CVE-2023-25591 Authenticated Information Disclosure in ClearPass Policy Manager Web-Based Management Interface

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further...

CVE-2023-25591

CVE-2023-25591 affects Aruba ClearPass Policy Manager Web-Based Management Interface. An attacker authenticated with low privileges could access sensitive information via the management UI, enabling potential privilege escalation. The issue is documented across multiple feeds (NVD, CVE listings, ...

CVE-2023-25592: Improper Neutralization of Input During Web Page Generation

Vulnerabilities within the web-based management interface of ClearPass Policy Manager could allow a remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browse...

CVE-2023-25593: Improper Neutralization of Input During Web Page Generation

Vulnerabilities within the web-based management interface of ClearPass Policy Manager could allow a remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browse...

CVE-2023-25594: Incorrect Authorization

A vulnerability in the web-based management interface of ClearPass Policy Manager allows an attacker with read-only privileges to perform actions that change the state of the ClearPass Policy Manager instance. Successful exploitation of this vulnerability allows an attacker to...

Cisco IP Phones < 11.3.7SR1 Multiple Vulnerabilities (cisco-sa-ip-phone-cmd-inj-KMFynVcP)

Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service DoS condition. Please see the included Cisco BIDs and Cisco Security Advisory for more information...

CVE-2023-20069: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network EPN Manager could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface on an affected device. This...

CVE-2023-20079: Stack-based Buffer Overflow

Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service DoS condition. For more information about these vulnerabilities, see the Details section of this advisor...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. This vulnerability is due to...

CVE-2023-22761 Authenticated Remote Command Execution in ArubaOS Web-based Management Interface

Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to full...

CVE-2023-22758 Authenticated Remote Command Execution in ArubaOS Web-based Management Interface

Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to full...

PT-2023-2089

Name of the Vulnerable Software and Affected Versions ArubaOS affected versions not specified Description The issue is related to an information disclosure vulnerability in the ArubaOS web-based management interface. This vulnerability allows a remote attacker to read arbitrary files in the...

PT-2023-2054

Name of the Vulnerable Software and Affected Versions ArubaOS affected versions not specified Description The issue is related to an authenticated path traversal vulnerability in the ArubaOS web-based management interface. This vulnerability allows for the deletion of arbitrary files in the...

CVE-2023-22777: Exposure of Resource to Wrong Sphere

An authenticated information disclosure vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in the ability to read arbitrary files in the underlying operating system...

CVE-2023-22761: Improper Neutralization of Special Elements used in a Command

Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to full...

CVE-2023-22759: Improper Neutralization of Special Elements used in a Command

Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to full...

CVE-2023-22772: Improper Limitation of a Pathname to a Restricted Directory

An authenticated path traversal vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in the ability to delete arbitrary files in the underlying operating system...

CVE-2023-22760: Improper Neutralization of Special Elements used in a Command

Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to full...

CVE-2023-22758: Improper Neutralization of Special Elements used in a Command

Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to full...

CVE-2023-20011 Cisco Application Policy Infrastructure Controller and Cisco Cloud Network Controller Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller APIC and Cisco Cloud Network Controller, formerly Cisco Cloud APIC, could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system...