4 results (0.009 seconds)

CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0

CVE-2016-4401

https://notcve.org/view.php?id=CVE-2016-4401

Aruba ClearPass Policy Manager before 6.5.7 and 6.6.x before 6.6.2 allows attackers to obtain database credentials. Aruba ClearPass Policy Manager versiones anteriores a 6.5.7 y versiones 6.6.x anteriores a 6.6.2, permite a atacantes obtener credenciales de la base de datos. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2016-010.txt • CWE-522: Insufficiently Protected Credentials •

CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0

CVE-2018-7060

https://notcve.org/view.php?id=CVE-2018-7060

Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 is vulnerable to CSRF attacks against authenticated users. An attacker could manipulate an authenticated user into performing actions on the web administrative interface. Aruba ClearPass en versiones 6.6.x anteriores a la 6.6.9 y versiones 6.7.x anteriores a la 6.7.1 es vulnerable a ataques de Cross-Site Request Forgery (CSRF) contra usuarios autenticados. Un atacante podría manipular a un usuario autenticado para qu realice acciones en la interfaz web administrativa. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-003.txt • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0

CVE-2018-0489

https://notcve.org/view.php?id=CVE-2018-0489

Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this issue exists because of an incomplete fix for CVE-2018-0486. Shibboleth XMLTooling-C en versiones anteriores a la 1.6.4, tal y como se emplea en Shibboleth Service Provider en versiones anteriores a la 2.6.1.4 en Windows y otros productos, gestiona de manera incorrecta las firmas digitales de datos de usuario. Esto permite que atacantes remotos obtengan información sensible o lleven a cabo ataques de suplantación mediante datos XML manipulados. NOTA: este problema existe debido a una solución incompleta para CVE-2018-0486. • http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-003.txt http://www.securityfocus.com/bid/103172 http://www.securitytracker.com/id/1040435 https://lists.debian.org/debian-lts-announce/2018/02/msg00031.html https://shibboleth.net/community/advisories/secadv_20180227.txt https://www.debian.org/security/2018/dsa-4126 • CWE-347: Improper Verification of Cryptographic Signature •

CVSS: 9.8EPSS: 0%CPEs: 8EXPL: 0

CVE-2016-2034

https://notcve.org/view.php?id=CVE-2016-2034

SQL injection vulnerability in ClearPass Policy Manager 6.5.x through 6.5.6 and 6.6.0. Vulnerabilidad de inyección SQL en ClearPass Policy Manager versiones 6.5.x hasta 6.5.6 y versión 6.6.0. • http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2016-009.txt • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •