CVSS: 10.0EPSS: 0%CPEs: 7EXPL: 0CVE-2021-37716
https://notcve.org/view.php?id=CVE-2021-37716
A remote buffer overflow vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.2, 8.6.0.8, 8.5.0.12, 8.3.0.15. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability. Se ha detectado una vulnerabilidad de desbordamiento de búfer remoto en Aruba SD-WAN Software and Gateways; Aruba Operating System Software versiones: anteriores a 8.6.0.4-2.2.0.4; anteriores a 8.7.1.2, 8.6.0.8, 8.5.0.12, 8.3.0.15. Aruba ha publicado parches para Aruba SD-WAN Software and Gateways y ArubaOS que solucionan esta vulnerabilidad de seguridad • https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txt • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 5.3EPSS: 0%CPEs: 38EXPL: 0CVE-2020-26146 – kernel: reassembling encrypted fragments with non-consecutive packet numbers
https://notcve.org/view.php?id=CVE-2020-26146
An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations reassemble fragments with non-consecutive packet numbers. An adversary can abuse this to exfiltrate selected fragments. This vulnerability is exploitable when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used. Note that WEP is vulnerable to this attack by design. • http://www.openwall.com/lists/oss-security/2021/05/11/12 https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63 https://www.fragattacks.com https://access.redhat.com/security/cve/CVE-2020-26146 https://bugzilla.redhat.com/show&# • CWE-20: Improper Input Validation CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 10.0EPSS: 0%CPEs: 7EXPL: 0CVE-2019-5319
https://notcve.org/view.php?id=CVE-2019-5319
A remote buffer overflow vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.16 and below; Aruba Instant 8.3.x: 8.3.0.12 and below; Aruba Instant 8.5.x: 8.5.0.6 and below; Aruba Instant 8.6.x: 8.6.0.2 and below. Aruba has released patches for Aruba Instant that address this security vulnerability. Se detectó una vulnerabilidad de desbordamiento de búfer remoto en algunos productos Aruba Instant Access Point (IAP) en versiones: Aruba Instant versiones 6.4.x: 6.4.4.8-4.2.4.17 y anteriores; Aruba Instant versiones 6.5.x: 6.5.4.16 y anteriores; Aruba Instant versiones 8.3.x: 8.3.0.12 y anteriores; Aruba Instant versiones 8.5.x: 8.5.0.6 y anteriores; Aruba Instant versiones 8.6.x: 8.6.0.2 y anteriores. Aruba ha lanzado parches para Aruba Instant que abordan esta vulnerabilidad de seguridad. • https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 2CVE-2021-25161 – Aruba Instant (IAP) - Remote Code Execution
https://notcve.org/view.php?id=CVE-2021-25161
A remote cross-site scripting (xss) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba Instant 8.6.x: 8.6.0.7 and below; Aruba Instant 8.7.x: 8.7.1.1 and below. Aruba has released patches for Aruba Instant that address this security vulnerability. Se detectó una vulnerabilidad de tipo cross-site scripting (xss) remota en algunos productos Aruba Instant Access Point (IAP) en versiones: Aruba Instant versiones 6.4.x: 6.4.4.8-4.2.4.17 y anteriores; Aruba Instant versiones 6.5.x: 6.5.4.18 y anteriores; Aruba Instant versiones 8.3.x: 8.3.0.14 y anteriores; Aruba Instant versiones 8.5.x: 8.5.0.11 y anteriores; Aruba Instant versiones 8.6.x: 8.6.0.7 y anteriores; Aruba Instant versiones 8.7.x: 8.7.1.1 y anteriores. Aruba ha lanzado parches para Aruba Instant que abordan esta vulnerabilidad de seguridad. • https://www.exploit-db.com/exploits/50136 http://packetstormsecurity.com/files/163522/Aruba-Instant-IAP-Remote-Code-Execution.html https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.3EPSS: 60%CPEs: 8EXPL: 3CVE-2021-25162 – Aruba Instant (IAP) - Remote Code Execution
https://notcve.org/view.php?id=CVE-2021-25162
A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba Instant 8.6.x: 8.6.0.7 and below; Aruba Instant 8.7.x: 8.7.1.1 and below. Aruba has released patches for Aruba Instant that address this security vulnerability. Se detectó una vulnerabilidad de ejecución remota de comandos arbitrarios en algunos productos Aruba Instant Access Point (IAP) en versiones: Aruba Instant versiones 6.4.x: 6.4.4.8-4.2.4.17 y anteriores; Aruba Instant versiones 6.5.x: 6.5.4.18 y anteriores; Aruba Instant versiones 8.3.x: 8.3.0.14 y anteriores; Aruba Instant versiones 8.5.x: 8.5.0.11 y anteriores; Aruba Instant versiones 8.6.x: 8.6.0.7 y anteriores; Aruba Instant versiones 8.7.x: 8.7.1.1 y anteriores. Aruba ha lanzado parches para Aruba Instant que abordan esta vulnerabilidad de seguridad. • https://www.exploit-db.com/exploits/50136 https://github.com/twentybel0w/CVE-2021-25162 http://packetstormsecurity.com/files/163522/Aruba-Instant-IAP-Remote-Code-Execution.html https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •