deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-22466
Published: 2023-01-04
Description: Tokio is a runtime for writing applications with Rust. Starting with version 1.7.0 and prior to versions 1.18.4, 1.20.3, and 1.23.1, when configuring a Windows named pipe server, setting `pipe_mode` will reset `reject_remote_clients` to `false`. If the application has previously configured `reject_remote_clients` to `true`, this effectively undoes the configuration. Remote clients may only access the named pipe if the named pipe's associated path is accessible via a publicly shared folder (SMB). Versions 1.23.1, 1.20.3, and 1.18.4 have been patched. The fix will also be present in all releases starting from version 1.24.0. Named pipes were introduced to Tokio in version 1.7.0, so releases older than 1.7.0 are not affected. As a workaround, ensure that `pipe_mode` is set first after initializing a `ServerOptions`.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-665
References: https://github.com/tokio-rs/tokio/pull/5336; https://github.com/tokio-rs/tokio/releases/tag/tokio-1.23.1; https://github.com/tokio-rs/tokio/security/advisories/GHSA-7rrj-xr53-82p7
CVE: CVE-2023-22467
Published: 2023-01-04
Description: Luxon is a library for working with dates and times in JavaScript. On the 1.x branch prior to 1.38.1, the 2.x branch prior to 2.5.2, and the 3.x branch on 3.2.1, Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks. This issue also appears in Moment as CVE-2022-31129. Versions 1.38.1, 2.5.2, and 3.2.1 contain patches for this issue. As a workaround, limit the length of the input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://github.com/moment/luxon/commit/5ab3bf64a10da929a437629cdb2f059bb83212bf; https://github.com/moment/luxon/security/advisories/GHSA-3xq5-wjfh-ppjc; https://github.com/moment/moment/pull/6015#issuecomment[PII_REDACTED]
CVE: CVE-2022-4876
Published: 2023-01-04
Description: A vulnerability was found in Kaltura mwEmbed up to 2.96.rc1 and classified as problematic. This issue affects some unknown processing of the file includes/DefaultSettings.php. The manipulation of the argument HTTP_X_FORWARDED_HOST leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.96.rc2 is able to address this issue. The patch is named 13b8812ebc8c9fa034eed91ab35ba8423a528c0b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217427.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/kaltura/mwEmbed/commit/13b8812ebc8c9fa034eed91ab35ba8423a528c0b; https://github.com/kaltura/mwEmbed/pull/4266; https://github.com/kaltura/mwEmbed/releases/tag/v2.96.rc2
CVE: CVE-2023-0057
Published: 2023-01-05
Description: Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5.0b3.dev33.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021
References: https://github.com/pyload/pyload/commit/bd2a31b7de54570b919aa1581d486e6ee18c0f64; https://huntr.dev/bounties/12b64f91-d048-490c-94b0-37514b6d694d; https://github.com/pyload/pyload/commit/bd2a31b7de54570b919aa1581d486e6ee18c0f64
CVE: CVE-2023-22622
Published: 2023-01-05
Description: WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner," but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits.
CVSS Score: 5.3 (MEDIUM)
References: https://developer.wordpress.org/plugins/cron/; https://github.com/WordPress/WordPress/blob/dca7b5204b5fea54e6d[PII_REDACTED]b359a9222ab/wp-cron.php#L5-L8; https://medium.com/%40thecpanelguy/the-nightmare-that-is-wpcron-php-ae31c1d3ae30
CVE: CVE-2021-25221
Published: 2023-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
CVE: CVE-2021-25222
Published: 2023-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
CVE: CVE-2021-25223
Published: 2023-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
CVE: CVE-2022-22371
Published: 2023-01-05
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system.  IBM X-Force ID:  221195.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-613
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/221195; https://www.ibm.com/support/pages/node/6852461; https://exchange.xforce.ibmcloud.com/vulnerabilities/221195
CVE: CVE-2022-34330
Published: 2023-01-05
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  229469.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/229469; https://www.ibm.com/support/pages/node/6852469; https://exchange.xforce.ibmcloud.com/vulnerabilities/229469
CVE: CVE-2022-37933
Published: 2023-01-05
Description: A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 servers. The vulnerability could be exploited to allow local unauthorized data injection. HPE has made the following software updates to resolve the vulnerability in HPE Superdome Flex firmware 3.60.50 and below and Superdome Flex 280 servers firmware 1.40.60 and below.


CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-74
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04400en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04400en_us
CVE: CVE-2022-37934
Published: 2023-01-05
Description: A potential security vulnerability has been identified in HPE OfficeConnect 1820, and 1850 switch series. The vulnerability could be remotely exploited to allow remote directory traversal in HPE OfficeConnect 1820 switch series version PT.02.17 and below, HPE OfficeConnect 1850 switch series version PC.01.23 and below, and HPE OfficeConnect 1850 (10G aggregator) switch version PO.01.22 and below.


CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04401en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04401en_us
CVE: CVE-2022-43519
Published: 2023-01-05
Description: Multiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the Aruba EdgeConnect Enterprise Orchestrator instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the Aruba EdgeConnect Enterprise Orchestrator host in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned.


CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt
CVE: CVE-2022-43520
Published: 2023-01-05
Description: Multiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the Aruba EdgeConnect Enterprise Orchestrator instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the Aruba EdgeConnect Enterprise Orchestrator host in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned.


CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt
CVE: CVE-2022-43521
Published: 2023-01-05
Description: Multiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the Aruba EdgeConnect Enterprise Orchestrator instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the Aruba EdgeConnect Enterprise Orchestrator host in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned.


CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt
CVE: CVE-2022-43522
Published: 2023-01-05
Description: Multiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the Aruba EdgeConnect Enterprise Orchestrator instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the Aruba EdgeConnect Enterprise Orchestrator host in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned.


CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt
CVE: CVE-2022-43523
Published: 2023-01-05
Description: Multiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the Aruba EdgeConnect Enterprise Orchestrator instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the Aruba EdgeConnect Enterprise Orchestrator host in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned.


CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt
CVE: CVE-2022-43524
Published: 2023-01-05
Description: A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned.


CVSS Score: 8.7 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt
CVE: CVE-2022-43525
Published: 2023-01-05
Description: Multiple vulnerabilities within the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt
CVE: CVE-2022-43526
Published: 2023-01-05
Description: Multiple vulnerabilities within the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt
CVE: CVE-2022-43527
Published: 2023-01-05
Description: Multiple vulnerabilities within the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt
CVE: CVE-2022-43528
Published: 2023-01-05
Description: Under certain configurations, an attacker can login to Aruba EdgeConnect Enterprise Orchestrator without supplying a multi-factor authentication code. Successful exploitation allows an attacker to login using only a username and password and successfully bypass MFA requirements in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned.


CVSS Score: 4.8 (MEDIUM)
CWE: CWE-287
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt
CVE: CVE-2022-43529
Published: 2023-01-05
Description: A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an remote attacker to persist a session after a password reset or similar session clearing event. Successful exploitation of this vulnerability could allow an authenticated attacker to remain on the system with the permissions of their current session after the session should be invalidated  in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned.


CVSS Score: 4.6 (MEDIUM)
CWE: CWE-384, CWE-384
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt
CVE: CVE-2022-43530
Published: 2023-01-05
Description: Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading  to complete compromise of the ClearPass Policy Manager cluster in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x: 6.10.7 and below and ClearPass Policy Manager 6.9.x:  6.9.12 and below.


CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-020.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-020.txt
CVE: CVE-2022-43531
Published: 2023-01-05
Description:  Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading  to complete compromise of the ClearPass Policy Manager cluster in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x: 6.10.7 and below and ClearPass Policy Manager 6.9.x: 6.9.12 and below.


CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-020.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-020.txt
CVE: CVE-2022-43532
Published: 2023-01-05
Description:  A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x: 6.10.7 and below and ClearPass Policy Manager 6.9.x:  6.9.12 and below.


CVSS Score: 8.0 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-020.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-020.txt
CVE: CVE-2022-43533
Published: 2023-01-05
Description:  A vulnerability in the ClearPass OnGuard macOS agent could allow malicious users on a macOS instance to elevate their user privileges. A successful exploit could allow these users to execute arbitrary code with root level privileges on the macOS instance in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x: 6.10.7 and below and ClearPass Policy Manager 6.9.x:  6.9.12 and below.


CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-020.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-020.txt
CVE: CVE-2022-43534
Published: 2023-01-05
Description: A vulnerability in the ClearPass OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges. A successful exploit could allow these users to execute arbitrary code with root level privileges on the Linux instance in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x: 6.10.7 and below and ClearPass Policy Manager 6.9.x:  6.9.12 and below.


CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-020.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-020.txt
CVE: CVE-2022-43535
Published: 2023-01-05
Description: A vulnerability in the ClearPass OnGuard Windows agent could allow malicious users on a Windows instance to elevate their user privileges. A successful exploit could allow these users to execute arbitrary code with NT AUTHORITY\SYSTEM level privileges on the Windows instance in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x: 6.10.7 and below and ClearPass Policy Manager 6.9.x:  6.9.12 and below.


CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-020.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-020.txt