HPE
Page 2 of 3 — HPE CVEs from a corpus of 285, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-51767 | High | 7.3 | 2025-07-14 | An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. |
CVE-2025-37099 | Critical | 9.8 | 2025-07-01 | A remote code execution vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646. |
CVE-2025-37098 | High | 7.5 | 2025-07-01 | A path traversal vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646. |
CVE-2025-37097 | High | 7.5 | 2025-07-01 | A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of service |
CVE-2025-37096 | Critical | 9.8 | 2025-06-02 | A command injection remote code execution vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37095 | Critical | 9.8 | 2025-06-02 | A directory traversal information disclosure vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37094 | Medium | 5.5 | 2025-06-02 | A directory traversal arbitrary file deletion vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37093 | Critical | 9.8 | 2025-06-02 | An authentication bypass vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37092 | Critical | 9.8 | 2025-06-02 | A command injection remote code execution vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37091 | High | 7.2 | 2025-06-02 | A command injection remote code execution vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37090 | Critical | 9.8 | 2025-06-02 | A server-side request forgery vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37089 | Critical | 9.8 | 2025-06-02 | A command injection remote code execution vulnerability exists in HPE StoreOnce Software. |
CVE-2025-27086 | High | 8.1 | 2025-04-21 | A vulnerability in the HPE Performance Cluster Manager (HPCM) GUI could allow an attacker to bypass authentication. |
CVE-2025-25040 | Low | 3.3 | 2025-03-18 | A vulnerability has been identified in the port ACL functionality of AOS-CX software running on the HPE Aruba Networking CX 9300 Switch Series only and affects… |
CVE-2024-54010 | Low | 3.4 | 2025-01-08 | A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches exists. It could allow an unauthenticated adjacent attacker to cond… |
CVE-2024-53676 | Critical | 9.8 | 2024-11-27 | A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution. |
CVE-2024-53675 | High | 7.3 | 2024-11-26 | An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. |
CVE-2024-53674 | High | 7.3 | 2024-11-26 | An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. |
CVE-2024-53673 | High | 8.1 | 2024-11-26 | A java deserialization vulnerability in HPE Remote Insight Support may allow an unauthenticated attacker to execute code. |
CVE-2024-11622 | High | 7.3 | 2024-11-26 | An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. |
CVE-2024-42508 | Medium | 5.5 | 2024-10-18 | This vulnerability could be exploited, leading to unauthorized disclosure of information to authenticated users. |
CVE-2024-22441 | Critical | 9.8 | 2024-06-13 | HPE Cray Parallel Application Launch Service (PALS) is subject to an authentication bypass. |
CVE-2023-50272 | High | 7.5 | 2023-12-19 | A potential security vulnerability has been identified in HPE Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 6 (iLO 6). The vulnerability could be r… |
CVE-2023-50271 | High | 7.2 | 2023-12-17 | A potential security vulnerability has been identified with HP-UX System Management Homepage (SMH). This vulnerability could be exploited locally or remotely… |
CVE-2023-30912 | High | 7.2 | 2023-10-25 | A remote code execution issue exists in HPE OneView. |
CVE-2023-30911 | Medium | 6.8 | 2023-10-18 | HPE Integrated Lights-Out 5, and Integrated Lights-Out 6 using iLOrest may cause denial of service. |
CVE-2023-30910 | Medium | 5.4 | 2023-10-09 | HPE MSA Controller prior to version IN210R004 could be remotely exploited to allow inconsistent interpretation of HTTP requests. |
CVE-2023-39268 | Medium | 4.5 | 2023-08-29 | A memory corruption vulnerability in ArubaOS-Switch could lead to unauthenticated remote code execution by receiving specially crafted packets. Successful expl… |
CVE-2023-39267 | Medium | 6.6 | 2023-08-29 | An authenticated remote code execution vulnerability exists in the command line interface in ArubaOS-Switch. Successful exploitation results in a Denial-of-Ser… |
CVE-2023-39266 | High | 8.3 | 2023-08-29 | A vulnerability in the ArubaOS-Switch web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) at… |
CVE-2023-3718 | High | 8.8 | 2023-08-01 | An authenticated command injection vulnerability exists in the AOS-CX command line interface. Successful exploitation of this vulnerability results in the abi… |
CVE-2023-30906 | High | 7.5 | 2023-07-18 | The vulnerability could be locally exploited to allow escalation of privilege. |
CVE-2023-30905 | High | 7.8 | 2023-06-16 | The MC990 X and UV300 RMC component has and inadequate default configuration that could be exploited to obtain enhanced privilege. |
CVE-2023-30904 | Medium | 5.5 | 2023-06-16 | A security vulnerability in HPE Insight Remote Support may result in the local disclosure of privileged LDAP information. |
CVE-2023-28084 | Medium | 5.5 | 2023-04-25 | HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens |
CVE-2023-28085 | Medium | 5.5 | 2023-04-14 | An HPE OneView Global Dashboard (OVGD) appliance dump may expose OVGD user account credentials |
CVE-2023-28083 | High | 8.3 | 2023-03-22 | A remote Cross-site Scripting vulnerability was discovered in HPE Integrated Lights-Out 6 (iLO 6), Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4… |
CVE-2023-1168 | High | 7.2 | 2023-03-22 | An authenticated remote code execution vulnerability exists in the AOS-CX Network Analytics Engine. Successful exploitation of this vulnerability resul… |
CVE-2022-37940 | Medium | 5.3 | 2023-03-22 | Potential security vulnerabilities have been identified in the HPE FlexFabric 5700 Switch Series. These vulnerabilities could be remotely exploited to allow ho… |
CVE-2022-37939 | Low | 2.3 | 2023-03-10 | A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 servers. The vulnerability could be locally exploited to al… |
CVE-2022-37938 | Critical | 9.8 | 2023-03-01 | Unauthenticated server side request forgery in HPE Serviceguard Manager |
CVE-2022-37937 | Critical | 9.8 | 2023-03-01 | Pre-auth memory corruption in HPE Serviceguard |
CVE-2022-37936 | Critical | 9.8 | 2023-03-01 | Unauthenticated Java deserialization vulnerability in Serviceguard Manager |
CVE-2022-37934 | Medium | 6.8 | 2023-01-05 | A potential security vulnerability has been identified in HPE OfficeConnect 1820, and 1850 switch series. The vulnerability could be remotely exploited to allo… |
CVE-2022-37933 | High | 7.3 | 2023-01-05 | A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 servers. The vulnerability could be exploited to allow loca… |
CVE-2022-37932 | High | 8.8 | 2022-12-12 | A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S Network switches. The vulnerability co… |
CVE-2022-37930 | Medium | 6.7 | 2022-12-12 | A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays and HPE Nimble Storage Secondary Flash Arrays which could potentially al… |
CVE-2022-37929 | Medium | 6.7 | 2022-12-12 | Improper Privilege Management vulnerability in Hewlett Packard Enterprise Nimble Storage Hybrid Flash Arrays and Nimble Storage Secondary Flash Arrays. |
CVE-2022-37928 | High | 8.0 | 2022-12-12 | Insufficient Verification of Data Authenticity vulnerability in Hewlett Packard Enterprise HPE Nimble Storage Hybrid Flash Arrays and Nimble Storage Secondary… |
CVE-2022-37927 | Medium | 6.1 | 2022-12-12 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Hewlett Packard Enterprise HPE OneView Global Dashboard (OVGD). |
CVE-2021-46846 | Medium | 6.4 | 2022-12-12 | Cross Site Scripting vulnerability in Hewlett Packard Enterprise Integrated Lights-Out 5. |
CVE-2022-37931 | High | 7.3 | 2022-11-22 | A vulnerability in NetBatch-Plus software allows unauthorized access to the application. HPE has provided a workaround and fix. Please refer to HPE Security… |
CVE-2022-28640 | High | 8.8 | 2022-09-20 | A potential local adjacent arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and availability was dis… |
CVE-2022-28639 | High | 8.8 | 2022-09-20 | A remote potential adjacent denial of service (DoS) and potential adjacent arbitrary code execution vulnerability that could potentially lead to a loss of conf… |
CVE-2022-28638 | High | 7.8 | 2022-09-20 | An isolated local disclosure of information and potential isolated local arbitrary code execution vulnerability that could potentially lead to a loss of confid… |
CVE-2022-28637 | High | 7.8 | 2022-09-20 | A local Denial of Service (DoS) and local arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and avail… |
CVE-2022-28636 | High | 7.4 | 2022-08-12 | A potential local arbitrary code execution and a local denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Light… |
CVE-2022-28635 | High | 7.4 | 2022-08-12 | A potential local arbitrary code execution and a local denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Light… |
CVE-2022-28634 | Medium | 6.7 | 2022-08-12 | A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. A highly privileged us… |
CVE-2022-28633 | High | 7.3 | 2022-08-12 | A local disclosure of sensitive information and a local unauthorized data modification vulnerability were discovered in HPE Integrated Lights-Out 5 (iLO 5) fir… |
CVE-2022-28632 | High | 8.8 | 2022-08-12 | A potential arbitrary code execution and a denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Lights-Out 5 (iLO… |
CVE-2022-28631 | High | 8.8 | 2022-08-12 | A potential arbitrary code execution and a denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Lights-Out 5 (iLO… |
CVE-2022-28630 | High | 7.3 | 2022-08-12 | A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user c… |
CVE-2022-28629 | High | 7.8 | 2022-08-12 | A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. A low privileged user… |
CVE-2022-28628 | High | 8.4 | 2022-08-12 | A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user c… |
CVE-2022-28627 | High | 8.4 | 2022-08-12 | A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user c… |
CVE-2022-28626 | Medium | 6.7 | 2022-08-12 | A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. A highly privileged us… |
CVE-2022-28624 | Medium | 4.8 | 2022-07-08 | A potential security vulnerability has been identified in certain HPE FlexNetwork and FlexFabric switch products. The vulnerability could be remotely exploited… |
CVE-2022-28623 | Critical | 9.8 | 2022-07-08 | Security vulnerabilities in HPE IceWall SSO 10.0 certd could be exploited remotely to allow SQL injection or unauthorized data injection. HPE has provided the… |
CVE-2022-28621 | High | 7.5 | 2022-06-28 | A remote disclosure of sensitive information vulnerability was discovered in HPE NonStop DSM/SCM version: T6031H03^ADP. HPE has provided a software update to r… |
CVE-2022-28622 | High | 7.5 | 2022-06-27 | A potential security vulnerability has been identified in HPE StoreOnce Software. The SSH server supports weak key exchange algorithms which could lead to remo… |
CVE-2022-28620 | Critical | 9.8 | 2022-06-24 | A remote authentication bypass vulnerability was discovered in HPE Cray Legacy Shasta System Solutions; HPE Slingshot; and HPE Cray EX supercomputers versions… |
CVE-2022-28619 | High | 7.8 | 2022-06-24 | A potential security vulnerability has been identified in the installer of HPE Version Control Repository Manager. The vulnerability could allow local escalati… |
CVE-2022-28618 | Critical | 9.8 | 2022-05-20 | A command injection security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays and HPE Nimble St… |
CVE-2022-23705 | High | 7.5 | 2022-05-09 | A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays, and HPE Nimble Storage Secondary F… |
CVE-2022-23704 | High | 7.5 | 2022-05-09 | A potential security vulnerability has been identified in Integrated Lights-Out 4 (iLO 4). The vulnerability could allow remote Denial of Service. The vulnerab… |
CVE-2022-23703 | High | 7.5 | 2022-04-12 | A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays and HPE Nimble Storage Secondary Fl… |
CVE-2022-23702 | Medium | 6.7 | 2022-04-12 | A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 Servers. The vulnerability could be locally exploited to al… |
CVE-2021-41005 | Medium | 6.5 | 2022-04-12 | A remote vulnerability was discovered in Aruba Instant On 1930 Switch Series version(s): Firmware below v1.0.7.0. |
CVE-2021-41004 | High | 7.5 | 2022-04-12 | A remote vulnerability was discovered in Aruba Instant On 1930 Switch Series version(s): Firmware below v1.0.7.0. |
CVE-2021-41003 | Medium | 6.1 | 2022-03-02 | Multiple unauthenticated command injection vulnerabilities were discovered in the AOS-CX API interface in Aruba CX 6200F Switch Series, Aruba 6300 Switch Serie… |
CVE-2021-41002 | High | 8.1 | 2022-03-02 | Multiple authenticated remote path traversal vulnerabilities were discovered in the AOS-CX command line interface in Aruba CX 6200F Switch Series, Aruba 6300 S… |
CVE-2021-41001 | High | 8.8 | 2022-03-02 | An authenticated remote code execution vulnerability was discovered in the AOS-CX Network Analytics Engine (NAE) in Aruba CX 6200F Switch Series, Aruba 6300 Sw… |
CVE-2021-41000 | High | 8.8 | 2022-03-02 | Multiple authenticated remote code execution vulnerabilities were discovered in the AOS-CX command line interface in Aruba CX 6200F Switch Series, Aruba 6300 S… |
CVE-2022-23701 | Medium | 5.3 | 2022-02-24 | A potential remote host header injection security vulnerability has been identified in HPE Integrated Lights-Out 4 (iLO 4) firmware version(s): Prior to 2.60… |
CVE-2021-29217 | Medium | 6.1 | 2022-02-24 | A remote URL redirection vulnerability was discovered in HPE OneView Global Dashboard version(s): Prior to 2.5. HPE has provided a software update to resolve t… |
CVE-2021-29216 | Medium | 6.1 | 2022-02-24 | A remote cross-site scripting vulnerability was discovered in HPE OneView Global Dashboard version(s): Prior to 2.5. HPE has provided a software update to reso… |
CVE-2022-25256 | Medium | 6.1 | 2022-02-19 | SAS Web Report Studio 4.4 allows XSS. /SASWebReportStudio/logonAndRender.do has two parameters: saspfs_request_backlabel_list and saspfs_request_backurl_list… |
CVE-2021-29219 | High | 7.8 | 2022-02-04 | A potential local buffer overflow vulnerability has been identified in HPE FlexNetwork 5130 EL Switch Series version: Prior to 5130_EI_7.10.R3507P02. HPE has m… |
CVE-2021-29218 | Medium | 6.7 | 2022-02-04 | A local unquoted search path security vulnerability has been identified in HPE Agentless Management Service for Windows version(s): Prior to 1.44.0.0, 10.96.0… |
CVE-2021-29215 | Critical | 9.8 | 2022-01-18 | A potential security vulnerability in HPE Ezmeral Data Fabric that may allow a remote access restriction bypass in the TEZ MapR ecosystem component was discove… |
CVE-2002-20001 | High | 7.5 | 2021-11-11 | The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigg… |
CVE-2021-29213 | Medium | 6.7 | 2021-11-01 | A potential local bypass of security restrictions vulnerability has been identified in HPE ProLiant DL20 Gen10, HPE ProLiant ML30 Gen10, and HPE ProLiant Micro… |
CVE-2021-26589 | Medium | 6.1 | 2021-10-19 | A potential security vulnerability has been identified in HPE Superdome Flex Servers. The vulnerability could be remotely exploited to allow Cross Site Scripti… |
CVE-2021-26588 | Critical | 9.8 | 2021-10-11 | A potential security vulnerability has been identified in HPE 3PAR StoreServ, HPE Primera Storage and HPE Alletra 9000 Storage array firmware. An unauthenticat… |
CVE-2021-26587 | Medium | 6.5 | 2021-09-27 | A potential DOM-based Cross Site Scripting security vulnerability has been identified in HPE StoreOnce. The vulnerability could be remotely exploited to cause… |
CVE-2021-33895 | High | 8.1 | 2021-06-25 | ETINET BACKBOX E4.09 and H4.09 mismanages password access control. When a user uses the User ID of the process running BBSV to login to the Backbox UI applicat… |
CVE-2021-26585 | Medium | 5.5 | 2021-06-24 | A potential vulnerability has been identified in HPE OneView Global Dashboard release 2.31 which could lead to a local disclosure of privileged information. HP… |
CVE-2021-26581 | Medium | 6.5 | 2021-04-01 | A potential security vulnerability has been identified in HPE Superdome Flex server. A denial of service attack can be remotely exploited leaving hung connecti… |
CVE-2021-26580 | Medium | 6.1 | 2021-04-01 | A potential security vulnerability has been identified in HPE iLO Amplifier Pack. The vulnerability could be remotely exploited to allow Cross-Site Scripting (… |