Page 10 of 55 results (0.007 seconds)

CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0

A remote authenticated SQL Injection vulnerabilitiy was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the web-based management interface API of ClearPass could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass instance. An attacker could exploit this vulnerability to obtain and modify sensitive information in the underlying database. Se detectó una vulnerabilidad de inyección SQL autenticada remota en Aruba ClearPass Policy Manager: versiones anteriores a 6.9.5, 6.8.8-HF1, 6.7.14-HF1. Una vulnerabilidad en la API de la interfaz de administración basada en web de ClearPass podría permitir a un atacante remoto autenticado conducir ataques de inyección SQL contra la instancia de ClearPass. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-004.txt • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0

A remote authenticated SQL Injection vulnerabilitiy was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the web-based management interface API of ClearPass could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass instance. An attacker could exploit this vulnerability to obtain and modify sensitive information in the underlying database. Se detectó una vulnerabilidad de inyección SQL autenticada remota en Aruba ClearPass Policy Manager: versiones anteriores a 6.9.5, 6.8.8-HF1, 6.7.14-HF1. Una vulnerabilidad en la API de la interfaz de administración basada en web de ClearPass podría permitir a un atacante remoto autenticado conducir ataques de inyección SQL contra la instancia de ClearPass. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-004.txt • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0

The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote execution. When the attacker is already authenticated to the administrative interface, they could then exploit the system, leading to remote command execution in the underlying operating system. Resolution: Fixed in 6.7.13-HF, 6.8.5-HF, 6.8.6, 6.9.1 and higher. La interfaz administrativa de ClearPass Policy Manager WebUI, presenta una ejecución de comando remota autenticado. Cuando el atacante ya está autenticado en la interfaz administrativa, podría explotar el sistema, conllevando a una ejecución de comando remota en el sistema operativo subyacente. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-005.txt •

CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0

The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote execution. When the attacker is already authenticated to the administrative interface, they could then exploit the system, leading to remote command execution in the underlying operating system. Resolution: Fixed in 6.7.13-HF, 6.8.5-HF, 6.8.6, 6.9.1 and higher. La interfaz administrativa de ClearPass Policy Manager WebUI, presenta una ejecución de comando remota autenticada. Cuando el atacante ya está autenticado en la interfaz administrativa, podría explotar el sistema, conllevando a una ejecución de comando remota en el sistema operativo subyacente. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-005.txt •

CVSS: 10.0EPSS: 94%CPEs: 3EXPL: 3

The ClearPass Policy Manager web interface is affected by a vulnerability that leads to authentication bypass. Upon successful bypass an attacker could then execute an exploit that would allow to remote command execution in the underlying operating system. Resolution: Fixed in 6.7.13-HF, 6.8.5-HF, 6.8.6, 6.9.1 and higher. La interfaz web de ClearPass Policy Manager está afectada por una vulnerabilidad que conlleva a una omisión de autenticación. Luego de una omisión con éxito, un atacante podría ejecutar una explotación que permitiría una ejecución de comando remota en el sistema operativo subyacente. • https://www.exploit-db.com/exploits/48661 https://github.com/Retr02332/CVE-2020-7115 http://packetstormsecurity.com/files/158368/ClearPass-Policy-Manager-Unauthenticated-Remote-Command-Execution.html https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-005.txt • CWE-306: Missing Authentication for Critical Function •