CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-26961
https://notcve.org/view.php?id=CVE-2021-26961
A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the AirWave web-based management interface could allow an unauthenticated remote attacker to conduct a CSRF attack against a vulnerable system. A successful exploit would consist of an attacker persuading an authorized user to follow a malicious link, resulting in arbitrary actions being carried out with the privilege level of the targeted user. Se detectó una vulnerabilidad de tipo cross-site request forgery (csrf) remotos no autenticados en Aruba AirWave Management Platform versiones: anteriores a 8.2.12.0. Una vulnerabilidad en la interfaz de administración basada en web de AirWave podría permitir a un atacante remoto no autenticado conducir un ataque CSRF contra un sistema vulnerable. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-005.txt • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-7120
https://notcve.org/view.php?id=CVE-2020-7120
A local authenticated buffer overflow vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in ClearPass OnGuard could allow local authenticated users to cause a buffer overflow condition. A successful exploit could allow a local attacker to execute arbitrary code within the context the binary is running in, which is a lower privileged account. Se detectó una vulnerabilidad de desbordamiento del búfer autenticado local en Aruba ClearPass Policy Manager versiones: Anteriores a 6.9.5, 6.8.8-HF1, 6.7.14-HF1. Una vulnerabilidad en ClearPass OnGuard podría permitir a los usuarios autenticados locales causar una condición de desbordamiento del búfer. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-004.txt • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-26677
https://notcve.org/view.php?id=CVE-2021-26677
A local authenticated escalation of privilege vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in ClearPass OnGuard could allow local authenticated users on a Windows platform to elevate their privileges. A successful exploit could allow an attacker to execute arbitrary code with SYSTEM level privileges. Se detectó una vulnerabilidad de escalada de privilegios autenticada local en Aruba ClearPass Policy Manager versiones: Anteriores a 6.9.5, 6.8.8-HF1, 6.7.14-HF1. Una vulnerabilidad en ClearPass OnGuard podría permitir a usuarios locales autenticados en una plataforma Windows elevar sus privilegios. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-004.txt •
CVSS: 9.0EPSS: 0%CPEs: 5EXPL: 0CVE-2021-26679
https://notcve.org/view.php?id=CVE-2021-26679
A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the ClearPass web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise. Una vulnerabilidad de inyección de comando autenticada remota fue detectada en Aruba ClearPass Policy Manager versiones: Anteriores a 6.9.5, 6.8.8-HF1, 6.7.14-HF1. Una vulnerabilidad en la interfaz de administración basada en web de ClearPass permite a usuarios autenticados remotos ejecutar comandos arbitrarios en el host subyacente. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-004.txt • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 5EXPL: 0CVE-2021-26680
https://notcve.org/view.php?id=CVE-2021-26680
A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the ClearPass web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise. Una vulnerabilidad de inyección de comando autenticada remota fue detectada en Aruba ClearPass Policy Manager versiones: Anteriores a 6.9.5, 6.8.8-HF1, 6.7.14-HF1. Una vulnerabilidad en la interfaz de administración basada en web de ClearPass permite a usuarios autenticados remotos ejecutar comandos arbitrarios en el host subyacente. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-004.txt • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •