Hewlett Packard Enterprise (HPE)
Page 2 of 5 — Hewlett Packard Enterprise (HPE) CVEs from a corpus of 459, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-37139 | Medium | 6.0 | 2025-10-14 | A vulnerability in an AOS firmware binary allows an authenticated malicious actor to permanently delete necessary boot information. Successful exploitation may… |
CVE-2025-37138 | Medium | 6.2 | 2025-10-14 | An authenticated command injection vulnerability exists in the command line interface binary of AOS-10 GW and AOS-8 Controllers/Mobility Conductor operating sy… |
CVE-2025-37137 | Medium | 6.5 | 2025-10-14 | Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation o… |
CVE-2025-37136 | Medium | 6.5 | 2025-10-14 | Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation o… |
CVE-2025-37135 | Medium | 6.5 | 2025-10-14 | Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation o… |
CVE-2025-37134 | High | 7.2 | 2025-10-14 | An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation c… |
CVE-2025-37133 | High | 7.2 | 2025-10-14 | An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation c… |
CVE-2025-37132 | High | 7.2 | 2025-10-14 | An arbitrary file write vulnerability exists in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating syst… |
CVE-2025-37149 | Medium | 6.0 | 2025-10-14 | A potential out-of-bound reads vulnerability in HPE ProLiant RL300 Gen11 Server's UEFI firmware. |
CVE-2025-37122 | Medium | 6.1 | 2025-09-17 | A vulnerability in the web-based management interface of network access control services could allow an unauthenticated remote attacker to conduct a Reflected… |
CVE-2025-37131 | Medium | 4.9 | 2025-09-16 | A vulnerability in EdgeConnect SD-WAN ECOS could allow an authenticated remote threat actor with admin privileges to access sensitive unauthorized system files… |
CVE-2025-37130 | Medium | 6.5 | 2025-09-16 | A vulnerability in the command-line interface of EdgeConnect SD-WAN could allow an authenticated attacker to read arbitrary files within the system. Successful… |
CVE-2025-37129 | Medium | 6.7 | 2025-09-16 | A vulnerable feature in the command line interface of EdgeConnect SD-WAN could allow an authenticated attacker to exploit built-in script execution capabilitie… |
CVE-2025-37128 | Medium | 6.8 | 2025-09-16 | A vulnerability in the web API of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to terminate arbitrary running… |
CVE-2025-37127 | High | 7.2 | 2025-09-16 | A vulnerability in the cryptographic logic used by HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to gain shell… |
CVE-2025-37126 | High | 7.2 | 2025-09-16 | A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN Gateways Command Line Interface that allows remote authenticated users to run arbitrary c… |
CVE-2025-37125 | High | 7.5 | 2025-09-16 | A broken access control vulnerability exists in HPE Aruba Networking EdgeConnect OS (ECOS). Successful exploitation could allow an attacker to bypass firewall… |
CVE-2025-37124 | High | 8.6 | 2025-09-16 | A vulnerability in the HPE Aruba Networking SD-WAN Gateways could allow an unauthenticated remote attacker to bypass firewall protections. Successful exploitat… |
CVE-2025-37123 | High | 8.8 | 2025-09-16 | A vulnerability in the command-line interface of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to escalate priv… |
CVE-2025-37109 | Low | 3.5 | 2025-07-31 | Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product |
CVE-2025-37108 | Low | 3.5 | 2025-07-31 | Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product |
CVE-2025-37104 | High | 7.1 | 2025-07-16 | A security vulnerability has been identified in HPE Telco Service Orchestrator software. The vulnerability could allow authenticated clients to to perform a SQ… |
CVE-2025-37103 | Critical | 9.8 | 2025-07-08 | Hard-coded login credentials were found in HPE Networking Instant On Access Points, allowing anyone with knowledge of it to bypass normal device authenticati… |
CVE-2025-37102 | High | 7.2 | 2025-07-08 | An authenticated command injection vulnerability exists in the Command line interface of HPE Networking Instant On Access Points. A successful exploitation… |
CVE-2025-37100 | High | 7.7 | 2025-06-10 | A vulnerability in the APIs of HPE Aruba Networking Private 5G Core could potentially expose sensitive information to unauthorized users. A successful exploit… |
CVE-2025-37096 | Critical | 9.8 | 2025-06-02 | A command injection remote code execution vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37095 | Critical | 9.8 | 2025-06-02 | A directory traversal information disclosure vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37094 | Medium | 5.5 | 2025-06-02 | A directory traversal arbitrary file deletion vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37093 | Critical | 9.8 | 2025-06-02 | An authentication bypass vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37092 | Critical | 9.8 | 2025-06-02 | A command injection remote code execution vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37091 | High | 7.2 | 2025-06-02 | A command injection remote code execution vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37090 | Critical | 9.8 | 2025-06-02 | A server-side request forgery vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37089 | Critical | 9.8 | 2025-06-02 | A command injection remote code execution vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37088 | Medium | 6.8 | 2025-04-22 | A security vulnerability has been identified in HPE Cray Data Virtualization Service (DVS). Depending on race conditions and configuration, this vulnerability… |
CVE-2025-27087 | Medium | 5.5 | 2025-04-22 | A vulnerability in the kernel of the Cray Operating System (COS) could allow an attacker to perform a local Denial of Service (DoS) attack. |
CVE-2025-37087 | Critical | 9.8 | 2025-04-22 | A vulnerability in the cmdb service of the HPE Performance Cluster Manager (HPCM) could allow an attacker to gain access to an arbitrary file on the server hos… |
CVE-2025-27085 | Medium | 4.9 | 2025-04-08 | Multiple vulnerabilities exist in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor. Successful exploitation of these vul… |
CVE-2025-27084 | Medium | 5.4 | 2025-04-08 | A vulnerability in the Captive Portal of an AOS-10 GW and AOS-8 Controller/Mobility Conductor could allow a remote attacker to conduct a reflected cross-site s… |
CVE-2025-27083 | High | 7.2 | 2025-04-08 | Authenticated command injection vulnerabilities exist in the AOS-10 GW and AOS-8 Controller/Mobility Conductor web-based management interface. Successful explo… |
CVE-2025-27082 | High | 7.2 | 2025-04-08 | Arbitrary File Write vulnerabilities exist in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating system… |
CVE-2025-27079 | Medium | 6.0 | 2025-04-08 | A vulnerability in the file creation process on the command line interface of AOS-8 Instant and AOS-10 AP could allow an authenticated remote attacker to perfo… |
CVE-2025-27078 | Medium | 6.5 | 2025-04-08 | A vulnerability in a system binary of AOS-8 Instant and AOS-10 AP could allow an authenticated remote attacker to inject commands into the underlying operating… |
CVE-2025-25041 | Medium | 5.5 | 2025-04-01 | A vulnerability in the HPE Aruba Networking Virtual Intranet Access (VIA) client could allow malicious users to overwrite arbitrary files as NT AUTHORITY\SYSTE… |
CVE-2024-24456 | Medium | 5.9 | 2025-03-31 | An E-RAB Release Command packet containing a malformed NAS PDU will cause the Athonet MME to immediately crash, potentially due to a buffer overflow. |
CVE-2025-27080 | Medium | 6.0 | 2025-03-18 | Vulnerabilities in the command line interface of AOS-CX could allow an authenticated remote attacker to expose sensitive information. Successful exploitation c… |
CVE-2025-25042 | Medium | 4.3 | 2025-03-18 | A vulnerability in the AOS-CX REST interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploit… |
CVE-2025-25040 | Low | 3.3 | 2025-03-18 | A vulnerability has been identified in the port ACL functionality of AOS-CX software running on the HPE Aruba Networking CX 9300 Switch Series only and affects… |
CVE-2025-25039 | Medium | 4.7 | 2025-02-04 | A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager (CPPM) allows remote authenticated users to run arbitrar… |
CVE-2025-23060 | Medium | 6.6 | 2025-02-04 | A vulnerability in HPE Aruba Networking ClearPass Policy Manager may, under certain circumstances, expose sensitive unencrypted information. Exploiting this vu… |
CVE-2025-23059 | Medium | 6.8 | 2025-02-04 | A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager exposes directories containing sensitive information. If… |
CVE-2025-23058 | High | 8.8 | 2025-02-04 | A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged (read-only) authenticated remote attacker to gain unauth… |
CVE-2025-23057 | Medium | 5.5 | 2025-01-28 | A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-… |
CVE-2025-23056 | Medium | 5.5 | 2025-01-28 | A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-… |
CVE-2025-23055 | Medium | 5.5 | 2025-01-28 | A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-… |
CVE-2025-23054 | Medium | 6.5 | 2025-01-28 | A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an authenticated low privilege operator user to perfo… |
CVE-2025-23053 | Medium | 6.5 | 2025-01-28 | A privilege escalation vulnerability exists in the web-based management interface of HPE Aruba Networking Fabric Composer. Successful exploitation could allow… |
CVE-2025-23052 | High | 7.2 | 2025-01-14 | Authenticated command injection vulnerability in the command line interface of a network management service. Successful exploitation of this vulnerability coul… |
CVE-2025-23051 | High | 7.2 | 2025-01-14 | An authenticated parameter injection vulnerability exists in the web-based management interface of the AOS-8 and AOS-10 Operating Systems. Successful exploitat… |
CVE-2024-54010 | Low | 3.4 | 2025-01-08 | A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches exists. It could allow an unauthenticated adjacent attacker to cond… |
CVE-2024-54007 | High | 7.2 | 2025-01-07 | Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated remote command execut… |
CVE-2024-54006 | High | 7.2 | 2025-01-07 | Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated remote command execut… |
CVE-2024-54009 | Medium | 4.0 | 2024-12-19 | Remote authentication bypass vulnerability in HPE Alletra Storage MP B10000 in versions prior to version 10.4.5 could be remotely exploited to allow disclosure… |
CVE-2024-54008 | High | 7.2 | 2024-12-10 | An authenticated Remote Code Execution (RCE) vulnerability exists in the AirWave CLI. Successful exploitation of this vulnerability could allow a remote authen… |
CVE-2024-53672 | Medium | 4.7 | 2024-12-03 | A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying ho… |
CVE-2024-51773 | Medium | 4.8 | 2024-12-03 | A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote Attacker to conduct a s… |
CVE-2024-51772 | Medium | 6.4 | 2024-12-03 | An authenticated RCE vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands o… |
CVE-2024-51771 | High | 7.2 | 2024-12-03 | A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote threat actor to conduct… |
CVE-2024-53676 | Critical | 9.8 | 2024-11-27 | A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution. |
CVE-2024-53675 | High | 7.3 | 2024-11-26 | An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. |
CVE-2024-53674 | High | 7.3 | 2024-11-26 | An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. |
CVE-2024-53673 | High | 8.1 | 2024-11-26 | A java deserialization vulnerability in HPE Remote Insight Support may allow an unauthenticated attacker to execute code. |
CVE-2024-11622 | High | 7.3 | 2024-11-26 | An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. |
CVE-2024-51765 | Medium | 5.5 | 2024-11-15 | A security vulnerability has been identified in HPE Cray Data Virtualization Service (DVS). Depending on configuration, this vulnerability may lead to local/cl… |
CVE-2024-51764 | Medium | 5.5 | 2024-11-15 | A security vulnerability has been identified in HPE Data Management Framework (DMF) Suite (CXFS). Depending on configuration, this vulnerability may lead to lo… |
CVE-2024-24459 | Medium | 5.9 | 2024-11-15 | An invalid memory access when handling the ProtocolIE_ID field of S1Setup Request messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Se… |
CVE-2024-24458 | Medium | 5.9 | 2024-11-15 | An invalid memory access when handling the ENB Configuration Transfer messages containing invalid PLMN Identities in Athonet vEPC MME v11.4.0 allows attackers… |
CVE-2024-24457 | Medium | 5.9 | 2024-11-15 | An invalid memory access when handling the ProtocolIE_ID field of E-RAB Setup List Context SURes messages in Athonet vEPC MME v11.4.0 allows attackers to cause… |
CVE-2024-24455 | Medium | 5.9 | 2024-11-15 | An invalid memory access when handling a UE Context Release message containing an invalid UE identifier in Athonet vEPC MME v11.4.0 allows attackers to cause a… |
CVE-2024-24454 | Medium | 5.9 | 2024-11-15 | An invalid memory access when handling the ProtocolIE_ID field of E-RAB Modify Request messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial… |
CVE-2024-24453 | Medium | 5.9 | 2024-11-15 | An invalid memory access when handling the ProtocolIE_ID field of E-RAB NotToBeModifiedBearerModInd information element in Athonet vEPC MME v11.4.0 allows atta… |
CVE-2024-24452 | Medium | 5.9 | 2024-11-15 | An invalid memory access when handling the ProtocolIE_ID field of E-RAB Release Indication messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Den… |
CVE-2024-47464 | Medium | 6.8 | 2024-11-05 | An authenticated Path Traversal vulnerability exists in Instant AOS-8 and AOS-10. Successful exploitation of this vulnerability allows an attacker to copy arbi… |
CVE-2024-47463 | High | 7.2 | 2024-11-05 | An arbitrary file creation vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. Successful exploitation of this vulnerability could all… |
CVE-2024-47462 | High | 7.2 | 2024-11-05 | An arbitrary file creation vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. Successful exploitation of this vulnerability could all… |
CVE-2024-47461 | High | 7.2 | 2024-11-05 | An authenticated command injection vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. A successful exploitation of this vulnerability… |
CVE-2024-47460 | Critical | 9.0 | 2024-11-05 | Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined… |
CVE-2024-42509 | Critical | 9.8 | 2024-11-05 | Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined… |
CVE-2024-42508 | Medium | 5.5 | 2024-10-18 | This vulnerability could be exploited, leading to unauthorized disclosure of information to authenticated users. |
CVE-2024-42507 | Critical | 9.8 | 2024-09-25 | Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destin… |
CVE-2024-42506 | Critical | 9.8 | 2024-09-25 | Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destin… |
CVE-2024-42505 | Critical | 9.8 | 2024-09-25 | Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destin… |
CVE-2024-42503 | High | 7.2 | 2024-09-17 | Authenticated command execution vulnerability exist in the ArubaOS command line interface (CLI). Successful exploitation of this vulnerabilities result in the… |
CVE-2024-42502 | High | 7.2 | 2024-09-17 | Authenticated command injection vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability result in the ability… |
CVE-2024-42501 | High | 7.2 | 2024-09-17 | An authenticated Path Traversal vulnerabilities exists in the ArubaOS. Successful exploitation of this vulnerability allows an attacker to install unsigned pac… |
CVE-2024-42500 | Critical | 9.3 | 2024-09-09 | HPE has identified a denial of service vulnerability in HPE HP-UX System's Network File System (NFSv4) services. |
CVE-2024-42397 | Medium | 5.3 | 2024-08-06 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol. Successful explo… |
CVE-2024-42396 | Medium | 5.3 | 2024-08-06 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol. Successful explo… |
CVE-2024-42395 | Critical | 9.8 | 2024-08-06 | There is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploit… |
CVE-2024-42394 | Critical | 9.8 | 2024-08-06 | There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation coul… |
CVE-2024-42393 | Critical | 9.8 | 2024-08-06 | There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation coul… |