CVSS: 6.5EPSS: 0%CPEs: 9EXPL: 0CVE-2023-43510 – Authenticated Remote Command Injection in ClearPass Policy Manager Web-Based Management Interface Leading to Partial System Compromise
https://notcve.org/view.php?id=CVE-2023-43510
24 Oct 2023 — A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as a non-privileged user on the underlying operating system leading to partial system compromise. Una vulnerabilidad en la interfaz de administración basada en web de ClearPass Policy Manager permite a usuarios remotos autenticados ejecutar comandos arbitrarios en el host s... • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-016.txt • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 5.8EPSS: 0%CPEs: 9EXPL: 0CVE-2023-43509 – Unauthenticated Endpoint Allows Sending Arbitrary OnGuard Notifications
https://notcve.org/view.php?id=CVE-2023-43509
24 Oct 2023 — A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to send notifications to computers that are running ClearPass OnGuard. These notifications can then be used to phish users or trick them into downloading malicious software. Una vulnerabilidad en la interfaz de administración basada en web de ClearPass Policy Manager podría permitir que un atacante remoto no autenticado envíe notificaciones a ordenadores que ejecutan ClearPass OnG... • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-016.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 9EXPL: 0CVE-2023-43508 – Authorization Bypass Leading to Privilege Escalation in ClearPass Policy Manager Web-Based Management Interface
https://notcve.org/view.php?id=CVE-2023-43508
24 Oct 2023 — Vulnerabilities in the web-based management interface of ClearPass Policy Manager allow an attacker with read-only privileges to perform actions that change the state of the ClearPass Policy Manager instance. Successful exploitation of these vulnerabilities allow an attacker to complete state-changing actions in the web-based management interface that should not be allowed by their current level of authorization on the platform. Las vulnerabilidades en la interfaz de administración basada en web de ClearPas... • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-016.txt • CWE-863: Incorrect Authorization •
CVSS: 9.0EPSS: 0%CPEs: 9EXPL: 0CVE-2023-43507 – Authenticated SQL Injection Vulnerability in ClearPass Policy Manager Web-based Management Interface
https://notcve.org/view.php?id=CVE-2023-43507
24 Oct 2023 — A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit this vulnerability to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the ClearPass Policy Manager cluster. Una vulnerabilidad en la interfaz de administración basada en web de ClearPass Policy Manager podría permi... • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-016.txt • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.8EPSS: 0%CPEs: 10EXPL: 0CVE-2023-43506 – Local Privilege Escalation in ClearPass OnGuard Linux Agent
https://notcve.org/view.php?id=CVE-2023-43506
24 Oct 2023 — A vulnerability in the ClearPass OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges to those of a higher role. A successful exploit allows malicious users to execute arbitrary code with root level privileges on the Linux instance. Una vulnerabilidad en el agente de Linux ClearPass OnGuard podría permitir a usuarios malintencionados elevar sus privilegios de usuario a aquellos de una función superior. Un exploit exitoso permite a usuarios malintencionados eje... • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-016.txt • CWE-269: Improper Privilege Management •
CVSS: 5.4EPSS: 0%CPEs: 7EXPL: 0CVE-2022-23674
https://notcve.org/view.php?id=CVE-2022-23674
17 May 2022 — A remote authenticated stored cross-site scripting (xss) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability. Se ha detectado una vulnerabilidad de tipo cross-site scripting (xss) almacenado y autenticado de forma remota en Aruba ClearPass Policy Manager versiones 6.10.4 y anteriores, 6.9.9 y anteriores, 6.8.9-HF2 y an... • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 7EXPL: 0CVE-2022-23675
https://notcve.org/view.php?id=CVE-2022-23675
17 May 2022 — A remote authenticated stored cross-site scripting (xss) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability. Se ha detectado una vulnerabilidad de cross-site scripting (xss) almacenada y autenticada de forma remota en Aruba ClearPass Policy Manager versiones 6.10.4 y siguientes, 6.9.9 y siguientes, 6.8.9-HF2 y siguien... • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 7EXPL: 0CVE-2022-23673
https://notcve.org/view.php?id=CVE-2022-23673
17 May 2022 — A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability. Se ha detectado una vulnerabilidad de inyección de comandos remotos autenticados en Aruba ClearPass Policy Manager versiones 6.10.4 y anteriores, 6.9.9 y anteriores, 6.8.9-HF2 y anteriores, 6.7.x y anteriores. Aruba ha publica... • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2022-23671
https://notcve.org/view.php?id=CVE-2022-23671
17 May 2022 — A remote authenticated information disclosure vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability. Se ha detectado una vulnerabilidad de divulgación de información autenticada remota en Aruba ClearPass Policy Manager versiones 6.10.4 y anteriores, 6.9.9 y anteriores, 6.8.9-HF2 y anteriores, 6.7.x y anteriores. Aruba ha... • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt •
CVSS: 9.0EPSS: 0%CPEs: 7EXPL: 0CVE-2022-23672
https://notcve.org/view.php?id=CVE-2022-23672
17 May 2022 — A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability. Se ha detectado una vulnerabilidad de inyección de comandos remotos autenticados en Aruba ClearPass Policy Manager versiones 6.10.4 y anteriores, 6.9.9 y anteriores, 6.8.9-HF2 y anteriores, 6.7.x y anteriores. Aruba ha publica... • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •