CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-26686
https://notcve.org/view.php?id=CVE-2021-26686
A remote authenticated SQL Injection vulnerabilitiy was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the web-based management interface API of ClearPass could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass instance. An attacker could exploit this vulnerability to obtain and modify sensitive information in the underlying database. Se detectó una vulnerabilidad de inyección SQL autenticada remota en Aruba ClearPass Policy Manager: versiones anteriores a 6.9.5, 6.8.8-HF1, 6.7.14-HF1. Una vulnerabilidad en la API de la interfaz de administración basada en web de ClearPass podría permitir a un atacante remoto autenticado conducir ataques de inyección SQL contra la instancia de ClearPass. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-004.txt • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-26685
https://notcve.org/view.php?id=CVE-2021-26685
A remote authenticated SQL Injection vulnerabilitiy was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the web-based management interface API of ClearPass could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass instance. An attacker could exploit this vulnerability to obtain and modify sensitive information in the underlying database. Se detectó una vulnerabilidad de inyección SQL autenticada remota en Aruba ClearPass Policy Manager: versiones anteriores a 6.9.5, 6.8.8-HF1, 6.7.14-HF1. Una vulnerabilidad en la API de la interfaz de administración basada en web de ClearPass podría permitir a un atacante remoto autenticado conducir ataques de inyección SQL contra la instancia de ClearPass. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-004.txt • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.9EPSS: 0%CPEs: 30EXPL: 0CVE-2021-25141
https://notcve.org/view.php?id=CVE-2021-25141
A security vulnerability has been identified in in certain HPE and Aruba L2/L3 switch firmware. A data processing error due to improper handling of an unexpected data type in user supplied information to the switch's management interface has been identified. The data processing error could be exploited to cause a crash or reboot in the switch management interface and/or possibly the switch itself leading to local denial of service (DoS). The user must have administrator privileges to exploit this vulnerability. Se ha identificado una vulnerabilidad de seguridad en determinado firmware del switch HPE y Aruba L2/L3. • https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04082en_us •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2020-24640
https://notcve.org/view.php?id=CVE-2020-24640
There is a vulnerability caused by insufficient input validation that allows for arbitrary command execution in a containerized environment within Airwave Glass before 1.3.3. Successful exploitation can lead to complete compromise of the underlying host operating system. Se presenta una vulnerabilidad causada por una comprobación insuficiente de entrada que permite una ejecución de comandos arbitrarios en un entorno de contenedores dentro de Airwave Glass versiones anteriores a 1.3.3. Una explotación con éxito puede conllevar a un compromiso completo del sistema operativo host subyacente • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-001.txt •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2020-24639
https://notcve.org/view.php?id=CVE-2020-24639
There is a vulnerability caused by unsafe Java deserialization that allows for arbitrary command execution in a containerized environment within Airwave Glass before 1.3.3. Successful exploitation can lead to complete compromise of the underlying host operating system. Se presenta una vulnerabilidad causada por la deserialización no segura de Java que permite una ejecución de comandos arbitrarios en un entorno de contenedores dentro de Airwave Glass versiones anteriores a 1.3.3. Una explotación con éxito puede conllevar a un compromiso completo del sistema operativo host subyacente • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-001.txt • CWE-502: Deserialization of Untrusted Data •