CVSS: 9.8EPSS: 0%CPEs: 7EXPL: 0CVE-2017-9000
https://notcve.org/view.php?id=CVE-2017-9000
ArubaOS, all versions prior to 6.3.1.25, 6.4 prior to 6.4.4.16, 6.5.x prior to 6.5.1.9, 6.5.2, 6.5.3 prior to 6.5.3.3, 6.5.4 prior to 6.5.4.2, 8.x prior to 8.1.0.4 FIPS and non-FIPS versions of software are both affected equally is vulnerable to unauthenticated arbitrary file access. An unauthenticated user with network access to an Aruba mobility controller on TCP port 8080 or 8081 may be able to access arbitrary files stored on the mobility controller. Ports 8080 and 8081 are used for captive portal functionality and are listening, by default, on all IP interfaces of the mobility controller, including captive portal interfaces. The attacker could access files which could contain passwords, keys, and other sensitive information that could lead to full system compromise. ArubaOS, en todas las versiones anteriores a la 6.3.1.25, versiones 6.4 anteriores a la 6.4.4.16, versiones 6.5.x anteriores a la 6.5.1.9, 6.5.2, versiones 6.5.3 anteriores a la 6.5.3.3, versiones 6.5.4 anteriores a la 6.5.4.2, versiones 8.x anteriores a la 8.1.0.4 de versiones FIPS y non-FIPS (afectadas por igual), se ha visto afectado por un acceso no autenticado a archivos arbitrarios. • http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-006.txt http://www.securitytracker.com/id/1039580 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.2EPSS: 0%CPEs: 38EXPL: 0CVE-2015-1388
https://notcve.org/view.php?id=CVE-2015-1388
The "RAP console" feature in ArubaOS 5.x through 6.2.x, 6.3.x before 6.3.1.15, and 6.4.x before 6.4.2.4 on Aruba access points in Remote Access Point (AP) mode allows remote attackers to execute arbitrary commands via unspecified vectors. La característica 'RAP console' en ArubaOS 5.x hasta 6.2.x, 6.3.x anterior a 6.3.1.15, y 6.4.x anterior a 6.4.2.4 en los puntos de acceso de Aruba en el modo Remote Access Point (AP) permite a atacantes remotos ejecutar comandos arbitrarios a través de vectores no especificados. • http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-004.txt • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 4.3EPSS: 0%CPEs: 11EXPL: 0CVE-2013-2290
https://notcve.org/view.php?id=CVE-2013-2290
Cross-site scripting (XSS) vulnerability in the dashboard of the ArubaOS Administration WebUI in Aruba Networks ArubaOS 6.2.x before 6.2.0.3, 6.1.3.x before 6.1.3.7, 6.1.x-FIPS before 6.1.4.3-FIPS, and 6.1.x-AirGroup before 6.1.3.6-AirGroup, as used by Mobility Controller, allows remote wireless access points to inject arbitrary web script or HTML via a crafted SSID. Ejecución de comandos en sitios cruzados (XSS) en el tablero de la WebUI ArubaOS Administración en Aruba Networks ArubaOS v6.2.x antes de v6.2.0.3, v6.1.3.x antes de v6.1.3.7, v6.1.x-FIPS antes de 6.1.4.3-FIPS, y 6.1.x-Airgroup antes v6.1.3.6-Airgroup, utilizada por el Mobility Controller, que permite a los puntos de acceso inalámbricos remotos inyectar secuencias de comandos web o HTML a través de un SSID diseñado. • http://osvdb.org/91485 http://secunia.com/advisories/52690 http://www.arubanetworks.com/support/alerts/aid-042213.asc http://www.securityfocus.com/bid/58579 https://exchange.xforce.ibmcloud.com/vulnerabilities/82917 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •