Advisories · Technology
SoftIron HyperCloud.
Every CVE that names SoftIron HyperCloud among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.4 High
SoftIron HyperCloud: OS Command Injection in Orchestrator via Virtual Machine Template Fields
- SoftIron HyperCloud
- Command injection
- CVSS 6.2 Medium
HyperCloud Improper Refresh Token Validation and Access Token Invalidation Allows Long-Term Unauthorized Access
- SoftIron HyperCloud
- Authentication bypass
- CVSS 1.8 Low
Improper SSH Key Handling in Internal Debug Builds May Grant Cluster-Level Access to Non-Administrative Users
- SoftIron HyperCloud
- Privilege escalation
- CVSS 4.8 Medium
Authenticated, non-admin users can create storage pools via the sifi API
- SoftIron HyperCloud
- Privilege escalation
- Broken access control
- CVSS 3.2 Low
When compute hosts are disabled and reenabled, they immediately transition to "ON", not "INIT"
- SoftIron HyperCloud
- CWE-1419
- CVSS 7.0 High
Media caddy removal and reinsertion without reboot may cause data loss
- SoftIron HyperCloud
- CWE-820
- CVSS 4.2 Medium
HyperCloud: "admin" and "serveradmin" users can be deleted
- SoftIron HyperCloud
- Privilege escalation