Advisories · Technology
Hewlett Packard Enterprise (HPE) ArubaOS (AOS).
Every CVE that names Hewlett Packard Enterprise (HPE) ArubaOS (AOS) among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.8 CriticalCritical · CVSS 9+
Authentication Bypass in the SSH Daemon of AOS-8 leads to Complete System Compromise
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in AOS-10
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Unauthenticated Sensitive Information Disclosure leads to Remote Code Execution in AOS-10
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Information disclosure
- CVSS 9.8 CriticalCritical · CVSS 9+
Unauthenticated SQL Injection allows Remote Code Execution in AOS Web-Based Management Interface
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- SQL injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Memory corruption
- CVSS 10.0 CriticalCritical · CVSS 9+
Authentication Bypass Leading to Remote Code Execution in AOS-8
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Authentication bypass
- CVSS 10.0 CriticalCritical · CVSS 9+
Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- SQL injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- SQL injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-10
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Memory corruption
- CVSS 10.0 CriticalCritical · CVSS 9+
Unauthenticated Command Injection Vulnerabilities in AOS-8
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Command injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Authentication Bypass Leading to Remote Code Execution in AOS-10
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Authentication bypass
- CVSS 7.2 High
Authenticated Command Injection leads to RCE in AOS-10 CLI Command
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Command injection
- CVSS 5.3 Medium
Unauthenticated XML External Entity Injection in AOS-8 Instant allows Denial of Service
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Denial of service
- CVSS 7.2 High
Inconsistent input filtering allows Authenticated Command Injection in AOS-10 CLI
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Command injection
- CVSS 7.2 High
Inconsistent input filtering allows Authenticated Command Injection in AOS-8 Instant and AOS-10 CLI
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Command injection
- CVSS 8.8 High
Error in SSID Processing allows Stored XSS in Web Management Interface
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Out-of-Bounds Read Vulnerabilities Leading to Process Crash in AOS-8 Operating System
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Memory corruption
- CVSS 5.3 Medium
Out-of-Bounds Read Vulnerabilities Leading to Process Crash in AOS-8 Operating System
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Memory corruption
- CVSS 6.5 Medium
Authenticated Arbitrary File Deletion Vulnerability in AOS-10 or AOS-8 Command Line Interface (CLI)
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Information disclosure
- CVSS 6.5 Medium
Authenticated Command Injection Vulnerability in an AOS-8 operating system's internal workflow
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Command injection
- CVSS 7.2 High
Authenticated Arbitrary File Upload Vulnerability in AOS-10 or AOS-8 Web-Based Management Interface
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Unrestricted file upload
- CVSS 7.2 High
Authenticated Arbitrary File Write Vulnerability in AOS 10 and AOS-8 Web-Based Management Interface
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- CWE-277
- CVSS 7.2 High
Improper Input Handling Vulnerability in Authenticated Configuration API Endpoint (AOS-10/AOS-8 Web UI)
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- CWE-20
- CVSS 7.2 High
Authenticated Command Injection Vulnerabilities in AOS-8 Web-Based Management Interface
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Command injection
- CVSS 7.2 High
Authenticated Command Injection Vulnerabilities in AOS-8 Web-Based Management Interface
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Command injection
- CVSS 7.2 High
Authenticated Command Injection Vulnerabilities in AOS-8 Web-Based Management Interface
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Command injection
- CVSS 7.2 High
Stack Overflow Vulnerability in AOS-10 Web-Based Management Interface
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Memory corruption
- CVSS 8.2 High
Unauthenticated Arbitrary File Deletion Vulnerability in AOS-8 Operating System
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Information disclosure
- CVSS 4.9 Medium
Authenticated Arbitrary File Download Vulnerabilities in a Low-Level Interface Library Affecting AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Path traversal
- CVSS 4.9 Medium
Authenticated Arbitrary File Download Vulnerabilities in a Low-Level Interface Library Affecting AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Path traversal
- CVSS 4.9 Medium
Authenticated Arbitrary File Download Vulnerability in CLI Binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor Web Interface (Physical Access Required)
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Broken access control
- CVSS 4.9 Medium
Authenticated Arbitrary File Download Vulnerabilities in CLI Binary of AOS-8 Controller/Mobility Conductor Web-Based Management Interface
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Broken access control
- CVSS 4.9 Medium
Authenticated Arbitrary File Download Vulnerabilities in CLI Binary of AOS-8 Controller/Mobility Conductor Web-Based Management Interface
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Broken access control
- CVSS 4.9 Medium
Authenticated Arbitrary File Download Vulnerabilities in CLI Binary of AOS-8 Controller/Mobility Conductor Web-Based Management Interface
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Broken access control
- CVSS 6.0 Medium
Vulnerability in AOS firmware allows for Authenticated Local malicious actor to Permanently Disable Boot
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Denial of service
- CVSS 6.2 Medium
Authenticated Command Injection Vulnerability in CLI Binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface (Physical Access Required)
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Command injection
- CVSS 6.5 Medium
Authenticated Arbitrary File Deletion Vulnerabilities in AOS-8 Controller/Mobility Conductor Command Line Interface (CLI)
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Broken access control
- CVSS 6.5 Medium
Authenticated Arbitrary File Deletion Vulnerabilities in AOS-8 Controller/Mobility Conductor Command Line Interface (CLI)
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Broken access control
- CVSS 6.5 Medium
Authenticated Arbitrary File Deletion Vulnerabilities in AOS-8 Controller/Mobility Conductor Command Line Interface (CLI)
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Broken access control
- CVSS 7.2 High
Authenticated Command Injection Vulnerability in the Low-Level Interface Library Affecting AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Command injection
- CVSS 7.2 High
Authenticated Command Injection Vulnerability in AOS-8 Controller/Mobility Conductor Web-Based Management Interface via the CLI Binaryalong with accounting controls for tracking and logging user acti…
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Command injection
- CVSS 7.2 High
Authenticated Remote Code Execution Vulnerability in AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface via Arbitrary File Write
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Unrestricted file upload
- CVSS 6.5 Medium
Kernel Panic triggered by Modified Ethernet Frames leads to Denial of Service Vulnerability
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Denial of service
- CVSS 7.1 High
Secure Boot Bypass allows for Compromise of Hardware Root of Trust
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Authentication bypass
- CVSS 7.2 High
Unauthorized Filesystem Operations in System Firmware allow Authenticated Remote Code Execution
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Command injection