CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2021-26682
https://notcve.org/view.php?id=CVE-2021-26682
23 Feb 2021 — A remote reflected cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the guest portal interface of ClearPass could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the portal. A successful exploit could allow an attacker to execute arbitrary script code in a victim’s browser in the context of the guest portal interface. Se detectó una vulnerabilidad ... • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-004.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 3%CPEs: 3EXPL: 0CVE-2021-26681
https://notcve.org/view.php?id=CVE-2021-26681
23 Feb 2021 — A remote authenticated command Injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the ClearPass CLI could allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise. Se detectó una vulnerabilidad de inyección de comando autenticada remota e... • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-004.txt • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 3%CPEs: 3EXPL: 0CVE-2021-26683
https://notcve.org/view.php?id=CVE-2021-26683
23 Feb 2021 — A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the ClearPass web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise. Se detectó una vulnerabilidad de inyección de comand... • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-004.txt • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-26686
https://notcve.org/view.php?id=CVE-2021-26686
23 Feb 2021 — A remote authenticated SQL Injection vulnerabilitiy was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the web-based management interface API of ClearPass could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass instance. An attacker could exploit this vulnerability to obtain and modify sensitive information in the underlying database. Se detectó una vulnerabilidad de inyección SQL autenticada remo... • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-004.txt • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-26685
https://notcve.org/view.php?id=CVE-2021-26685
23 Feb 2021 — A remote authenticated SQL Injection vulnerabilitiy was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the web-based management interface API of ClearPass could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass instance. An attacker could exploit this vulnerability to obtain and modify sensitive information in the underlying database. Se detectó una vulnerabilidad de inyección SQL autenticada remo... • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-004.txt • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2018-7063
https://notcve.org/view.php?id=CVE-2018-7063
07 Dec 2018 — In Aruba ClearPass, disabled API admins can still perform read/write operations. In certain circumstances, API admins in ClearPass which have been disabled may still be able to perform read/write operations on parts of the XML API. This can lead to unauthorized access to the API and complete compromise of the ClearPass instance if an attacker knows of the existence of these accounts. En Aruba ClearPass, los administradores de la API deshabilitados pueden seguir realizando operaciones de lectura/escritura. E... • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-007.txt • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 9.3EPSS: 1%CPEs: 2EXPL: 0CVE-2018-7066
https://notcve.org/view.php?id=CVE-2018-7066
07 Dec 2018 — An unauthenticated remote command execution exists in Aruba ClearPass Policy Manager on linked devices. The ClearPass OnConnect feature permits administrators to link other network devices into ClearPass for the purpose of collecting enhanced information about connected endpoints. A defect in the API could allow a remote attacker to execute arbitrary commands on one of the linked devices. This vulnerability is only applicable if credentials for devices have been supplied to ClearPass under Configuration -> ... • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-007.txt •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2018-7067
https://notcve.org/view.php?id=CVE-2018-7067
07 Dec 2018 — A Remote Authentication bypass in Aruba ClearPass Policy Manager leads to complete cluster compromise. An authentication flaw in all versions of ClearPass could allow an attacker to compromise the entire cluster through a specially crafted API call. Network access to the administrative web interface is required to exploit this vulnerability. Resolution: Fixed in 6.7.6 and 6.6.10-hotfix. Una omisión de autenticación remota en Aruba ClearPass Policy Manager conduce al compromiso total del clúster. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-007.txt • CWE-287: Improper Authentication •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2018-7079
https://notcve.org/view.php?id=CVE-2018-7079
07 Dec 2018 — Aruba ClearPass Policy Manager guest authorization failure. Certain administrative operations in ClearPass Guest do not properly enforce authorization rules, which allows any authenticated administrative user to execute those operations regardless of privilege level. This could allow low-privilege users to view, modify, or delete guest users. Resolution: Fixed in 6.7.6 and 6.6.10-hotfix. Error de autorización de invitados en Aruba ClearPass Policy Manager. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-007.txt • CWE-863: Incorrect Authorization •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2018-7065
https://notcve.org/view.php?id=CVE-2018-7065
07 Dec 2018 — An authenticated SQL injection vulnerability in Aruba ClearPass Policy Manager can lead to privilege escalation. All versions of ClearPass are affected by multiple authenticated SQL injection vulnerabilities. In each case, an authenticated administrative user of any type could exploit this vulnerability to gain access to "appadmin" credentials, leading to complete cluster compromise. Resolution: Fixed in 6.7.6 and 6.6.10-hotfix. Una vulnerabilidad de inyección SQL autenticada en Aruba ClearPass Policy Manag... • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-007.txt • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •