rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-37089 
A command injection remote code execution vulnerability exists in HPE StoreOnce Software.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE StoreOnce Software
default_status: unaffected
Published: 2025-06-02T13:21:24.852Z
CVE-2025-37090 
A server-side request forgery vulnerability exists in HPE StoreOnce Software.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE StoreOnce Software
default_status: unaffected
Published: 2025-06-02T13:26:46.823Z
CVE-2025-37091 
A command injection remote code execution vulnerability exists in HPE StoreOnce Software.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE StoreOnce Software
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-06-02T13:31:54.938Z
CVE-2025-37092 
A command injection remote code execution vulnerability exists in HPE StoreOnce Software.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE StoreOnce Software
default_status: unaffected
Published: 2025-06-02T13:53:14.814Z
CVE-2025-37093 
An authentication bypass vulnerability exists in HPE StoreOnce Software.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE StoreOnce Software
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-06-02T13:56:18.942Z
CVE-2025-37094 
A directory traversal arbitrary file deletion vulnerability exists in HPE StoreOnce Software.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE StoreOnce Software
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
version: 3.1
Published: 2025-06-02T14:02:13.590Z
CVE-2025-37095 
A directory traversal information disclosure vulnerability exists in HPE StoreOnce Software.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE StoreOnce Software
default_status: unaffected
Published: 2025-06-02T14:14:51.450Z
CVE-2025-37096 
A command injection remote code execution vulnerability exists in HPE StoreOnce Software.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE StoreOnce Software
default_status: unaffected
Published: 2025-06-02T14:18:10.669Z
CVE-2025-37097 
A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of service
Affected products: vendor: Hewlett Packard Enterprise
product: Insight Remote Support
default_status: unaffected
Published: 2025-07-01T14:06:43.175Z
CVE-2025-37098 
A path traversal vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646.
Affected products: vendor: Hewlett Packard Enterprise
product: Insight Remote Support
default_status: unaffected
Published: 2025-07-01T14:39:11.831Z
CVE-2025-37099 
A remote code execution vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646.
Affected products: vendor: Hewlett Packard Enterprise
product: Insight Remote Support
default_status: unaffected
Published: 2025-07-01T17:30:25.166Z
CVE-2025-37100 Exposure of Sensitive Information to an Unauthorized User in HPE Aruba Networking Private 5G Core
A vulnerability in the APIs of HPE Aruba Networking Private 5G Core could potentially expose sensitive information to unauthorized users. 
A successful exploitation could allow an attacker to iteratively navigate through the filesystem and ultimately download protected system files containing sensitive information.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE Aruba Networking Private 5G Core
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2025-06-10T15:05:55.025Z
CVE-2025-37101 HPE OneView for VMware vCenter (OV4VC), Local Elevation of Privilege
A potential security vulnerability has been identified in HPE OneView for VMware vCenter (OV4VC). This vulnerability could be exploited allowing an attacker with read only privilege to cause Vertical Privilege Escalation (operator can perform admin actions).
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Hewlett Packard Enterprise
product: HPE OneView for VMware vCenter
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.7
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H
version: 3.1
Published: 2025-06-26T05:19:02.298Z
CVE-2025-37102 Authenticated Command Injection Vulnerability In Instant On Command Line Interface
An authenticated command injection vulnerability exists in the Command line interface of HPE Networking Instant On Access Points.  

A successful exploitation could allow a remote attacker with elevated  privileges to execute arbitrary commands on the underlying operating system as a highly privileged user.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE Networking Instant On
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: ZZ from Ubisectech Sirius Team
Published: 2025-07-08T19:08:15.395Z
CVE-2025-37103 Hardcoded Credential Exposure Allows Unauthorized Access in Web Interface
Hard-coded login credentials were found in HPE Networking Instant On  Access Points, allowing anyone with knowledge of it to bypass normal  device authentication. Successful exploitation could allow a remote  attacker to gain administrative access to the system.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE Networking Instant On
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: ZZ from Ubisectech Sirius Team
Published: 2025-07-08T19:09:30.415Z
CVE-2025-37104 HPE Telco Service Orchestrator Software, Authenticated SQL Injection
A security vulnerability has been identified in HPE Telco Service Orchestrator software. The vulnerability could allow authenticated clients to to perform a SQL Injection attack when sending a service request, and potentially exfiltrate the database's vendor name to unauthorized authenticated clients.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE Telco Service Orchestrator
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L
version: 3.1
Published: 2025-07-16T14:17:49.560Z
CVE-2025-37105 
An hsqldb-related remote code execution vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18.
Affected products: vendor: Hewlett Packard Enterprise
product: HPE AutoPass License Server
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-07-16T17:42:05.208Z
CVE-2025-37106 
An authentication bypass and disclosure of information vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18.
Affected products: vendor: Hewlett Packard Enterprise
product: HPE AutoPass License Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2025-07-16T17:53:03.999Z
CVE-2025-37107 
An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18.
Affected products: vendor: Hewlett Packard Enterprise
product: HPE AutoPass License Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2025-07-16T17:55:16.614Z
CVE-2025-37108 HPE Telco Service Activator, Protection Mechanism Failure
Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE Telco Service Activator
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-07-31T19:17:55.861Z
CVE-2025-37109 HPE Telco Service Activator, Protection Mechanism Failure
Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE Telco Service Activator
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-07-31T19:20:44.918Z
CVE-2025-37110 Sensitive Credential Information stored insecurely in System Database
A vulnerability was discovered in the storage policy for certain sets of sensitive credential information in the HPE Telco Network Function Virtual Orchestrator. Successful Exploitation could lead to unauthorized parties gaining access to sensitive system information.
Problem types: cwe_id: CWE-922
description: CWE-922 Insecure Storage of Sensitive Information
Affected products: vendor: Hewlett Packard Enterprise
product: HPE Telco Network Function Virtual Orchestrator
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2025-07-31T19:41:39.665Z
CVE-2025-37111 Hard-Coded Authentication Keys found in System
A vulnerability was discovered in the storage policy for certain sets of authentication keys in the HPE Telco Network Function Virtual Orchestrator. Successful Exploitation could lead to unauthorized parties gaining access to sensitive system information.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: Hewlett Packard Enterprise
product: HPE Telco Network Function Virtual Orchestrator
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2025-07-31T19:41:54.593Z
CVE-2025-37112 Hard-Coded Encryption Keys found in System
A vulnerability was discovered in the storage policy for certain sets of encryption keys in the HPE Telco Network Function Virtual Orchestrator. Successful Exploitation could lead to unauthorized parties gaining access to sensitive system information.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: Hewlett Packard Enterprise
product: HPE Telco Network Function Virtual Orchestrator
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2025-07-31T19:42:04.081Z
CVE-2025-37122 Unauthenticated Reflected Cross-Site Scripting
A vulnerability in the web-based management interface of network access control services could allow an unauthenticated remote attacker to conduct a Reflected Cross-Site Scripting (XSS) attack. Successful exploitation could allow an attacker to execute arbitrary JavaScript code in a victim's browser in the context of the affected interface.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE Aruba Networking ClearPass Policy Manager
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: ricky8368
Published: 2025-09-17T19:31:19.915Z
CVE-2025-37123 Authenticated Command Injection leads to Unauthorized Actions in CLI  Interface
A vulnerability in the command-line interface of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary system commands with root privileges on the underlying operating system.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE Aruba Networking EdgeConnect SD-WAN Gateway
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Nicholas Migliore
Published: 2025-09-16T22:30:31.261Z
CVE-2025-37124 Unauthenticated Access Vulnerability allows Transit Traffic Misrouting in SD-WAN Edge Interface
A vulnerability in the HPE Aruba Networking SD-WAN Gateways could allow an unauthenticated remote attacker to bypass firewall protections. Successful exploitation could allow an attacker to route potentially harmful traffic through the internal network, leading to unauthorized access or disruption of services.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE Aruba Networking EdgeConnect SD-WAN Gateway
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
version: 3.1
Credits: lang: en
value: HPE Aruba Networking EdgeConnect SD-WAN Engineering
Published: 2025-09-16T22:29:14.622Z
CVE-2025-37125 Broken access control vulnerability in Firewall Configuration Leads to  Unauthorized Access to Internal Network Resources
A broken access control vulnerability exists in HPE Aruba Networking EdgeConnect OS (ECOS). Successful exploitation could allow an attacker to bypass firewall protections, potentially leading to unauthorized traffic being handled improperly
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE Aruba Networking EdgeConnect SD-WAN Gateway
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Unknown contributor
Published: 2025-09-16T22:32:04.483Z
CVE-2025-37126 Authenticated Remote Code Execution in HPE Aruba Networking  EdgeConnect SD-WAN Gateways Command Line Interface
A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN Gateways Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE Aruba Networking EdgeConnect SD-WAN Gateway
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: grouptherapy
Published: 2025-09-16T22:19:16.146Z
CVE-2025-37127 Authenticated Replay Attack contains Cryptographic Vulnerability
A vulnerability in the cryptographic logic used by HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to gain shell access. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, potentially leading to unauthorized access and control over the affected systems.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE Aruba Networking EdgeConnect SD-WAN Gateway
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: NCC Group
Published: 2025-09-16T22:22:02.338Z
CVE-2025-37128 Authenticated Arbitrary Process Termination allows potential System Disruption in ECOS
A vulnerability in the web API of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to terminate arbitrary running processes. Successful exploitation could allow an attacker to disrupt system operations, potentially resulting in an unstable system state.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE Aruba Networking EdgeConnect SD-WAN Gateway
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: NCC Group
Published: 2025-09-16T22:22:57.383Z
CVE-2025-37129 Authenticated Remote Code Execution allows Exploit in Scripts Feature
A vulnerable feature in the command line interface of EdgeConnect SD-WAN could allow an authenticated attacker to exploit built-in script execution capabilities. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system if the feature is enabled without proper security measures.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE Aruba Networking EdgeConnect SD-WAN Gateway
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: NCC Group
Published: 2025-09-16T22:22:05.098Z
CVE-2025-37130 Unrestricted Binary allows File Enumeration in Underlying Operating  System
A vulnerability in the command-line interface of EdgeConnect SD-WAN could allow an authenticated attacker to read arbitrary files within the system. Successful exploitation could allow an attacker to read sensitive data from the underlying file system.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE Aruba Networking EdgeConnect SD-WAN Gateway
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: NCC Group
Published: 2025-09-16T22:20:53.184Z
CVE-2025-37131 Authenticated Arbitrary File Read allows Data Exposure in CLI  Interface
A vulnerability in EdgeConnect SD-WAN ECOS could allow an authenticated remote threat actor with admin privileges to access sensitive unauthorized system files. Under certain conditions, this could lead to exposure and exfiltration of sensitive information.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE Aruba Networking EdgeConnect SD-WAN Gateway
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: NCC Group
Published: 2025-09-16T22:17:32.261Z
CVE-2025-37132 Authenticated Remote Code Execution Vulnerability in AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface via Arbitrary File Write
An arbitrary file write vulnerability exists in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to upload arbitrary files and execute arbitrary commands on the underlying operating system.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: ArubaOS (AOS)
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: zzcentury from Ubisectech Sirius Team
Published: 2025-10-14T16:53:16.724Z