Hewlett Packard Enterprise
311 CVEs across 102 Hewlett Packard Enterprise products. Browse Hewlett Packard Enterprise vulnerabilities, severities, and proof-of-concept exploits.
Hewlett Packard Enterprise products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-37112 | Medium | 6.0 | 2025-07-31 | A vulnerability was discovered in the storage policy for certain sets of encryption keys in the HPE Telco Network Function Virtual Orchestrator. Successful Exp… |
CVE-2025-37111 | Medium | 6.0 | 2025-07-31 | A vulnerability was discovered in the storage policy for certain sets of authentication keys in the HPE Telco Network Function Virtual Orchestrator. Successful… |
CVE-2025-37110 | Medium | 6.0 | 2025-07-31 | A vulnerability was discovered in the storage policy for certain sets of sensitive credential information in the HPE Telco Network Function Virtual Orchestrato… |
CVE-2025-37107 | High | 7.3 | 2025-07-16 | An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18. |
CVE-2025-37106 | High | 7.3 | 2025-07-16 | An authentication bypass and disclosure of information vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18. |
CVE-2025-37105 | High | 7.5 | 2025-07-16 | An hsqldb-related remote code execution vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18. |
CVE-2024-51770 | High | 7.5 | 2025-07-14 | An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. |
CVE-2024-51769 | High | 7.5 | 2025-07-14 | An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. |
CVE-2024-51768 | High | 8.0 | 2025-07-14 | An hsqldb-related remote code execution vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. |
CVE-2024-51767 | High | 7.3 | 2025-07-14 | An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. |
CVE-2025-37099 | Critical | 9.8 | 2025-07-01 | A remote code execution vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646. |
CVE-2025-37098 | High | 7.5 | 2025-07-01 | A path traversal vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646. |
CVE-2025-37097 | High | 7.5 | 2025-07-01 | A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of service |
CVE-2025-37101 | High | 8.7 | 2025-06-26 | A potential security vulnerability has been identified in HPE OneView for VMware vCenter (OV4VC). This vulnerability could be exploited allowing an attacker wi… |
CVE-2025-27086 | High | 8.1 | 2025-04-21 | A vulnerability in the HPE Performance Cluster Manager (HPCM) GUI could allow an attacker to bypass authentication. |
CVE-2025-27081 | Medium | 6.8 | 2025-04-10 | A potential security vulnerability in HPE NonStop OSM Service Connection Suite could potentially be exploited to allow a local Denial of Service. |
CVE-2024-13804 | Critical | 9.8 | 2025-03-30 | Unauthenticated RCE in HPE Insight Cluster Management Utility |
CVE-2024-11856 | Low | 3.7 | 2024-12-02 | A security vulnerability in HPE IceWall products could be exploited remotely to cause Unauthorized Data Modification. |
CVE-2024-51766 | Medium | 6.5 | 2024-11-22 | A potential security vulnerability has been identified in the HPE NonStop DISK UTIL (T9208) product. This vulnerability could be exploited to cause a denial of… |
CVE-2024-42504 | Medium | 4.3 | 2024-10-03 | A security vulnerability in HPE IceWall Agent products could be exploited remotely to cause a Cross-Site Request Forgery (CSRF) in the login flow. |
CVE-2024-42400 | Medium | 5.3 | 2024-08-06 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these v… |
CVE-2024-42399 | Medium | 5.3 | 2024-08-06 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these v… |
CVE-2024-42398 | Medium | 5.3 | 2024-08-06 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these v… |
CVE-2024-22444 | Medium | 6.1 | 2024-07-24 | A vulnerability within the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow a remote attacker to conduct a reflected cross-site sc… |
CVE-2024-41914 | High | 8.1 | 2024-07-24 | A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross… |
CVE-2024-22443 | High | 7.2 | 2024-07-24 | A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a server-side… |
CVE-2024-22440 | Medium | 6.8 | 2024-04-17 | A potential security vulnerability has been identified in HPE Compute Scale-up Server 3200 server. This vulnerability could cause disclosure of sensitive info… |
CVE-2024-22439 | Medium | 6.9 | 2024-04-15 | A potential security vulnerability has been identified in HPE FlexFabric and FlexNetwork series products. This vulnerability could be exploited to gain privil… |
CVE-2024-22438 | Low | 3.5 | 2024-04-15 | A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820 Network switches. The vulnerability could be remotely… |
CVE-2024-22437 | High | 7.3 | 2024-04-15 | A potential security vulnerability has been identified in VSS Provider and CAPI Proxy software for certain HPE MSA storage products. This vulnerability could… |
CVE-2024-22435 | High | 8.3 | 2024-04-15 | A potential security vulnerability has been identified in Web ViewPoint Enterprise software. This vulnerability could be exploited to allow unauthorized users… |
CVE-2023-6573 | Medium | 5.5 | 2024-01-23 | HPE OneView may have a missing passphrase during restore. |
CVE-2023-50275 | High | 7.5 | 2024-01-23 | HPE OneView may allow clusterService Authentication Bypass resulting in denial of service. |
CVE-2023-50274 | High | 7.8 | 2024-01-23 | HPE OneView may allow command injection with local privilege escalation. |
CVE-2023-39268 | Medium | 4.5 | 2023-08-29 | A memory corruption vulnerability in ArubaOS-Switch could lead to unauthenticated remote code execution by receiving specially crafted packets. Successful expl… |
CVE-2023-39267 | Medium | 6.6 | 2023-08-29 | An authenticated remote code execution vulnerability exists in the command line interface in ArubaOS-Switch. Successful exploitation results in a Denial-of-Ser… |
CVE-2023-39266 | High | 8.3 | 2023-08-29 | A vulnerability in the ArubaOS-Switch web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) at… |
CVE-2023-28084 | Medium | 5.5 | 2023-04-25 | HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens |
CVE-2022-37912 | High | 7.2 | 2022-12-12 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ab… |
CVE-2022-37911 | Low | 3.8 | 2022-12-12 | Due to improper restrictions on XML entities multiple vulnerabilities exist in the command line interface of ArubaOS. A successful exploit could allow an authe… |
CVE-2022-37910 | Medium | 4.4 | 2022-12-12 | A buffer overflow vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability results in a denial of service on t… |
CVE-2022-37909 | Medium | 5.3 | 2022-12-12 | Aruba has identified certain configurations of ArubaOS that can lead to sensitive information disclosure from the configured ESSIDs. The scenarios in which dis… |
CVE-2022-37908 | Medium | 5.8 | 2022-12-12 | An authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series controllers. Successful exploitation can compromise the hardware ch… |
CVE-2022-37907 | Medium | 5.8 | 2022-12-12 | A vulnerability exists in the ArubaOS bootloader on 7xxx series controllers which can result in a denial of service (DoS) condition on an impacted system. A su… |
CVE-2022-37906 | Medium | 6.5 | 2022-12-12 | An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of the vulnerability results in the ability… |
CVE-2022-37905 | Medium | 6.6 | 2022-12-12 | Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful expl… |
CVE-2022-37904 | Medium | 6.6 | 2022-12-12 | Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful expl… |
CVE-2022-37903 | High | 7.2 | 2022-12-12 | A vulnerability exists that allows an authenticated attacker to overwrite an arbitrary file with attacker-controlled content via the web interface. Successful… |
CVE-2022-37902 | High | 7.2 | 2022-12-12 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ab… |
CVE-2022-37901 | High | 7.2 | 2022-12-12 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ab… |
CVE-2022-37900 | High | 7.2 | 2022-12-12 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ab… |
CVE-2022-37899 | High | 7.2 | 2022-12-12 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ab… |
CVE-2022-37898 | High | 7.2 | 2022-12-12 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ab… |
CVE-2022-37897 | Critical | 9.8 | 2022-12-12 | There is a command injection vulnerability that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (… |
CVE-2020-7136 | Critical | 9.8 | 2020-04-30 | A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access. Hewlett Packard Enterprise has provid… |
CVE-2019-11991 | Critical | 9.8 | 2019-07-09 | HPE has identified a vulnerability in HPE 3PAR Service Processor (SP) version 4.1 through 4.4. HPE 3PAR Service Processor (SP) version 4.1 through 4.4 has a re… |
CVE-2018-7080 | High | 7.5 | 2018-12-07 | A vulnerability exists in the firmware of embedded BLE radios that are part of some Aruba Access points. An attacker who is able to exploit the vulnerability c… |
CVE-2018-7079 | High | 7.2 | 2018-12-07 | Aruba ClearPass Policy Manager guest authorization failure. Certain administrative operations in ClearPass Guest do not properly enforce authorization rules, w… |
CVE-2018-7067 | High | 7.2 | 2018-12-07 | A Remote Authentication bypass in Aruba ClearPass Policy Manager leads to complete cluster compromise. An authentication flaw in all versions of ClearPass coul… |
CVE-2018-7066 | Critical | 9.0 | 2018-12-07 | An unauthenticated remote command execution exists in Aruba ClearPass Policy Manager on linked devices. The ClearPass OnConnect feature permits administrators… |
CVE-2018-7065 | High | 7.2 | 2018-12-07 | An authenticated SQL injection vulnerability in Aruba ClearPass Policy Manager can lead to privilege escalation. All versions of ClearPass are affected by mult… |
CVE-2018-7063 | High | 8.1 | 2018-12-07 | In Aruba ClearPass, disabled API admins can still perform read/write operations. In certain circumstances, API admins in ClearPass which have been disabled may… |
CVE-2018-7116 | High | 7.5 | 2018-12-03 | HPE Intelligent Management Center (IMC) prior to IMC PLAT 7.3 (E0605P06) is vulnerable to a remote denial of service via dbman Opcode 10003 'Filename'. This pr… |
CVE-2018-7115 | Medium | 5.3 | 2018-12-03 | HPE Intelligent Management Center (IMC) prior to IMC PLAT 7.3 (E0605P06) is vulnerable to a remote buffer overflow in dbman.exe opcode 10001 on Windows. This p… |
CVE-2018-7114 | Critical | 9.8 | 2018-12-03 | HPE Intelligent Management Center (IMC) prior to IMC PLAT 7.3 (E0605P06) is vulnerable to remote buffer overflow in dbman leading to code execution. This probl… |
CVE-2018-7113 | Medium | 6.6 | 2018-12-03 | A security vulnerability in HPE Integrated Lights-Out 5 (iLO 5) prior to v1.37 could be locally exploited to bypass the security restrictions for firmware upda… |
CVE-2018-7112 | Medium | 5.5 | 2018-12-03 | The HPE-provided Windows firmware installer for certain Gen9, Gen8, G7,and G6 HPE servers allows local disclosure of privileged information. This issue was res… |
CVE-2018-7111 | Medium | 5.3 | 2018-10-17 | A remote unauthorized access vulnerability was identified in HPE UIoT versions 1.5, 1.4.0, 1.4.1, 1.4.2, 1.2.4.2. Specifically, there is a malfunction identifi… |
CVE-2018-7110 | Medium | 5.9 | 2018-10-17 | A remote unauthorized disclosure of information vulnerability was identified in HPE Service Governance Framework (SGF) version 4.2, 4.3. A race condition under… |
CVE-2018-7076 | Critical | 9.8 | 2018-10-17 | A remote code execution vulnerability was identified in HPE Intelligent Management Center (iMC) prior to iMC PLAT 7.3 E0605P04. |
CVE-2018-7109 | Medium | 6.5 | 2018-09-27 | HPE has addressed a remote arbitrary file modification vulnerability in HPE enhanced Internet Usage Manager (eIUM) v9.0FP1 with the cumulative patch for v9.0FP… |
CVE-2018-7108 | Medium | 5.9 | 2018-09-27 | HPE StorageWorks XP7 Automation Director (AutoDir) version 8.5.2-02 to earlier than 8.6.1-00 has a local and remote authentication bypass vulnerability that ex… |
CVE-2018-7107 | High | 8.8 | 2018-09-27 | A potential security vulnerability has been identified in HPE Device Entitlement Gateway (DEG) v3.2.4, v3.3 and v3.3.1. The vulnerability could be remotely exp… |
CVE-2018-7105 | High | 7.2 | 2018-09-27 | A security vulnerability in HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers prior to v1.35, HPE Integrated Lights-Out 4 (iLO 4) prior to v2.61, HPE I… |
CVE-2018-7104 | Critical | 9.8 | 2018-09-27 | A Remote Code Execution vulnerability was identified in HPE Intelligent Management Center (iMC) Wireless Services Manager Software earlier than version IMC WSM… |
CVE-2018-7103 | Critical | 9.8 | 2018-09-27 | A Remote Code Execution vulnerability was identified in HPE Intelligent Management Center (iMC) Wireless Services Manager Software earlier than version IMC WSM… |
CVE-2018-7102 | High | 7.5 | 2018-09-27 | A security vulnerability in HPE Intelligent Management Center (iMC) PLAT E0506P09, createFabricAutoCfgFile could be remotely exploited via directory traversal… |
CVE-2018-7101 | High | 7.5 | 2018-09-27 | A potential remote denial of service security vulnerability has been identified in HPE Integrated Lights Out 4 prior to v2.60 and iLO 5 for Gen 10 servers prio… |
CVE-2018-7100 | Medium | 5.5 | 2018-08-14 | A potential security vulnerability has been identified in HPE OfficeConnect 1810 Switch Series (HP 1810-24G - P.2.22 and previous versions, HP 1810-48G PK.1.34… |
CVE-2018-7099 | Medium | 5.5 | 2018-08-14 | A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). The vulnerability may be locally exploited to allow discl… |
CVE-2018-7098 | High | 8.4 | 2018-08-14 | A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). The vulnerability may be locally exploited to allow direc… |
CVE-2018-7097 | High | 8.8 | 2018-08-14 | A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). The vulnerability may be exploited remotely to allow cros… |
CVE-2018-7096 | Critical | 9.8 | 2018-08-14 | A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). The vulnerability may be exploited remotely to allow code… |
CVE-2018-7095 | Critical | 9.8 | 2018-08-14 | A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). The vulnerability may be exploited remotely to allow acce… |
CVE-2018-7094 | Medium | 5.5 | 2018-08-14 | A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-5.0.0.0-22913(GA). The vulnerability may be exploited locally to allow discl… |
CVE-2018-7093 | High | 8.6 | 2018-08-14 | A security vulnerability in HPE Integrated Lights-Out 3 prior to v1.90, iLO 4 prior to v2.60, iLO 5 prior to v1.30, Moonshot Chassis Manager firmware prior to… |
CVE-2018-7077 | High | 7.5 | 2018-08-14 | A security vulnerability in HPE XP P9000 Command View Advanced Edition (CVAE) Device Manager (DevMgr 8.5.0-00 and prior to 8.6.0-00), Configuration Manager (CM… |
CVE-2018-7092 | High | 7.5 | 2018-08-06 | A potential security vulnerability has been identified in HPE Intelligent Management Center Platform (IMC Plat) 7.3 E0506P09. The vulnerability could be remote… |
CVE-2018-7091 | Medium | 6.1 | 2018-08-06 | HPE XP P9000 Command View Advanced Edition Software (CVAE) has open URL redirection vulnerability in versions 7.0.0-00 to earlier than 8.60-00 of DevMgr, TSMgr… |
CVE-2018-7090 | Medium | 6.1 | 2018-08-06 | HPE XP P9000 Command View Advanced Edition Software (CVAE) has local and remote cross site scripting vulnerability in versions 7.0.0-00 to earlier than 8.60-00… |
CVE-2018-7078 | High | 7.2 | 2018-08-06 | A remote code execution was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than version v2.60 and HPE Integrated Lights-Out 5 (iLO 5) earlier than v… |
CVE-2018-7075 | Medium | 6.1 | 2018-08-06 | A remote cross-site scripting (XSS) vulnerability was identified in HPE Intelligent Management Center (iMC) PLAT version v7.3 (E0506). The vulnerability is fix… |
CVE-2018-7074 | Critical | 9.8 | 2018-08-06 | A remote code execution vulnerability was identified in HPE Intelligent Management Center (iMC) PLAT 7.3 E0506P07. The vulnerability was resolved in iMC PLAT 7… |
CVE-2018-7073 | Medium | 5.5 | 2018-08-06 | A local arbitrary file modification vulnerability was identified in HPE Moonshot Provisioning Manager prior to v1.24. |
CVE-2018-7072 | Critical | 9.8 | 2018-08-06 | A remote bypass of security restrictions vulnerability was identified in HPE Moonshot Provisioning Manager prior to v1.24. |
CVE-2018-7071 | Medium | 4.3 | 2018-08-06 | HPE has identified a remote access to sensitive information vulnerability in HPE Network Function Virtualization Director (NFVD) 4.2.1 prior to gui patch 3. |
CVE-2018-7070 | Medium | 5.3 | 2018-08-06 | HPE has identified a remote disclosure of information vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. This issue is resolve… |
CVE-2018-7069 | High | 7.5 | 2018-08-06 | HPE has identified a remote unauthenticated access to files vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. This issue is r… |
CVE-2018-7068 | Medium | 6.1 | 2018-08-06 | HPE has identified a remote HOST header attack vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. This issue is resolved in HF… |
CVE-2018-7060 | High | 8.8 | 2018-08-06 | Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 is vulnerable to CSRF attacks against authenticated users. An attacker could manipulate an authen… |