rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-29092 
Unrestricted upload of file with dangerous type vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to execute arbitrary code via unspecified vectors.
Problem types: cwe_id: CWE-434
description: CWE-434: Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Synology
product: Synology Photo Station
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-06-01T09:45:16.520Z
CVE-2021-29093 ArcGIS Server image service and raster analytics security update: use-after-free
A use-after-free vulnerability when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: Esri
product: ArcGIS Server
Published: 2021-03-25T20:32:06.303Z
CVE-2021-29094 ArcGIS Server image service and raster analytics security update: buffer overflow
Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Overflow
Affected products: vendor: Esri
product: ArcGIS Server
Published: 2021-03-25T20:33:20.321Z
CVE-2021-29095 ArcGIS Server image service and raster analytics security update: uninitialized pointer
Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.
Problem types: cwe_id: CWE-824
description: CWE-824 Access of Uninitialized Pointer
Affected products: vendor: Esri
product: ArcGIS Server
Published: 2021-03-25T20:34:59.374Z
CVE-2021-29096 ArcGIS general raster security update: use-after-free
A use-after-free vulnerability when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allows an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: Esri
product: ArcReader
vendor: Esri
product: ArcGIS Desktop
vendor: Esri
product: ArcGIS Engine
vendor: Esri
product: ArcGIS Engine
vendor: Esri
product: ArcGIS Engine
vendor: Esri
product: ArcGIS Engine
vendor: Esri
product: ArcGIS Desktop Background Geoprocessing
vendor: Esri
product: ArcGIS Engine Background Geoprocessing
vendor: Esri
product: ArcGIS Engine Background Geoprocessing
Published: 2021-03-25T18:37:37.051Z
CVE-2021-29097 ArcGIS general raster security update: buffer overflow
Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allow an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Esri
product: ArcReader
vendor: Esri
product: ArcGIS Desktop
vendor: Esri
product: ArcGIS Engine
vendor: Esri
product: ArcGIS Engine
vendor: Esri
product: ArcGIS Pro
vendor: Esri
product: ArcGIS Desktop Background Geoprocessing
vendor: Esri
product: ArcGIS Desktop Background Geoprocessing
Published: 2021-03-25T20:36:03.915Z
CVE-2021-29098 ArcGIS general raster security update: uninitialized pointer
Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allow an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.
Problem types: cwe_id: CWE-824
description: CWE-824 Access of Uninitialized Pointer
Affected products: vendor: Esri
product: ArcReader
vendor: Esri
product: ArcGIS Desktop
vendor: Esri
product: ArcGIS Engine
vendor: Esri
product: ArcGIS Engine
vendor: Esri
product: ArcGIS Engine
vendor: Esri
product: ArcGIS Engine
vendor: Esri
product: ArcGIS Pro
vendor: Esri
product: ArcGIS Desktop Background Geoprocessing
vendor: Esri
product: ArcGIS Desktop Background Geoprocessing
Published: 2021-03-25T20:37:05.516Z
CVE-2021-29099 There is a SQL injection vulnerability in ArcGIS Server
A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier. Specially crafted web requests can expose information that is not intended to be disclosed (not customer datasets). Web Services that use file based data sources (file Geodatabase or Shape Files or tile cached services) are unaffected by this issue.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Esri
product: ArcGIS Server
Published: 2021-06-07T11:47:19.951Z
CVE-2021-29100 ArcGIS Earth has a File Parsing Directory Traversal Vulnerability
A path traversal vulnerability exists in Esri ArcGIS Earth versions 1.11.0 and below which allows arbitrary file creation on an affected system through crafted input. An attacker could exploit this vulnerability to gain arbitrary code execution under security context of the user running ArcGIS Earth by inducing the user to upload a crafted file to an affected system.
Problem types: cwe_id: CWE-23
description: CWE-23 Relative Path Traversal
Affected products: vendor: Esri
product: ArcGIS Earth
Published: 2021-05-05T15:16:13.177Z
CVE-2021-29101 ArcGIS GeoEvent Server has a Directory Traversal security vulnerability.
ArcGIS GeoEvent Server versions 10.8.1 and below has a read-only directory path traversal vulnerability that could allow an unauthenticated, remote attacker to perform directory traversal attacks and read arbitrary files on the system.
Problem types: cwe_id: CWE-23
description: CWE-23 Relative Path Traversal
Affected products: vendor: Esri
product: ArcGIS GeoEvent Server
Published: 2021-05-05T18:21:27.314Z
CVE-2021-29102 There is a Server-Side Request Forgery (SSRF) vulnerability in Esri ArcGIS Server Manager version 10.8.1 and below.
A Server-Side Request Forgery (SSRF) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote, unauthenticated attacker to forge GET requests to arbitrary URLs from the system, potentially leading to network enumeration or facilitating other attacks.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Esri
product: ArcGIS Server
Published: 2021-07-11T01:28:15.394Z
CVE-2021-29103 There is a reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below.
A reflected Cross Site Scripting (XXS) vulnerability in ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Esri
product: ArcGIS Server
Published: 2021-07-11T01:16:28.826Z
CVE-2021-29104 There is a stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below.
A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS Server Manager application.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Esri
product: ArcGIS Server
Published: 2021-07-11T01:39:41.853Z
CVE-2021-29105 There is a stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below.
A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below may allow a remote authenticated attacker to pass and store malicious strings in the ArcGIS Services Directory.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Esri
product: ArcGIS Server
Published: 2021-07-11T01:11:36.814Z
CVE-2021-29106 There is a reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below.
A reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Esri
product: ArcGIS Server
Published: 2021-07-10T14:26:11.746Z
CVE-2021-29107 There is a stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below.
A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS Server Manager application.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Esri
product: ArcGIS Server
Published: 2021-07-10T14:23:45.846Z
CVE-2021-29108 There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below.
There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authenticated attacker who is able to intercept and modify a SAML assertion to impersonate another account (XML Signature Wrapping Attack). In addition patching, Esri also strongly recommends as best practice for SAML assertions to be signed and encrypted.
Problem types: cwe_id: CWE-347
description: CWE-347 Improper Verification of Cryptographic Signature
Affected products: vendor: Esri
product: Portal for ArcGIS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-10-01T14:41:33.989Z
CVE-2021-29109 A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9.
A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Esri
product: Portal for ArcGIS
Published: 2021-10-01T14:51:28.177Z
CVE-2021-29110 Stored cross-site scripting (XSS) issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home application.
Stored cross-site scripting (XSS) issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home application.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Esri
product: Portal for ArcGIS
Published: 2021-10-01T14:59:24.718Z
CVE-2021-29112 Esri ArcReader PMF File Parsing Out-Of-Bounds Read Information  Disclosure Vulnerability
An out-of-bounds read vulnerability exists when parsing a specially crafted file in Esri ArcReader 10.8.1 (and earlier) which allow an unauthenticated attacker to induce an information disclosure issue in the context of the current user.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: Esri
product: ArcReader
Published: 2022-08-12T18:40:27.411Z
CVE-2021-29113 Remote file inclusion vulnerability in ArcGIS Server help documentation
A remote file inclusion vulnerability in the ArcGIS Server help documentation may allow a remote, unauthenticated attacker to inject attacker supplied html into a page.
Problem types: cwe_id: CWE-98
description: CWE-98: Improper Control of Filename for Include/Require Statement
Affected products: vendor: Esri
product: ArcGIS Server
Published: 2021-12-07T10:48:48.897Z
CVE-2021-29114 SQL injection vulnerability in ArcGIS Server
A SQL injection vulnerability in feature services provided by Esri ArcGIS Server 10.9 and below allows a remote, unauthenticated attacker to impact the confidentiality, integrity and availability of targeted services via specifically crafted queries.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Esri
product: ArcGIS Server
Published: 2021-12-07T10:51:39.544Z
CVE-2021-29115 An information disclosure vulnerability
An information disclosure vulnerability in the ArcGIS Service Directory in Esri ArcGIS Enterprise versions 10.9.0 and below may allows a remote attacker to view hidden field names in feature layers. This issue may reveal field names, but not not disclose features.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Esri
product: ArcGIS Server
Published: 2021-12-07T10:56:55.260Z
CVE-2021-29116 BUG-000142180 Hosted feature services vulnerable to stored XSS
A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server feature services versions 10.8.1 and 10.9 (only) feature services may allow a remote, unauthenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Esri
product: ArcGIS Server
Published: 2021-12-07T11:00:53.382Z
CVE-2021-29117 arcreader use-after-free
A use-after-free vulnerability when parsing a specially crafted file in Esri ArcReader 10.8.1 (and earlier) allows an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: Esri
product: ArcReader
Published: 2022-08-12T18:45:12.867Z
CVE-2021-29118 Esri ArcReader PMF File Parsing Out-Of-Bounds Read Information  Disclosure Vulnerability
An out-of-bounds read vulnerability exists when parsing a specially crafted file in Esri ArcReader 10.8.1 (and earlier) which allow an unauthenticated attacker to induce an information disclosure issue in the context of the current user.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: Esri
product: ArcReader
Published: 2022-08-12T18:40:09.061Z
CVE-2021-29133 
Lack of verification in haserl, a component of Alpine Linux Configuration Framework, before 0.9.36 allows local users to read the contents of any file on the filesystem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-24T06:32:44.000Z
CVE-2021-29134 
The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T20:30:58.000Z
CVE-2021-29136 
Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-06T15:57:49.000Z
CVE-2021-29137 
A remote URL redirection vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave Management Platform that address this security vulnerability.
Problem types: description: remote url redirection
Affected products: vendor: n/a
product: Aruba AirWave Management Platform
Published: 2021-04-29T11:10:12.000Z
CVE-2021-29138 
A remote disclosure of privileged information vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba has released patches for Aruba ClearPass Policy Manager that address this security vulnerability.
Problem types: description: remote disclosure of privileged information
Affected products: vendor: n/a
product: Aruba ClearPass Policy Manager
Published: 2021-04-29T12:25:07.000Z
CVE-2021-29139 
A remote cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba has released patches for Aruba ClearPass Policy Manager that address this security vulnerability.
Problem types: description: remote cross site scripting (xss)
Affected products: vendor: n/a
product: Aruba ClearPass Policy Manager
Published: 2021-04-29T13:16:56.000Z
CVE-2021-29140 
A remote XML external entity (XXE) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba has released patches for Aruba ClearPass Policy Manager that address this security vulnerability.
Problem types: description: remote xml external entity (xxe)
Affected products: vendor: n/a
product: Aruba ClearPass Policy Manager
Published: 2021-04-29T12:19:12.000Z
CVE-2021-29141 
A remote disclosure of sensitive information vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba has released patches for Aruba ClearPass Policy Manager that address this security vulnerability.
Problem types: description: remote disclosure of sensitive information
Affected products: vendor: n/a
product: Aruba ClearPass Policy Manager
Published: 2021-04-29T13:30:59.000Z
CVE-2021-29142 
A remote cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba has released patches for Aruba ClearPass Policy Manager that address this security vulnerability.
Problem types: description: remote cross site scripting (xss)
Affected products: vendor: n/a
product: Aruba ClearPass Policy Manager
Published: 2021-04-29T12:08:56.000Z
CVE-2021-29143 
A remote execution of arbitrary commands vulnerability was discovered in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series version(s): Aruba AOS-CX firmware: 10.04.xxxx - versions prior to 10.04.3070, 10.05.xxxx - versions prior to 10.05.0070, 10.06.xxxx - versions prior to 10.06.0110, 10.07.xxxx - versions prior to 10.07.0001. Aruba has released upgrades for Aruba AOS-CX devices that address this security vulnerability.
Problem types: description: remote execution of arbitrary commands
Affected products: vendor: n/a
product: Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series
Published: 2021-07-22T13:31:38.000Z
CVE-2021-29144 
A remote disclosure of sensitive information vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba has released patches for Aruba ClearPass Policy Manager that address this security vulnerability.
Problem types: description: remote disclosure of sensitive information
Affected products: vendor: n/a
product: Aruba ClearPass Policy Manager
Published: 2021-04-29T11:52:27.000Z
CVE-2021-29145 
A remote server side request forgery (SSRF) remote code execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba has released patches for Aruba ClearPass Policy Manager that address this security vulnerability.
Problem types: description: remote server side request forgery (ssrf), remote code execution
Affected products: vendor: n/a
product: Aruba ClearPass Policy Manager
Published: 2021-04-29T11:31:10.000Z
CVE-2021-29146 
A remote cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba has released patches for Aruba ClearPass Policy Manager that address this security vulnerability.
Problem types: description: remote cross site scripting (xss)
Affected products: vendor: n/a
product: Aruba ClearPass Policy Manager
Published: 2021-04-29T11:21:28.000Z
CVE-2021-29147 
A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba has released patches for Aruba ClearPass Policy Manager that address this security vulnerability.
Problem types: description: remote arbitray command execution
Affected products: vendor: n/a
product: Aruba ClearPass Policy Manager
Published: 2021-04-29T11:58:09.000Z
CVE-2021-29148 
A local cross-site scripting (XSS) vulnerability was discovered in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series version(s): Aruba AOS-CX firmware: 10.04.xxxx - versions prior to 10.04.3070, 10.05.xxxx - versions prior to 10.05.0070, 10.06.xxxx - versions prior to 10.06.0110, 10.07.xxxx - versions prior to 10.07.0001. Aruba has released upgrades for Aruba AOS-CX devices that address this security vulnerability.
Problem types: description: local cross-site scripting (XSS)
Affected products: vendor: n/a
product: Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series
Published: 2021-07-22T13:37:41.000Z
CVE-2021-29149 
A local bypass security restrictions vulnerability was discovered in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series version(s): Aruba AOS-CX firmware: 10.04.xxxx - versions prior to 10.04.3070, 10.05.xxxx - versions prior to 10.05.0070, 10.06.xxxx - versions prior to 10.06.0110, 10.07.xxxx - versions prior to 10.07.0001. Aruba has released upgrades for Aruba AOS-CX devices that address this security vulnerability.
Problem types: description: local bypass security restrictions
Affected products: vendor: n/a
product: Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series
Published: 2021-07-22T13:42:08.000Z
CVE-2021-29150 
A remote insecure deserialization vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
Problem types: description: remote insecure deserialization
Affected products: vendor: n/a
product: Aruba ClearPass Policy Manager
Published: 2021-07-08T14:08:22.000Z
CVE-2021-29151 
A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
Problem types: description: remote authentication bypass
Affected products: vendor: n/a
product: Aruba ClearPass Policy Manager
Published: 2021-07-08T15:14:38.000Z