Hewlett Packard Enterprise (Hpe) vulnerabilities

594 vulnerabilities

Known vulnerabilities in Hewlett Packard Enterprise (Hpe) products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 86 products.

Products

50 of 86
6.4CVE-2021-46846hewlett packard enterprise (hpe)hpe integrated lights-out 5+1
EPSS score
0.52%
Cross Site Scripting vulnerability in Hewlett Packard Enterprise Integrated Lights-Out 5.8.8CVE-2025-25039arubanetworksclearpass_policy_manager+1
EPSS score
0.65%
A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager (CPPM) allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as a lower privileged user on the underlying operating system.3.3CVE-2025-25040hewlett packard enterprise (hpe)aos-cx+1
EPSS score
0.14%
A vulnerability has been identified in the port ACL functionality of AOS-CX software running on the HPE Aruba Networking CX 9300 Switch Series only and affects: - AOS-CX 10.14.xxxx : All patches - AOS-CX 10.15.xxxx : 10.15.1000 and below The vulnerability is specific to traffic originated by the CX 9300 switch platform and could allow an attacker to bypass ACL rules applied to routed ports on egress. As a result, port ACLs are not correctly enforced, which could lead to unauthorized traffic flow and violations of security policies. Egress VLAN ACLs and Routed VLAN ACLs are not affected by this vulnerability.4.3CVE-2025-25042hewlett packard enterprise (hpe)aos-cx
EPSS score
0.35%
A vulnerability in the AOS-CX REST interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation could allow an attacker to read encrypted credentials of other users on the switch, potentially leading to further unauthorized access or data breaches.5.5CVE-2025-25041hewlett packard enterprise (hpe)virtual intranet access (via)
EPSS score
0.14%
A vulnerability in the HPE Aruba Networking Virtual Intranet Access (VIA) client could allow malicious users to overwrite arbitrary files as NT AUTHORITY\SYSTEM (root). A successful exploit could allow the creation of a Denial-of-Service (DoS) condition affecting the Microsoft Windows Operating System. This vulnerability does not affect Linux and Android based clients.9.8CVE-2025-37093hewlett packard enterprise (hpe)hpe storeonce software+1
EPSS score
1.10%
An authentication bypass vulnerability exists in HPE StoreOnce Software.6CVE-2025-37149hewlett packard enterprise (hpe)proliant rl300 gen11 server
EPSS score
0.14%
A potential out-of-bound reads vulnerability in HPE ProLiant RL300 Gen11 Server's UEFI firmware.7.5CVE-2025-37178arubanetworksarubaos+1
EPSS score
0.39%
Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers. Due to insufficient validation of maximum buffer size values, the process may attempt to read beyond the intended memory region. Under specific conditions, this can result in a crash of the affected process and a potential denial-of-service of the compromised process.9.8CVE-2025-37184arubanetworksedgeconnect_sd-wan_orchestrator+1
EPSS score
0.65%
A vulnerability exists in an Orchestrator service that could allow an unauthenticated remote attacker to bypass multi-factor authentication requirements. Successful exploitation could allow an attacker to create an admin user account without the necessary multi-factor authentication, thereby compromising the integrity of secured access to the system.4.9CVE-2025-37142arubanetworksarubaos+1
EPSS score
0.35%
Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.7.2CVE-2025-37175arubanetworksarubaos+1
EPSS score
0.51%
Arbitrary file upload vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation could allow an authenticated malicious actor to upload arbitrary files as a privilege user and execute arbitrary commands on the underlying operating system.9.8CVE-2025-37095hewlett packard enterprise (hpe)hpe storeonce software+1
EPSS score
1.18%
A directory traversal information disclosure vulnerability exists in HPE StoreOnce Software.6.7CVE-2025-37129hewlett packard enterprise (hpe)hpe aruba networking edgeconnect sd-wan gateway
EPSS score
0.22%
A vulnerable feature in the command line interface of EdgeConnect SD-WAN could allow an authenticated attacker to exploit built-in script execution capabilities. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system if the feature is enabled without proper security measures.8.6CVE-2025-37124hewlett packard enterprise (hpe)hpe aruba networking edgeconnect sd-wan gateway
EPSS score
0.40%
A vulnerability in the HPE Aruba Networking SD-WAN Gateways could allow an unauthenticated remote attacker to bypass firewall protections. Successful exploitation could allow an attacker to route potentially harmful traffic through the internal network, leading to unauthorized access or disruption of services.7.5CVE-2025-37166hewlett packard enterprise (hpe)instant on
EPSS score
0.47%
A vulnerability affecting HPE Networking Instant On Access Points has been identified where a device processing a specially crafted packet could enter a non-responsive state, in some cases requiring a hard reset to re-establish services. A malicious actor could leverage this vulnerability to conduct a Denial-of-Service attack on a target network.7.5CVE-2025-37165hewlett packard enterprise (hpe)instant on
EPSS score
0.41%
A vulnerability in the router mode configuration of HPE Instant On Access Points exposed certain network configuration details to unintended interfaces. A malicious actor could gain knowledge of internal network configuration details through inspecting impacted packets.7.2CVE-2025-37126hewlett packard enterprise (hpe)hpe aruba networking edgeconnect sd-wan gateway
EPSS score
0.64%
A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN Gateways Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system.9.8CVE-2025-37090hewlett packard enterprise (hpe)hpe storeonce software+1
EPSS score
0.62%
A server-side request forgery vulnerability exists in HPE StoreOnce Software.9.8CVE-2025-37091hewlett packard enterprise (hpe)hpe storeonce software+1
EPSS score
1.19%
A command injection remote code execution vulnerability exists in HPE StoreOnce Software.6.5CVE-2025-37177arubanetworksarubaos+1
EPSS score
0.37%
An arbitrary file deletion vulnerability has been identified in the command-line interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation of this vulnerability could allow an authenticated remote malicious actor to delete arbitrary files within the affected system.