CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2016-4401
https://notcve.org/view.php?id=CVE-2016-4401
Aruba ClearPass Policy Manager before 6.5.7 and 6.6.x before 6.6.2 allows attackers to obtain database credentials. Aruba ClearPass Policy Manager versiones anteriores a 6.5.7 y versiones 6.6.x anteriores a 6.6.2, permite a atacantes obtener credenciales de la base de datos. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2016-010.txt • CWE-522: Insufficiently Protected Credentials •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-7060
https://notcve.org/view.php?id=CVE-2018-7060
Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 is vulnerable to CSRF attacks against authenticated users. An attacker could manipulate an authenticated user into performing actions on the web administrative interface. Aruba ClearPass en versiones 6.6.x anteriores a la 6.6.9 y versiones 6.7.x anteriores a la 6.7.1 es vulnerable a ataques de Cross-Site Request Forgery (CSRF) contra usuarios autenticados. Un atacante podría manipular a un usuario autenticado para qu realice acciones en la interfaz web administrativa. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-003.txt • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2018-0489
https://notcve.org/view.php?id=CVE-2018-0489
Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this issue exists because of an incomplete fix for CVE-2018-0486. Shibboleth XMLTooling-C en versiones anteriores a la 1.6.4, tal y como se emplea en Shibboleth Service Provider en versiones anteriores a la 2.6.1.4 en Windows y otros productos, gestiona de manera incorrecta las firmas digitales de datos de usuario. Esto permite que atacantes remotos obtengan información sensible o lleven a cabo ataques de suplantación mediante datos XML manipulados. NOTA: este problema existe debido a una solución incompleta para CVE-2018-0486. • http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-003.txt http://www.securityfocus.com/bid/103172 http://www.securitytracker.com/id/1040435 https://lists.debian.org/debian-lts-announce/2018/02/msg00031.html https://shibboleth.net/community/advisories/secadv_20180227.txt https://www.debian.org/security/2018/dsa-4126 • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 9.8EPSS: 0%CPEs: 8EXPL: 0CVE-2016-2034
https://notcve.org/view.php?id=CVE-2016-2034
SQL injection vulnerability in ClearPass Policy Manager 6.5.x through 6.5.6 and 6.6.0. Vulnerabilidad de inyección SQL en ClearPass Policy Manager versiones 6.5.x hasta 6.5.6 y versión 6.6.0. • http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2016-009.txt • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •