Hpe vulnerabilities, page 5
279 vulnerabilities
Known vulnerabilities in Hpe products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 198 products.
CVE-2025-37097hewlett packard enterpriseinsight remote support+1
EPSS score0.54%
A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of serviceCVE-2025-37157hewlett packard enterprise (hpe)hpe aruba networkign aos-cx+1EPSS score0.64%
A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remote Code Execution (RCE) on the affected system.CVE-2025-37164hewlett packard enterprise (hpe)hpe oneview+1KEVEPSS score90.19%
A remote code execution issue exists in HPE OneView.CVE-2025-37158hewlett packard enterprise (hpe)hpe aruba networking aos-cx+1EPSS score0.64%
A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remote Code Execution (RCE) on the affected system.CVE-2025-37092hewlett packard enterprise (hpe)hpe storeonce software+1EPSS score1.25%
A command injection remote code execution vulnerability exists in HPE StoreOnce Software.CVE-2025-37159hewlett packard enterprise (hpe)hpe aruba networking aos-cx+1EPSS score0.27%
A vulnerability in the web management interface of the AOS-CX OS user authentication service could allow an authenticated remote attacker to hijack an active user session. Successful exploitation may enable the attacker to maintain unauthorized access to the session, potentially leading to the view or modification of sensitive configuration data.CVE-2025-37096hewlett packard enterprise (hpe)hpe storeonce software+1EPSS score1.25%
A command injection remote code execution vulnerability exists in HPE StoreOnce Software.CVE-2025-37155hewlett packard enterprise (hpe)hpe aruba networking aos-cx+1EPSS score0.13%
A vulnerability in the SSH restricted shell interface of the network management services allows improper access control for authenticated read-only users. If successfully exploited, this vulnerability could allow an attacker with read-only privileges to gain administrator access on the affected system.CVE-2025-37094hewlett packard enterprise (hpe)hpe storeonce software+1EPSS score0.86%
A directory traversal arbitrary file deletion vulnerability exists in HPE StoreOnce Software.CVE-2025-37107hewlett packard enterprisehpe autopass license server+1EPSS score0.53%
An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18.CVE-2025-37160hewlett packard enterprise (hpe)hpe aruba networking aos-cx+1EPSS score0.30%
A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation of this vulnerability could enable the attacker to disclose sensitive data.CVE-2025-37098hewlett packard enterpriseinsight remote support+1EPSS score46.34%
A path traversal vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646.CVE-2025-37106hewlett packard enterprisehpe autopass license server+1EPSS score0.54%
An authentication bypass and disclosure of information vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18.CVE-2025-27086hewlett packard enterprisehpe performance cluster manager (hpcm)+1EPSS score0.41%
A vulnerability in the HPE Performance Cluster Manager (HPCM) GUI could allow an attacker to bypass authentication.CVE-2020-7138hpenimbleosEPSS score1.81%
Potential remote code execution security vulnerabilities have been identified with HPE Nimble Storage systems that could be exploited by an attacker to gain elevated privileges on the array. The following NimbleOS versions, and all subsequent releases, contain a software fix for this vulnerability: 3.9.3.0 4.5.6.0 5.0.9.0 5.1.4.100CVE-2020-7139hpenimbleosEPSS score0.88%
Potential remote access security vulnerabilities have been identified with HPE Nimble Storage systems that could be exploited by an attacker to access and modify sensitive information on the system. The following NimbleOS versions, and all subsequent releases, contain a software fix for this vulnerability: 3.9.3.0 4.5.6.0 5.0.9.0 5.1.4.100CVE-2020-7137hpesuperdome_flex_server_firmwareEPSS score0.30%
A validation issue in HPE Superdome Flex's RMC component may allow local elevation of privilege. Apply HPE Superdome Flex Server version 3.25.46 or later to resolve this issue.CVE-2020-7136hewlett packard enterprisesmart update manager (sum)+1EPSS score80.86%
A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access. Hewlett Packard Enterprise has provided a software update to resolve this vulnerability in HPE Smart Update Manager (SUM) prior to 8.5.6. Please visit the HPE Support Center at https://support.hpe.com/hpesc/public/home to download the latest version of HPE Smart Update Manager (SUM). Download the latest version of HPE Smart Update Manager (SUM) or download the latest Service Pack For ProLiant (SPP).CVE-2020-7135hpservice_pack_for_proliant+8EPSS score0.53%
A potential security vulnerability has been identified in the disk drive firmware installers named Supplemental Update / Online ROM Flash Component on HPE servers running Linux. The vulnerable software is included in the HPE Service Pack for ProLiant (SPP) releases 2018.06.0, 2018.09.0, and 2018.11.0. The vulnerable software is the Supplemental Update / Online ROM Flash Component for Linux (x64) software. The installer in this software component could be locally exploited to execute arbitrary code. Drive Models can be found in the Vulnerability Resolution field of the security bulletin. The 2019_03 SPP and Supplemental update / Online ROM Flash Component for Linux (x64) after 2019.03.0 has fixed this issue.CVE-2020-7205hpeintelligent_provisioning+2EPSS score0.42%
A potential security vulnerability has been identified in HPE Intelligent Provisioning, Service Pack for ProLiant, and HPE Scripting ToolKit. The vulnerability could be locally exploited to allow arbitrary code execution during the boot process. **Note:** This vulnerability is related to using insmod in GRUB2 in the specific impacted HPE product and HPE is addressing this issue. HPE has made the following software updates and mitigation information to resolve the vulnerability in Intelligent Provisioning, Service Pack for ProLiant, and HPE Scripting ToolKit. HPE provided latest Intelligent Provisioning, Service Pack for ProLiant, and HPE Scripting Toolkit which includes the GRUB2 patch to resolve this vulnerability. These new boot images will update GRUB2 and the Forbidden Signature Database (DBX). After the DBX is updated, users will not be able to boot to the older IP, SPP or Scripting ToolKit with Secure Boot enabled. HPE have provided a standalone DBX update tool to work with Microsoft Windows, and supported Linux Operating Systems. These tools can be used to update the Forbidden Signature Database (DBX) from within the OS. **Note:** This DBX update mitigates the GRUB2 issue with insmod enabled, and the "Boot Hole" issue for HPE signed GRUB2 applications.