CVSS: 6.4EPSS: 0%CPEs: 8EXPL: 0CVE-2022-37896
https://notcve.org/view.php?id=CVE-2022-37896
07 Oct 2022 — A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim’s browser in the context of the affected interface of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 a... • https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 60EXPL: 0CVE-2022-37888
https://notcve.org/view.php?id=CVE-2022-37888
06 Oct 2022 — There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating system of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS... • https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.5EPSS: 4%CPEs: 60EXPL: 2CVE-2002-20001
https://notcve.org/view.php?id=CVE-2002-20001
11 Nov 2021 — The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)at or D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive in cases where a client can require a server to select its largest supported key size. The basic attack scenario is that the client must claim that it c... • https://github.com/c0r0n3r/dheater • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0CVE-2021-37734
https://notcve.org/view.php?id=CVE-2021-37734
12 Oct 2021 — A remote unauthorized read access to files vulnerability was discovered in Aruba Instant version(s): 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x.x: 6.5.4.19 and below; Aruba Instant 8.5.x.x: 8.5.0.12 and below; Aruba Instant 8.6.x.x: 8.6.0.11 and below; Aruba Instant 8.7.x.x: 8.7.1.3 and below; Aruba Instant 8.8.x.x: 8.8.0.0 and below. Aruba has released patches for Aruba Instant (IAP) that address this security vulnerability. Se ha detectado una vulnerabilidad de acceso remoto no autorizado a ... • https://cert-portal.siemens.com/productcert/pdf/ssa-917476.pdf • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 0CVE-2021-37735
https://notcve.org/view.php?id=CVE-2021-37735
12 Oct 2021 — A remote denial of service vulnerability was discovered in Aruba Instant version(s): Aruba Instant 6.5.x.x: 6.5.4.18 and below; Aruba Instant 8.5.x.x: 8.5.0.10 and below; Aruba Instant 8.6.x.x: 8.6.0.4 and below. Aruba has released patches for Aruba Instant (IAP) that address this security vulnerability. Se ha detectado una vulnerabilidad de denegación de servicio remota en Aruba Instant Aruba Instant versiones: 6.5.x.x: 6.5.4.18 y por debajo; Aruba Instant 8.5.x.x: 8.5.0.10 y por debajo; Aruba Instant 8.6.... • https://cert-portal.siemens.com/productcert/pdf/ssa-917476.pdf • CWE-134: Use of Externally-Controlled Format String •
CVSS: 9.0EPSS: 2%CPEs: 7EXPL: 0CVE-2021-37732
https://notcve.org/view.php?id=CVE-2021-37732
12 Oct 2021 — A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 6.4.x.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x.x: 6.5.4.18 and below; Aruba Instant 8.5.x.x: 8.5.0.11 and below; Aruba Instant 8.6.x.x: 8.6.0.6 and below; Aruba Instant 8.7.x.x: 8.7.1.0 and below. Aruba has released patches for Aruba Instant (IAP) that address this security vulnerability. Se ha detectado una vulnerabilidad de ejecución de comandos remota arbitrarias en HPE Aruba I... • https://cert-portal.siemens.com/productcert/pdf/ssa-917476.pdf • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 2%CPEs: 7EXPL: 0CVE-2021-37727
https://notcve.org/view.php?id=CVE-2021-37727
12 Oct 2021 — A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x.x: 6.5.4.20 and below; Aruba Instant 8.5.x.x: 8.5.0.12 and below; Aruba Instant 8.6.x.x: 8.6.0.11 and below; Aruba Instant 8.7.x.x: 8.7.1.3 and below. Aruba has released patches for Aruba Instant (IAP) that address this security vulnerability. Se ha detectado una vulnerabilidad de ejecución de comandos remota arbitrarias en HPE Aruba Instant (IAP) ... • https://cert-portal.siemens.com/productcert/pdf/ssa-917476.pdf • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 2%CPEs: 7EXPL: 0CVE-2021-37730
https://notcve.org/view.php?id=CVE-2021-37730
12 Oct 2021 — A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x.x: 6.5.4.20 and below; Aruba Instant 8.5.x.x: 8.5.0.12 and below; Aruba Instant 8.6.x.x: 8.6.0.11 and below; Aruba Instant 8.7.x.x: 8.7.1.3 and below. Aruba has released patches for Aruba Instant (IAP) that address this security vulnerability. Se ha detectado una vulnerabilidad de ejecución de comandos remota arbitrarias en HPE Aruba ... • https://cert-portal.siemens.com/productcert/pdf/ssa-917476.pdf • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 1%CPEs: 3EXPL: 0CVE-2021-37726
https://notcve.org/view.php?id=CVE-2021-37726
12 Oct 2021 — A remote buffer overflow vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 8.7.x.x: 8.7.0.0 through 8.7.1.2. Aruba has released patches for Aruba Instant (IAP) that address this security vulnerability. Se ha detectado una vulnerabilidad de desbordamiento de búfer remoto en HPE Aruba Instant (IAP) versiones: Aruba Instant 8.7.x.x: 8.7.0.0 hasta 8.7.1.2. Aruba ha publicado parches para Aruba Instant (IAP) que abordan esta vulnerabilidad de seguridad • https://cert-portal.siemens.com/productcert/pdf/ssa-917476.pdf • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.2EPSS: 0%CPEs: 20EXPL: 0CVE-2021-37731
https://notcve.org/view.php?id=CVE-2021-37731
07 Sep 2021 — A local path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.0-2.2.0.4; Prior to 8.7.1.1, 8.6.0.7, 8.5.0.12, 8.3.0.16. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability. Se ha detectado una vulnerabilidad de salto de ruta local en Aruba SD-WAN Software and Gateways; Aruba Operating System Software versiones: anteriores a 8.6.0.0-2.2.0.4; anteriores a 8... • https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •