Hewlett Packard Enterprise vulnerabilities, page 4
347 vulnerabilities
Known vulnerabilities in Hewlett Packard Enterprise products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 145 products.
CVE-2018-7115hewlett packard enterprisehpe intelligent management center (imc)+1
EPSS score13.36%
HPE Intelligent Management Center (IMC) prior to IMC PLAT 7.3 (E0605P06) is vulnerable to a remote buffer overflow in dbman.exe opcode 10001 on Windows. This problem is resolved in IMC PLAT 7.3 (E0605P06) or subsequent versions.CVE-2018-7111hewlett packard enterprisehpe uiot+1EPSS score5.27%
A remote unauthorized access vulnerability was identified in HPE UIoT versions 1.5, 1.4.0, 1.4.1, 1.4.2, 1.2.4.2. Specifically, there is a malfunction identified in some section of the DSM portal and some DSM APIs. The impact of the malfunction is that the info can be changed by other users.CVE-2018-7063arubanetworksclearpass_policy_manager+1EPSS score0.85%
In Aruba ClearPass, disabled API admins can still perform read/write operations. In certain circumstances, API admins in ClearPass which have been disabled may still be able to perform read/write operations on parts of the XML API. This can lead to unauthorized access to the API and complete compromise of the ClearPass instance if an attacker knows of the existence of these accounts.CVE-2018-7092hewlett packard enterprisehpe intelligent management center platform (imc plat)+1EPSS score24.21%
A potential security vulnerability has been identified in HPE Intelligent Management Center Platform (IMC Plat) 7.3 E0506P09. The vulnerability could be remotely exploited to allow for remote directory traversal leading to arbitrary file deletion.CVE-2018-7060arubanetworksclearpass+1EPSS score0.46%
Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 is vulnerable to CSRF attacks against authenticated users. An attacker could manipulate an authenticated user into performing actions on the web administrative interface.CVE-2018-7067arubanetworksclearpass_policy_manager+1EPSS score1.34%
A Remote Authentication bypass in Aruba ClearPass Policy Manager leads to complete cluster compromise. An authentication flaw in all versions of ClearPass could allow an attacker to compromise the entire cluster through a specially crafted API call. Network access to the administrative web interface is required to exploit this vulnerability. Resolution: Fixed in 6.7.6 and 6.6.10-hotfix.CVE-2018-7090hewlett packard enterprisehpe xp p9000 command view advanced edition software (cvae) versions 7.0.0-00 to earlier than 8.60-00+1EPSS score0.92%
HPE XP P9000 Command View Advanced Edition Software (CVAE) has local and remote cross site scripting vulnerability in versions 7.0.0-00 to earlier than 8.60-00 of DevMgr, TSMgr and RepMgr.CVE-2018-7080arubanetworks203r_firmware+5EPSS score0.64%
A vulnerability exists in the firmware of embedded BLE radios that are part of some Aruba Access points. An attacker who is able to exploit the vulnerability could install new, potentially malicious firmware into the AP's BLE radio and could then gain access to the AP's console port. This vulnerability is applicable only if the BLE radio has been enabled in affected access points. The BLE radio is disabled by default. Note - Aruba products are NOT affected by a similar vulnerability being tracked as CVE-2018-16986.CVE-2018-7091hewlett packard enterprisehpe xp p9000 command view advanced edition software (cvae)+1EPSS score0.92%
HPE XP P9000 Command View Advanced Edition Software (CVAE) has open URL redirection vulnerability in versions 7.0.0-00 to earlier than 8.60-00 of DevMgr, TSMgr and RepMgr.CVE-2018-7093hewlett packard enterpriseilo 5 for hpe gen10 servers, ilo 4, ilo 3, moonshot chassis management firmware, moonshot component packs for hpe proliant m510 and m710x server cartridges+5EPSS score3.08%
A security vulnerability in HPE Integrated Lights-Out 3 prior to v1.90, iLO 4 prior to v2.60, iLO 5 prior to v1.30, Moonshot Chassis Manager firmware prior to v1.58, and Moonshot Component Pack prior to v2.55 could be remotely exploited to create a denial of service.CVE-2018-7068hewlett packard enterprisehpe centralview fraud risk management+1EPSS score0.97%
HPE has identified a remote HOST header attack vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. This issue is resolved in HF16 for HPE CV 6.1 or subsequent version.CVE-2018-7113hewlett packard enterprisehpe integrated lights-out 5 (ilo 5) for hpe gen10 servers+1EPSS score0.74%
A security vulnerability in HPE Integrated Lights-Out 5 (iLO 5) prior to v1.37 could be locally exploited to bypass the security restrictions for firmware updates.CVE-2018-7070hewlett packard enterprisehpe centralview fraud risk management+1EPSS score1.89%
HPE has identified a remote disclosure of information vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. This issue is resolved in HF16 for HPE CV 6.1 or subsequent version.CVE-2018-7071hewlett packard enterprisehpe network function virtualization director (nfvd)+1EPSS score0.81%
HPE has identified a remote access to sensitive information vulnerability in HPE Network Function Virtualization Director (NFVD) 4.2.1 prior to gui patch 3.CVE-2018-7072hewlett packard enterprisehpe moonshot provisioning manager+1EPSS score3.11%
A remote bypass of security restrictions vulnerability was identified in HPE Moonshot Provisioning Manager prior to v1.24.CVE-2018-7112hewlett packard enterprisewindows firmware installer for gen9, gen8, g7,and g6 hpe servers+91EPSS score0.67%
The HPE-provided Windows firmware installer for certain Gen9, Gen8, G7,and G6 HPE servers allows local disclosure of privileged information. This issue was resolved in previously provided firmware updates as follows. The HPE Windows firmware installer was updated in the system ROM updates which also addressed the original Spectre/Meltdown set of vulnerabilities. At that time, the Windows firmware installer was also updated in the versions of HPE Integrated Lights-Out 2, 3, and 4 (iLO 2, 3, and 4) listed in the security bulletin. The updated HPE Windows firmware installer was released in the system ROM and HPE Integrated Lights-Out (iLO) releases documented in earlier HPE Security Bulletins: HPESBHF03805, HPESBHF03835, HPESBHF03831. Windows-based systems that have already been updated to the system ROM or iLO versions described in these security bulletins require no further action.CVE-2018-7105hewlett packard enterprisehpe integrated lights-out 5 (ilo 5) for hpe gen10 servers, hpe integrated lights-out 4 (ilo 4), hpe integrated lights-out 3 (ilo 3)+3EPSS score4.11%
A security vulnerability in HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers prior to v1.35, HPE Integrated Lights-Out 4 (iLO 4) prior to v2.61, HPE Integrated Lights-Out 3 (iLO 3) prior to v1.90 could be remotely exploited to execute arbitrary code leading to disclosure of information.CVE-2018-7098hewlett packard enterprisehpe 3par service processors+1EPSS score0.70%
A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). The vulnerability may be locally exploited to allow directory traversal.CVE-2018-7058hewlett packard enterprisearuba clearpass+1EPSS score3.89%
Aruba ClearPass, all versions of 6.6.x prior to 6.6.9 are affected by an authentication bypass vulnerability, an attacker can leverage this vulnerability to gain administrator privileges on the system. The vulnerability is exposed only on ClearPass web interfaces, including administrative, guest captive portal, and API. Customers who do not expose ClearPass web interfaces to untrusted users are impacted to a lesser extent.CVE-2018-7078hewlett packard enterprisehpe integrated lights-out 4 (ilo 4), hpe integrated lights-out 5 (ilo 5)+2EPSS score7.03%
A remote code execution was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than version v2.60 and HPE Integrated Lights-Out 5 (iLO 5) earlier than version v1.30.