Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-23652 State: PUBLISHED Published: 2022-02-22T19:55:11.000Z Last Updated: 2025-04-22T18:21:44.645Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: clastix Products: capsule-proxy Problem Types: CWE-287 Description: capsule-proxy is a reverse proxy for Capsule Operator which provides multi-tenancy in Kubernetes. In versions prior to 0.2.1 an attacker with a proper authentication mechanism may use a malicious `Connection` header to start a privilege escalation attack towards the Kubernetes API Server. This vulnerability allows for an exploit of the `cluster-admin` Role bound to `capsule-proxy`. There are no known workarounds for this issue. Addit
or an exploit of the `cluster-admin` Role bound to `capsule-proxy`. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/clastix/capsule-proxy/security/advisories/GHSA-9cwv-cppx-mqjm - https://github.com/clastix/capsule-proxy/issues/188 - https://github.com/clastix/capsule-proxy/commit/efe91f68ebf8a9e3d21491dc57da7b8a746415d8
CVE ID: CVE-2022-23653 State: PUBLISHED Published: 2022-02-23T23:05:11.000Z Last Updated: 2025-04-23T19:00:51.675Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Backblaze Products: B2_Command_Line_Tool Problem Types: CWE-367 Description: B2 Command Line Tool is the official command line tool for the backblaze cloud storage service. Linux and Mac releases of the B2 command-line tool version 3.2.0 and below contain a key disclosure vulnerability that, in certain conditions, can be exploited by local attackers through a time-of-check-time-of-use (TOCTOU) race condition. The command line tool saves API keys (and bucket name-to-id mapping) in a local database f
-use (TOCTOU) race condition. The command line tool saves API keys (and bucket name-to-id mapping) in a local database file (`$XDG_CONFIG_HOME/b2/account_info`, `~/.b2_account_info` or a user-defined path) when `b2 authorize-account` is first run. This happens regardless of whether a valid key is provided or not. When first created, the file is world readable and is (typically a few milliseconds) later altered to be private to the user. If the directory is readable by a local attacker and the user did not yet run `b2 authorize-account` then during the brief period between file creation and permission modification, a local attacker can race to open the file and maintain a handle to it. This a
ile creation and permission modification, a local attacker can race to open the file and maintain a handle to it. This allows the local attacker to read the contents after the file after the sensitive information has been saved to it. Users that have not yet run `b2 authorize-account` should upgrade to B2 Command-Line Tool v3.2.1 before running it. Users that have run `b2 authorize-account` are safe if at the time of the file creation no other local users had read access to the local configuration file. Users that have run `b2 authorize-account` where the designated path could be opened by another local user should upgrade to B2 Command-Line Tool v3.2.1 and remove the database and regenerate
uld be opened by another local user should upgrade to B2 Command-Line Tool v3.2.1 and remove the database and regenerate all application keys. Note that `b2 clear-account` does not remove the database file and it should not be used to ensure that all open handles to the file are invalidated. If B2 Command-Line Tool cannot be upgraded to v3.2.1 due to a dependency conflict, a binary release can be used instead. Alternatively a new version could be installed within a virtualenv, or the permissions can be changed to prevent local users from opening the database file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Backblaze/B2_Command
l Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Backblaze/B2_Command_Line_Tool/security/advisories/GHSA-8wr4-2wm6-w3pr - https://github.com/Backblaze/B2_Command_Line_Tool/commit/c74029f9f75065e8f7e3c3ec8e0a23fb8204feeb
CVE ID: CVE-2022-23654 State: PUBLISHED Published: 2022-02-22T20:05:11.000Z Last Updated: 2025-04-23T19:02:06.747Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Requarks Products: wiki Problem Types: CWE-287 Description: Wiki.js is a wiki app built on Node.js. In affected versions an authenticated user with write access on a restricted set of paths can update a page outside the allowed paths by specifying a different target page ID while keeping the path intact. The access control incorrectly check the path access against the user-provided values instead of the actual path associated to the page ID. Commit https://github.com/Requarks/wiki/commit/411802ec2f65
values instead of the actual path associated to the page ID. Commit https://github.com/Requarks/wiki/commit/411802ec2f654bb5ed1126c307575b81e2361c6b fixes this vulnerability by checking access control on the path associated with the page ID instead of the user-provided value. When the path is different than the current value, a second access control check is then performed on the user-provided path before the move operation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Requarks/wiki/security/advisories/GHSA-3cv9-795v-6j7j - https://github.com/Requarks/wiki/commit/411802ec2f654bb5ed1126c307575b81e2361c6b
CVE ID: CVE-2022-23655 State: PUBLISHED Published: 2022-02-23T23:30:09.000Z Last Updated: 2025-04-23T19:00:46.105Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: octobercms Products: october Problem Types: CWE-347 Description: Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. Affected versions of OctoberCMS did not validate gateway server signatures. As a result non-authoritative gateway servers may be used to exfiltrate user private keys. Users are advised to upgrade their installations to build 474 or v1.1.10. The only known workaround is to manually apply the patch (e3b455ad587282f0fbcb7763c6d9c3d000ca1e6a) which adds server si
The only known workaround is to manually apply the patch (e3b455ad587282f0fbcb7763c6d9c3d000ca1e6a) which adds server signature validation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/octobercms/october/security/advisories/GHSA-53m6-44rc-h2q5 - https://github.com/octobercms/october/commit/e3b455ad587282f0fbcb7763c6d9c3d000ca1e6a
CVE ID: CVE-2022-23656 State: PUBLISHED Published: 2022-03-02T20:25:10.000Z Last Updated: 2025-04-23T18:59:20.616Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: zulip Products: zulip Problem Types: CWE-79 Description: Zulip is an open source team chat app. The `main` development branch of Zulip Server from June 2021 and later is vulnerable to a cross-site scripting vulnerability on the recent topics page. An attacker could maliciously craft a full name for their account and send messages to a topic with several participants; a victim who then opens an overflow tooltip including this full name on the recent topics page could trigger execution of JavaScript
then opens an overflow tooltip including this full name on the recent topics page could trigger execution of JavaScript code controlled by the attacker. Users running a Zulip server from the main branch should upgrade from main (2022-03-01 or later) again to deploy this fix. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zulip/zulip/security/advisories/GHSA-fc77-h3jc-6mfv - https://github.com/zulip/zulip/commit/e090027adcbf62737d5b1f83a9618a9500a49321
CVE ID: CVE-2022-23657 State: PUBLISHED Published: 2022-05-16T19:18:02 Last Updated: 2024-08-03T03:51:44.205Z Vendors: n/a Products: Aruba ClearPass Policy Manager Problem Types: remote authentication bypass Description: A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE ID: CVE-2022-23658 State: PUBLISHED Published: 2022-05-16T19:22:09 Last Updated: 2024-08-03T03:51:45.695Z Vendors: n/a Products: Aruba ClearPass Policy Manager Problem Types: remote authentication bypass Description: A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE ID: CVE-2022-23659 State: PUBLISHED Published: 2022-05-16T19:24:30 Last Updated: 2024-08-03T03:51:45.973Z Vendors: n/a Products: Aruba ClearPass Policy Manager Problem Types: remote reflected cross site scripting (xss) Description: A remote reflected cross site scripting (xss) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE ID: CVE-2022-23660 State: PUBLISHED Published: 2022-05-16T19:28:28 Last Updated: 2024-08-03T03:51:45.534Z Vendors: n/a Products: Aruba ClearPass Policy Manager Problem Types: remote authentication bypass Description: A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE ID: CVE-2022-23661 State: PUBLISHED Published: 2022-05-16T19:35:09 Last Updated: 2024-08-03T03:51:45.593Z Vendors: n/a Products: Aruba ClearPass Policy Manager Problem Types: authenticated remote command injection Description: A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE ID: CVE-2022-23662 State: PUBLISHED Published: 2022-05-16T19:32:57 Last Updated: 2024-08-03T03:51:45.914Z Vendors: n/a Products: Aruba ClearPass Policy Manager Problem Types: authenticated remote command injection Description: A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE ID: CVE-2022-23663 State: PUBLISHED Published: 2022-05-16T19:30:36 Last Updated: 2024-08-03T03:51:45.879Z Vendors: n/a Products: Aruba ClearPass Policy Manager Problem Types: authenticated remote command injection Description: A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE ID: CVE-2022-23664 State: PUBLISHED Published: 2022-05-16T19:37:24 Last Updated: 2024-08-03T03:51:44.191Z Vendors: n/a Products: Aruba ClearPass Policy Manager Problem Types: authenticated remote command injection Description: A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE ID: CVE-2022-23665 State: PUBLISHED Published: 2022-05-16T19:40:13 Last Updated: 2024-08-03T03:51:45.551Z Vendors: n/a Products: Aruba ClearPass Policy Manager Problem Types: authenticated remote command injection Description: A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE ID: CVE-2022-23666 State: PUBLISHED Published: 2022-05-16T19:49:40 Last Updated: 2024-08-03T03:51:45.573Z Vendors: n/a Products: Aruba ClearPass Policy Manager Problem Types: authenticated remote command injection Description: A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE ID: CVE-2022-23667 State: PUBLISHED Published: 2022-05-16T20:08:34 Last Updated: 2024-08-03T03:51:45.395Z Vendors: n/a Products: Aruba ClearPass Policy Manager Problem Types: authenticated remote command injection Description: A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE ID: CVE-2022-23668 State: PUBLISHED Published: 2022-05-16T20:04:57 Last Updated: 2024-08-03T03:51:45.785Z Vendors: n/a Products: Aruba ClearPass Policy Manager Problem Types: remote authenticated server-side request forgery (ssrf) Description: A remote authenticated server-side request forgery (ssrf) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manage that address this security vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE ID: CVE-2022-23669 State: PUBLISHED Published: 2022-05-17T17:50:36 Last Updated: 2024-08-03T03:51:45.823Z Vendors: n/a Products: Aruba ClearPass Policy Manager Problem Types: remote authorization bypass Description: A remote authorization bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE ID: CVE-2022-23670 State: PUBLISHED Published: 2022-05-16T20:12:32 Last Updated: 2024-08-03T03:51:45.475Z Vendors: n/a Products: Aruba ClearPass Policy Manager Problem Types: remote authenticated information disclosure Description: A remote authenticated information disclosure vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE ID: CVE-2022-23671 State: PUBLISHED Published: 2022-05-17T17:55:07 Last Updated: 2024-08-03T03:51:45.909Z Vendors: n/a Products: Aruba ClearPass Policy Manager Problem Types: remote authenticated information disclosure Description: A remote authenticated information disclosure vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE ID: CVE-2022-23672 State: PUBLISHED Published: 2022-05-17T17:52:58 Last Updated: 2024-08-03T03:51:45.926Z Vendors: n/a Products: Aruba ClearPass Policy Manager Problem Types: authenticated remote command injection Description: A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE ID: CVE-2022-23673 State: PUBLISHED Published: 2022-05-17T17:57:11 Last Updated: 2024-08-03T03:51:45.944Z Vendors: n/a Products: Aruba ClearPass Policy Manager Problem Types: authenticated remote command injection Description: A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE ID: CVE-2022-23674 State: PUBLISHED Published: 2022-05-17T18:05:45 Last Updated: 2024-08-03T03:51:44.208Z Vendors: n/a Products: Aruba ClearPass Policy Manager Problem Types: remote authenticated stored cross-site scripting (xss) Description: A remote authenticated stored cross-site scripting (xss) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE ID: CVE-2022-23675 State: PUBLISHED Published: 2022-05-17T17:58:58 Last Updated: 2024-08-03T03:51:45.617Z Vendors: n/a Products: Aruba ClearPass Policy Manager Problem Types: remote authenticated stored cross-site scripting (xss) Description: A remote authenticated stored cross-site scripting (xss) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE ID: CVE-2022-23676 State: PUBLISHED Published: 2022-05-10T18:10:31 Last Updated: 2024-08-03T03:51:45.560Z Vendors: n/a Products: ArubaOS-Switch Devices Problem Types: remote execution of arbitrary code Description: A remote execution of arbitrary code vulnerability was discovered in ArubaOS-Switch Devices version(s): ArubaOS-Switch 15.xx.xxxx: All versions; ArubaOS-Switch 16.01.xxxx: All versions; ArubaOS-Switch 16.02.xxxx: K.16.02.0033 and below; ArubaOS-Switch 16.03.xxxx: All versions; ArubaOS-Switch 16.04.xxxx: All versions; ArubaOS-Switch 16.05.xxxx: All versions; ArubaOS-Switch 16.06.xxxx: All versions; ArubaOS-Switch 16.07.xxxx: All versions; ArubaOS-Switch 16.08.xxxx: KB/WB/WC/YA/
rubaOS-Switch 16.06.xxxx: All versions; ArubaOS-Switch 16.07.xxxx: All versions; ArubaOS-Switch 16.08.xxxx: KB/WB/WC/YA/YB/YC.16.08.0024 and below; ArubaOS-Switch 16.09.xxxx: KB/WB/WC/YA/YB/YC.16.09.0019 and below; ArubaOS-Switch 16.10.xxxx: KB/WB/WC/YA/YB/YC.16.10.0019 and below; ArubaOS-Switch 16.11.xxxx: KB/WB/WC/YA/YB/YC.16.11.0003 and below. Aruba has released upgrades for ArubaOS-Switch Devices that address these security vulnerabilities. Additional Analyst Notes: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-008.txt
CVE ID: CVE-2022-23677 State: PUBLISHED Published: 2022-05-10T18:15:28 Last Updated: 2024-08-03T03:51:44.688Z Vendors: n/a Products: ArubaOS-Switch Devices Problem Types: remote execution of arbitrary code Description: A remote execution of arbitrary code vulnerability was discovered in ArubaOS-Switch Devices version(s): ArubaOS-Switch 15.xx.xxxx: All versions; ArubaOS-Switch 16.01.xxxx: All versions; ArubaOS-Switch 16.02.xxxx: K.16.02.0033 and below; ArubaOS-Switch 16.03.xxxx: All versions; ArubaOS-Switch 16.04.xxxx: All versions; ArubaOS-Switch 16.05.xxxx: All versions; ArubaOS-Switch 16.06.xxxx: All versions; ArubaOS-Switch 16.07.xxxx: All versions; ArubaOS-Switch 16.08.xxxx: KB/WB/WC/YA/
CVE ID: CVE-2022-23678 State: PUBLISHED Published: 2022-09-06T17:18:52 Last Updated: 2024-08-03T03:51:45.413Z Vendors: n/a Products: Aruba Virtual Intranet Access (VIA) Problem Types: remote disclosure of sensitive information Description: A vulnerability in the Aruba Virtual Intranet Access (VIA) client for Microsoft Windows operating system client communications that could allow for an attacker in a privileged network position to intercept sensitive information in Aruba Virtual Intranet Access (VIA) client for Microsoft Windows operating system versions: 4.3.0 build 2208101 and below. Aruba has released upgrades for Virtual Intranet Access (VIA) Client that address this security vulnerabil
01 and below. Aruba has released upgrades for Virtual Intranet Access (VIA) Client that address this security vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-011.txt
CVE ID: CVE-2022-23679 State: PUBLISHED Published: 2022-09-06T17:18:52 Last Updated: 2024-08-03T03:51:45.586Z Vendors: n/a Products: Aruba CX 6200F Switch Series; Aruba 6300 Switch Series; Aruba 6400 Switch Series; Aruba 8325 Switch Series; Aruba 8400 Switch Series; Aruba CX 8360 Switch Series; ArubaOS-CX Switches; Problem Types: Failure to provide CSRF Protection Description: AOS-CX lacks Anti-CSRF protections in place for state-changing operations. This can potentially be exploited by an attacker to execute commands in the context of another user in ArubaOS-CX Switches version(s): AOS-CX 10.10.xxxx: 10.10.0002 and below, AOS-CX 10.09.xxxx: 10.09.1020 and below, AOS-CX 10.08.xxxx: 10.08.106
rsion(s): AOS-CX 10.10.xxxx: 10.10.0002 and below, AOS-CX 10.09.xxxx: 10.09.1020 and below, AOS-CX 10.08.xxxx: 10.08.1060 and below, AOS-CX 10.06.xxxx: 10.06.0200 and below. Aruba has released upgrades for ArubaOS-CX Switch Devices that address this security vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-012.txt