Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
56 results · page 1 of 2
Nov 18, 2025A command injection vulnerability has been identified in the command line interface of the HPE Aruba Networking Airwave Platform.CVE-2025-37163 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
A command injection vulnerability has been identified in the command line interface of the HPE Aruba Networking Airwave Platform. An authenticated attacker could exploit this vulnerability to execute arbitrary operating system commands with elevated privileges on the underlying operating system.
- Product
- HPE Aruba Networking Management Software (Airwave)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024An authenticated Remote Code Execution (RCE) vulnerability exists in the AirWave CLI.CVE-2024-54008 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
An authenticated Remote Code Execution (RCE) vulnerability exists in the AirWave CLI. Successful exploitation of this vulnerability could allow a remote authenticated threat actor to run arbitrary commands as a privileged user on the underlying host.
- Product
- HPE Aruba Networking AirWave Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023There are arbitrary file deletion vulnerabilities in the AirWave client service accessed by PAPI (Aruba's access point management protocol).CVE-2023-45618 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 8.2
There are arbitrary file deletion vulnerabilities in the AirWave client service accessed by PAPI (Aruba's access point management protocol). Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the access point.
- Product
- Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Ser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Nov 14, 2023There is a buffer overflow vulnerability in the underlying AirWave client service that could lead to unauthenticated remote code execution by sending specially CVE-2023-45616 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
There is a buffer overflow vulnerability in the underlying AirWave client service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Ser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Oct 17, 2023A vulnerability exists which allows an authenticated attacker to access sensitive information on the AirWave Management Platform web-based management interface.CVE-2023-4896 · Other software · HewarHewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.8
A vulnerability exists which allows an authenticated attacker to access sensitive information on the AirWave Management Platform web-based management interface. Successful exploitation allows the attacker to gain access to some data that could be further exploited to laterally access devices managed and monitored by the AirWave server.
- Product
- Aruba AirWave Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Sep 5, 2023Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows administrative users to escalate privileges to root on the underlying OS.CVE-2015-2202 · Other software · Arubanetworks · reported by MITREHigh 7.2
Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows administrative users to escalate privileges to root on the underlying OS.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Sep 5, 2023Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows VisualRF remote OS command execution and file disclosure by administrative users.CVE-2015-2201 · Other software · Arubanetworks · reported by MITREHigh 7.2
Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows VisualRF remote OS command execution and file disclosure by administrative users.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Sep 5, 2023Aruba AirWave before 8.0.7 allows bypass of a CSRF protection mechanism.CVE-2015-1391 · Other software · HP · reported by MITREHigh 8.8
Aruba AirWave before 8.0.7 allows bypass of a CSRF protection mechanism.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Sep 5, 2023Aruba AirWave before 8.0.7 allows XSS attacks agsinat an administrator.CVE-2015-1390 · Other software · HP · reported by MITREMedium 6.1
Aruba AirWave before 8.0.7 allows XSS attacks agsinat an administrator.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Dec 8, 2022Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls.CVE-2022-37918 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 8.1
Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access to sensitive information and/or change network configurations with privileges at a higher effective level in Aruba AirWave Management Platform version(s): 8.2.15.0 and below.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Dec 8, 2022Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls.CVE-2022-37917 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 8.1
Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access to sensitive information and/or change network configurations with privileges at a higher effective level in Aruba AirWave Management Platform version(s): 8.2.15.0 and below.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Dec 8, 2022Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls.CVE-2022-37916 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 8.1
Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access to sensitive information and/or change network configurations with privileges at a higher effective level in Aruba AirWave Management Platform version(s): 8.2.15.0 and below.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Aug 26, 2021A remote cross-site scripting (XSS) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.13.0.CVE-2021-37715 · Other software · Arubanetworks · reported by security-alert@hpe.comMedium 4.8
A remote cross-site scripting (XSS) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.13.0. Aruba has released upgrades for the Aruba AirWave Management Platform that address this security vulnerability.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Apr 29, 2021A remote URL redirection vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1.CVE-2021-29137 · Other software · Arubanetworks · reported by security-alert@hpe.comMedium 6.1
A remote URL redirection vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave Management Platform that address this security vulnerability.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Apr 29, 2021A remote unauthorized access vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1.CVE-2021-25167 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 8.8
A remote unauthorized access vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave Management Platform that address this security vulnerability.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Apr 29, 2021A remote unauthorized access vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1.CVE-2021-25166 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 8.8
A remote unauthorized access vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave Management Platform that address this security vulnerability.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Apr 29, 2021A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1.CVE-2021-25163 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 8.1
A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave Management Platform that address this security vulnerability.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Apr 28, 2021A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1.CVE-2021-25165 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 8.1
A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave Management Platform that address this security vulnerability.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Apr 28, 2021A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1.CVE-2021-25164 · Other software · Arubanetworks · reported by security-alert@hpe.comMedium 6.5
A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave Management Platform that address this security vulnerability.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Apr 28, 2021A remote insecure deserialization vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1.CVE-2021-25152 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 7.2
A remote insecure deserialization vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave Management Platform that address this security vulnerability.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Apr 28, 2021A remote escalation of privilege vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1.CVE-2021-25154 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 7.5
A remote escalation of privilege vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave Management Platform that address this security vulnerability.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Apr 28, 2021A remote SQL injection vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1.CVE-2021-25153 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 8.1
A remote SQL injection vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave Management Platform that address this security vulnerability.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Apr 28, 2021A remote insecure deserialization vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1.CVE-2021-25151 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 8.8
A remote insecure deserialization vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave Management Platform that address this security vulnerability.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Apr 28, 2021A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1.CVE-2021-25147 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 8.1
A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave Management Platform that address this security vulnerability.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Mar 5, 2021A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0.CVE-2021-26971 · Other software · Arubanetworks · reported by security-alert@hpe.comMedium 6.3
A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Vulnerabilities in the AirWave web-base management interface could allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as a lower privileged user on the underlying operating system leading to partial system compromise.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Mar 5, 2021A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0.CVE-2021-26970 · Other software · Arubanetworks · reported by security-alert@hpe.comMedium 6.3
A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Vulnerabilities in the AirWave web-base management interface could allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as a lower privileged user on the underlying operating system leading to partial system compromise.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Mar 5, 2021A remote authenticated authenticated xml external entity (xxe) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0.CVE-2021-26969 · Other software · Arubanetworks · reported by security-alert@hpe.comMedium 6.5
A remote authenticated authenticated xml external entity (xxe) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Due to improper restrictions on XML entities a vulnerability exists in the web-based management interface of AirWave. A successful exploit could allow an authenticated attacker to retrieve files from the local system or cause the application to consume system resources, resulting in a denial of service condition.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Mar 5, 2021A remote authenticated stored cross-site scripting (xss) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0.CVE-2021-26968 · Other software · Arubanetworks · reported by security-alert@hpe.comMedium 4.8
A remote authenticated stored cross-site scripting (xss) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the web-based management interface of AirWave could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim’s browser in the context of the affected interface.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Mar 5, 2021A remote reflected cross-site scripting (xss) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0.CVE-2021-26967 · Other software · Arubanetworks · reported by security-alert@hpe.comMedium 6.1
A remote reflected cross-site scripting (xss) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the web-based management interface of AirWave could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of certain components of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim’s browser in the context of the AirWave management interface.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Mar 5, 2021A remote authenticated sql injection vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0.CVE-2021-26966 · Other software · Arubanetworks · reported by security-alert@hpe.comMedium 6.5
A remote authenticated sql injection vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Multiple vulnerabilities in the API of AirWave could allow an authenticated remote attacker to conduct SQL injection attacks against the AirWave instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Mar 5, 2021A remote authenticated sql injection vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0.CVE-2021-26965 · Other software · Arubanetworks · reported by security-alert@hpe.comMedium 6.5
A remote authenticated sql injection vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Multiple vulnerabilities in the API of AirWave could allow an authenticated remote attacker to conduct SQL injection attacks against the AirWave instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Mar 5, 2021A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0.CVE-2021-26964 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 7.1
A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the AirWave web-based management interface could allow an authenticated remote attacker to improperly access and modify devices and management user details. A successful exploit would consist of an attacker using a lower privileged account to change management user or device details. This could allow the attacker to escalate privileges and/or change network details that they should not have access to.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Mar 5, 2021A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0.CVE-2021-26963 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 7.2
A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Vulnerabilities in the AirWave CLI could allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to full system compromise.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Mar 5, 2021A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0.CVE-2021-26962 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 7.2
A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Vulnerabilities in the AirWave CLI could allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to full system compromise.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Mar 5, 2021A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0.CVE-2021-26961 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 8.8
A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the AirWave web-based management interface could allow an unauthenticated remote attacker to conduct a CSRF attack against a vulnerable system. A successful exploit would consist of an attacker persuading an authorized user to follow a malicious link, resulting in arbitrary actions being carried out with the privilege level of the targeted user.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Mar 5, 2021A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0.CVE-2021-26960 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 8.8
A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the AirWave web-based management interface could allow an unauthenticated remote attacker to conduct a CSRF attack against a vulnerable system. A successful exploit would consist of an attacker persuading an authorized user to follow a malicious link, resulting in arbitrary actions being carried out with the privilege level of the targeted user.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Jan 15, 2021In Aruba AirWave Glass before 1.3.3, there is a Server-Side Request Forgery vulnerability through an unauthenticated endpoint that if successfully exploited canCVE-2020-24641 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 7.5
In Aruba AirWave Glass before 1.3.3, there is a Server-Side Request Forgery vulnerability through an unauthenticated endpoint that if successfully exploited can result in disclosure of sensitive information. This can be used to perform an authentication bypass and ultimately gain administrative access on the web administrative interface.
- Product
- Airwave Glass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Jan 15, 2021There is a vulnerability caused by insufficient input validation that allows for arbitrary command execution in a containerized environment within Airwave GlassCVE-2020-24640 · Other software · Arubanetworks · reported by security-alert@hpe.comCritical 9.8
There is a vulnerability caused by insufficient input validation that allows for arbitrary command execution in a containerized environment within Airwave Glass before 1.3.3. Successful exploitation can lead to complete compromise of the underlying host operating system.
- Product
- Airwave Glass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Jan 15, 2021There is a vulnerability caused by unsafe Java deserialization that allows for arbitrary command execution in a containerized environment within Airwave Glass bCVE-2020-24639 · Other software · Arubanetworks · reported by security-alert@hpe.comCritical 9.8
There is a vulnerability caused by unsafe Java deserialization that allows for arbitrary command execution in a containerized environment within Airwave Glass before 1.3.3. Successful exploitation can lead to complete compromise of the underlying host operating system.
- Product
- Airwave Glass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Jan 15, 2021Multiple authenticated remote command executions are possible in Airwave Glass before 1.3.3 via the glassadmin cli.CVE-2020-24638 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 7.2
Multiple authenticated remote command executions are possible in Airwave Glass before 1.3.3 via the glassadmin cli. These allow for a user with glassadmin privileges to execute arbitrary code as root on the underlying host operating system.
- Product
- Airwave Glass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Nov 4, 2020A remote execution of arbitrary commands vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.CVE-2020-7129 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 7.2
A remote execution of arbitrary commands vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.
- Product
- Airwave Glass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Nov 4, 2020A remote unauthenticated arbitrary code execution vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.CVE-2020-7128 · Other software · Arubanetworks · reported by security-alert@hpe.comCritical 9.8
A remote unauthenticated arbitrary code execution vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.
- Product
- Airwave Glass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Oct 26, 2020A remote unauthenticated arbitrary code execution vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.CVE-2020-7127 · Other software · Arubanetworks · reported by security-alert@hpe.comCritical 9.8
A remote unauthenticated arbitrary code execution vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.
- Product
- Airwave Glass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Oct 26, 2020A remote server-side request forgery (ssrf) vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.CVE-2020-7126 · Other software · Arubanetworks · reported by security-alert@hpe.comMedium 5.8
A remote server-side request forgery (ssrf) vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.
- Product
- Airwave Glass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Oct 26, 2020A remote escalation of privilege vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.CVE-2020-7125 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 8.8
A remote escalation of privilege vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.
- Product
- Airwave Glass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Oct 26, 2020A remote unauthorized access vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.CVE-2020-7124 · Other software · Arubanetworks · reported by security-alert@hpe.comCritical 9.8
A remote unauthorized access vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.
- Product
- Airwave Glass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Oct 26, 2020A remote execution of arbitrary commandss vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.CVE-2020-24632 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 7.2
A remote execution of arbitrary commandss vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.
- Product
- Airwave Glass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Oct 26, 2020A remote execution of arbitrary commands vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.CVE-2020-24631 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 7.2
A remote execution of arbitrary commands vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.
- Product
- Airwave Glass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Feb 27, 2020An administrative application user of or application user with write access to Aruba Airwave VisualRF is able to obtain code execution on the AMP platform.CVE-2019-5326 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 7.2
An administrative application user of or application user with write access to Aruba Airwave VisualRF is able to obtain code execution on the AMP platform. This is possible due to the ability to overwrite a file on disk which is subsequently deserialized by the Java application component.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Feb 27, 2020There are command injection vulnerabilities present in the AirWave application.CVE-2019-5323 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 7.2
There are command injection vulnerabilities present in the AirWave application. Certain input fields controlled by an administrative user are not properly sanitized before being parsed by AirWave. If conditions are met, an attacker can obtain command execution on the host.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.