z7550-98077 セキュリティホットフィックスがバージョン 5.20～10.20...

Exploit_CVE-2025-37164

ExploitCVE-2025-37164 ! このスクリプトは教育目的のみで作成されています。 CVE-2025-37164 用エクスプロイト 説明 : このスクリプトは、HPE OneView に影響する CVE-2025-37164 用のシンプルなエクスプロイトを提供し、資産が脆弱であるかどうかを検証するために使用できます。 使用方法 : root@kitploit: git clone https://github.com/LACHHAB-Anas/ExploitCVE-2025-37164.git cd ExploitCVE-2025-37164 pip install...

HPE OneView - Remote Code Execution

HPE OneView contains a remote code execution vulnerability, letting remote attackers execute arbitrary code. id: CVE-2025-37164 info: name: HPE OneView - Remote Code Execution author: DhiyaneshDk,garciaizcoa severity: critical description: | HPE OneView contains a remote code execution...

A week in security (January 5 – January 11)

Last week on Malwarebytes Labs: pcTattletale founder pleads guilty as US cracks down on stalkerware Are we ready for ChatGPT Health? CISA warns of active attacks on HPE OneView and legacy PowerPoint Lego’s Smart Bricks explained: what they do, and what they don’t Fake WinRAR downloads hide malwar...

CISA Urges Emergency Patching for Actively Exploited HPE OneView Flaw

CISA adds a critical HPE OneView flaw CVE-2025-37164 to its KEV catalogue with a Jan 28 deadline. Learn how this 10.0 RCE bug puts server infrastructure at risk...

CVE-2022-23699

A local authentication restriction bypass vulnerability was discovered in HPE OneView versions: Prior to 6.6. HPE has provided a software update to resolve this vulnerability in HPE OneView...

CVE-2022-23697

A remote cross-site scripting xss vulnerability was discovered in HPE OneView versions: Prior to 6.6. HPE has provided a software update to resolve this vulnerability in HPE OneView...

CVE-2022-23700

A local unauthorized read access to files vulnerability was discovered in HPE OneView versions: Prior to 6.6. HPE has provided a software update to resolve this vulnerability in HPE OneView...

CVE-2022-23698

A remote unauthenticated disclosure of information vulnerability was discovered in HPE OneView versions: Prior to 6.6. HPE has provided a software update to resolve this vulnerability in HPE OneView...

CVE-2022-37935

HPE OneView for VMware vCenter, in certain circumstances, may disclose the “HPE OneView” Username and Password...

CVE-2019-11992

A security vulnerability in HPE OneView for VMware vCenter 9.5 could be exploited remotely to allow Cross-Site Scripting...

CVE-2020-7198

There is a remote escalation of privilege possible for a malicious user that has a OneView account in OneView and Synergy Composer. HPE has provided updates to Oneview and Synergy Composer: Update to version 5.5 of OneView, Composer, or Composer2...

CVE-2022-37927

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Hewlett Packard Enterprise HPE OneView Global Dashboard OVGD...

CVE-2023-50274

HPE OneView may allow command injection with local privilege escalation...

CVE-2023-50275

HPE OneView may allow clusterService Authentication Bypass resulting in denial of service...

CISA warns of active attacks on HPE OneView and legacy PowerPoint

The US Cybersecurity and Infrastructure Security Agency CISA added both a newly discovered flaw and a much older one to its catalog of Known Exploited Vulnerabilities KEV. The KEV catalog gives Federal Civilian Executive Branch FCEB agencies a list of vulnerabilities that are known to be exploite...

CISA Flags Microsoft Office and HPE OneView Bugs as Actively Exploited

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Wednesday added two security flaws impacting Microsoft Office and Hewlett Packard Enterprise HPE OneView to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. The vulnerabilities are listed bel...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2009-0556link is external Microsoft Office PowerPoint Code Injection Vulnerability CVE-2025-37164link is external HPE OneView Code Injection Vulnerability These...

Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability

Hewlett Packard Enterprise HPE OneView contains a code injection vulnerability that allows a remote unauthenticated user to perform remote code execution...