CVE-2016-8527

Aruba AirWave (VisualRF) before version 8.2.3.1 is affected by CVE-2016-8527, a reflected XSS vulnerability. An attacker can exploit a malicious link to trick a logged-in AirWave admin into clicking it, potentially leaking session cookies or passwords. Root cause is a reflected XSS in the VisualR...

CVE-2016-8526

Aruba AirWave is affected by CVE-2016-8526 (XXE) in all versions up to 8.2.3.1. The vulnerability arises from an XML External Entity injection that allows an XML processor with access to the local filesystem (running with web server permissions) to read files and potentially exfiltrate password-c...