CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2021-26682
https://notcve.org/view.php?id=CVE-2021-26682
23 Feb 2021 — A remote reflected cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the guest portal interface of ClearPass could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the portal. A successful exploit could allow an attacker to execute arbitrary script code in a victim’s browser in the context of the guest portal interface. Se detectó una vulnerabilidad ... • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-004.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 3%CPEs: 3EXPL: 0CVE-2021-26681
https://notcve.org/view.php?id=CVE-2021-26681
23 Feb 2021 — A remote authenticated command Injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the ClearPass CLI could allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise. Se detectó una vulnerabilidad de inyección de comando autenticada remota e... • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-004.txt • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 3%CPEs: 3EXPL: 0CVE-2021-26683
https://notcve.org/view.php?id=CVE-2021-26683
23 Feb 2021 — A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the ClearPass web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise. Se detectó una vulnerabilidad de inyección de comand... • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-004.txt • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-26686
https://notcve.org/view.php?id=CVE-2021-26686
23 Feb 2021 — A remote authenticated SQL Injection vulnerabilitiy was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the web-based management interface API of ClearPass could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass instance. An attacker could exploit this vulnerability to obtain and modify sensitive information in the underlying database. Se detectó una vulnerabilidad de inyección SQL autenticada remo... • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-004.txt • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-26685
https://notcve.org/view.php?id=CVE-2021-26685
23 Feb 2021 — A remote authenticated SQL Injection vulnerabilitiy was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the web-based management interface API of ClearPass could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass instance. An attacker could exploit this vulnerability to obtain and modify sensitive information in the underlying database. Se detectó una vulnerabilidad de inyección SQL autenticada remo... • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-004.txt • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.0EPSS: 2%CPEs: 3EXPL: 0CVE-2020-7116
https://notcve.org/view.php?id=CVE-2020-7116
03 Jun 2020 — The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote execution. When the attacker is already authenticated to the administrative interface, they could then exploit the system, leading to remote command execution in the underlying operating system. Resolution: Fixed in 6.7.13-HF, 6.8.5-HF, 6.8.6, 6.9.1 and higher. La interfaz administrativa de ClearPass Policy Manager WebUI, presenta una ejecución de comando remota autenticado. Cuando el atacante ya está autenticado... • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-005.txt •
CVSS: 9.0EPSS: 2%CPEs: 3EXPL: 0CVE-2020-7117
https://notcve.org/view.php?id=CVE-2020-7117
03 Jun 2020 — The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote execution. When the attacker is already authenticated to the administrative interface, they could then exploit the system, leading to remote command execution in the underlying operating system. Resolution: Fixed in 6.7.13-HF, 6.8.5-HF, 6.8.6, 6.9.1 and higher. La interfaz administrativa de ClearPass Policy Manager WebUI, presenta una ejecución de comando remota autenticada. Cuando el atacante ya está autenticado... • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-005.txt •
CVSS: 10.0EPSS: 61%CPEs: 3EXPL: 4CVE-2020-7115 – Aruba ClearPass Policy Manager 6.7.0 - Unauthenticated Remote Command Execution
https://notcve.org/view.php?id=CVE-2020-7115
03 Jun 2020 — The ClearPass Policy Manager web interface is affected by a vulnerability that leads to authentication bypass. Upon successful bypass an attacker could then execute an exploit that would allow to remote command execution in the underlying operating system. Resolution: Fixed in 6.7.13-HF, 6.8.5-HF, 6.8.6, 6.9.1 and higher. La interfaz web de ClearPass Policy Manager está afectada por una vulnerabilidad que conlleva a una omisión de autenticación. Luego de una omisión con éxito, un atacante podría ejecutar un... • https://packetstorm.news/files/id/158368 • CWE-306: Missing Authentication for Critical Function •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2018-7063
https://notcve.org/view.php?id=CVE-2018-7063
07 Dec 2018 — In Aruba ClearPass, disabled API admins can still perform read/write operations. In certain circumstances, API admins in ClearPass which have been disabled may still be able to perform read/write operations on parts of the XML API. This can lead to unauthorized access to the API and complete compromise of the ClearPass instance if an attacker knows of the existence of these accounts. En Aruba ClearPass, los administradores de la API deshabilitados pueden seguir realizando operaciones de lectura/escritura. E... • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-007.txt • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 9.3EPSS: 1%CPEs: 2EXPL: 0CVE-2018-7066
https://notcve.org/view.php?id=CVE-2018-7066
07 Dec 2018 — An unauthenticated remote command execution exists in Aruba ClearPass Policy Manager on linked devices. The ClearPass OnConnect feature permits administrators to link other network devices into ClearPass for the purpose of collecting enhanced information about connected endpoints. A defect in the API could allow a remote attacker to execute arbitrary commands on one of the linked devices. This vulnerability is only applicable if credentials for devices have been supplied to ClearPass under Configuration -> ... • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-007.txt •