Vulnerabilidades de Hpe

CVEs publicadas que afetam produtos de Hpe: 148 registro(s), com severidade, exploração e correções.

Somente exploradas (KEV) →

CVE-2026-44880 Alta · 8.8 CWE-120 21/07/2026

Low-Privilege Authenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-CX

A buffer overflow vulnerability was found in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow an remote low-privileged user to execute arbitrary code as a privileged user on the underlying operating system.

CVE-2026-23818 Crítica · 9.6 CWE-601 07/04/2026

Open Redirect Vulnerability in HPE Aruba Networking Private 5G Core On-Prem

A vulnerability has been identified in the graphical user interface (GUI) of HPE Aruba Networking Private 5G Core On-Prem that could allow an attacker to abuse an open redirect vulnerability in the login flow using a crafted URL. Successful exploitation may redirect an authenticated user to an attacker-controlled server hosting a spoofed login page prompting the unsuspecting victim to give away their credentials, which could then be captured by the attacker, before being redirected back to the legitimate login page.

CVE-2026-23817 Média · 6.1 CWE-601 11/03/2026

Unauthenticated Open Redirect allows URL Manipulation in Web Interface

A vulnerability in the web-based management interface of AOS-CX Switches could allow an unauthenticated remote attacker to redirect users to an arbitrary URL.

CVE-2026-23816 Alta · 8.8 CWE-78 11/03/2026

Authenticated Command Injection found in admin AOS-CX CLI command

A vulnerability in the command line interface of AOS-CX Switches could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

CVE-2026-23815 Alta · 7.2 CWE-77 11/03/2026

Authenticated Command Injection found in AOS-CX Administrative CLI Command

A vulnerability in a custom binary used in AOS-CX Switches' CLI could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute unauthorized commands.

CVE-2026-23814 Alta · 8.8 CWE-77 11/03/2026

Authenticated Command Injection found in AOS-CX CLI Command

A vulnerability in the command parameters of a certain AOS-CX CLI command could allow a low-privilege authenticated remote attacker to inject malicious commands resulting in unwanted behavior.

CVE-2026-23813 Crítica · 9.8 CWE-287 11/03/2026

Authentication Bypass in Web Interface allows Unauthenticated Admin Password Reset

A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. In some cases this could enable resetting the admin password.

CVE-2026-23600 Crítica · 9.8 CWE-287 02/03/2026

Improper Authentication em Hpe Autopass License Server

A remote authentication bypass vulnerability exists in HPE AutoPass License Server (APLS).

CVE-2026-23598 Média · 6.5 CWE-209 17/02/2026

Unauthenticated Information Disclosure in application API allows sensitive system information exposure

Vulnerabilities in the API error handling of an HPE Aruba Networking 5G Core server API could allow an unauthenticated remote attacker to obtain sensitive information. Successful exploitation could allow an attacker to access details such as user accounts, roles, and system configuration, as well as to gain insight into internal services and workflows, increasing the risk of unauthorized access and elevated privileges when combined with other vulnerabilities.

CVE-2026-23597 Média · 6.5 CWE-200 17/02/2026

Unauthenticated Information Disclosure in application API allows sensitive system information exposure

CVE-2026-23596 Média · 6.5 CWE-400 17/02/2026

Unauthenticated Improper Access Control in management API allows unauthorized service disruption

A vulnerability in the management API of the affected product could allow an unauthenticated remote attacker to trigger service restarts. Successful exploitation could allow an attacker to disrupt services and negatively impact system availability.

CVE-2026-23595 Alta · 8.8 CWE-284 17/02/2026

Unauthenticated Authentication Bypass in application API allows unauthorized administrative account creation

An authentication bypass in the application API allows an unauthorized administrative account to be created. A remote attacker could exploit this vulnerability to create privileged user accounts. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.

CVE-2025-37164 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-94 16/12/2025

Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability

A remote code execution issue exists in HPE OneView.

CVE-2025-37160 Média · 6.5 CWE-200 18/11/2025

Authenticated Broken Access Control (BAC) in REST API Configuration Service

A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation of this vulnerability could enable the attacker to disclose sensitive data.

CVE-2025-37159 Alta · 7.3 CWE-384 18/11/2025

Authenticated Session Hijacking Allows Unauthorized Access in Network Switching Software

A vulnerability in the web management interface of the AOS-CX OS user authentication service could allow an authenticated remote attacker to hijack an active user session. Successful exploitation may enable the attacker to maintain unauthorized access to the session, potentially leading to the view or modification of sensitive configuration data.

CVE-2025-37158 Alta · 8.8 CWE-78 18/11/2025

Authenticated Command Injection allows Unauthorized Command Execution in AOS-CX

A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remote Code Execution (RCE) on the affected system.

CVE-2025-37157 Alta · 8.8 CWE-94 18/11/2025

Authenticated Command Injection allows Unauthorized Command Execution in AOS-CX

CVE-2025-37156 Média · 6.8 18/11/2025

ArubaOS-CX Platform-Level Denial-of-Service Vulnerability

A platform-level denial-of-service (DoS) vulnerability exists in ArubaOS-CX software. Successful exploitation of this vulnerability could allow an attacker with administrative access to execute specific code that renders the switch non-bootable and effectively non-functional.

CVE-2025-37155 Alta · 7.8 CWE-284 18/11/2025

Authenticated Privilege Escalation Allows Unauthorized Access in Network Management Interface

A vulnerability in the SSH restricted shell interface of the network management services allows improper access control for authenticated read-only users. If successfully exploited, this vulnerability could allow an attacker with read-only privileges to gain administrator access on the affected system.

CVE-2019-11137 Alta · 8.2 CWE-20 14/11/2019

Improper Input Validation em Intel Xeon Platinum 8253 Firmware

Insufficient input validation in system firmware for Intel(R) Xeon(R) Scalable Processors, Intel(R) Xeon(R) Processors D Family, Intel(R) Xeon(R) Processors E5 v4 Family, Intel(R) Xeon(R) Processors E7 v4 Family and Intel(R) Atom(R) processor C Series may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.

CVE-2019-11136 Média · 6.7 14/11/2019

Insufficient access control in system firmware for Intel(R) Xeon(R) Scalable Processors…

Insufficient access control in system firmware for Intel(R) Xeon(R) Scalable Processors, 2nd Generation Intel(R) Xeon(R) Scalable Processors and Intel(R) Xeon(R) Processors D Family may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.

CVE-2017-5689 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-269 02/05/2017

Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).

CVE-2015-5477 Alta · 7.5 KEV Urgente · 79 Exploit público CWE-19 29/07/2015

ISC BIND Data Processing Errors Vulnerability

named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.