CVE-2026-0209 | | | 2026-04-14 | Under certain administrative conditions, FlashArray Purity may apply snapshot retention policies earlier or later than configured. |
CVE-2026-0207 | | | 2026-04-14 | A vulnerability exists in FlashBlade whereby sensitive information may be logged under specific conditions. |
CVE-2025-9127 | Medium | 5.5 | 2025-12-04 | A vulnerability exists in PX Enterprise whereby sensitive information may be logged under specific conditions. |
CVE-2024-3057 | Critical | 9.8 | 2024-10-08 | A flaw exists whereby a user can make a specific call to a FlashArray endpoint allowing privilege escalation. |
CVE-2024-0005 | Critical | 9.1 | 2024-09-23 | A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a specifically crafted SNMP c… |
CVE-2024-0004 | Critical | 9.1 | 2024-09-23 | A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array. |
CVE-2024-0003 | Critical | 9.1 | 2024-09-23 | A condition exists in FlashArray Purity whereby a malicious user could use a remote administrative service to create an account on the array allowing privilege… |
CVE-2024-0002 | Critical | 10.0 | 2024-09-23 | A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing remote access to the array. |
CVE-2024-0001 | Critical | 10.0 | 2024-09-23 | A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active potentially allowing a malicious actor… |
CVE-2023-4976 | | | 2024-07-17 | A flaw exists in FlashBlade whereby a local account is permitted to authenticate to the management interface using an unintended method that allows an attacker… |
CVE-2023-36628 | High | 8.8 | 2023-10-03 | A flaw exists in VASA which allows users with access to a vSphere/ESXi VMware admin on a FlashArray to gain root access through privilege escalation.
|
CVE-2023-32572 | Medium | 6.5 | 2023-10-03 | A flaw exists in FlashArray Purity wherein under limited circumstances, an array administrator can alter the retention lock of a pgroup and disable pgroup Safe… |
CVE-2023-28373 | Medium | 4.4 | 2023-10-03 | A flaw exists in FlashArray Purity whereby an array administrator by configuring an external key manager can affect the availability of data on the system incl… |
CVE-2023-36627 | High | 7.7 | 2023-10-02 | A flaw exists in FlashBlade Purity whereby a user with access to an administrative account on a FlashBlade that is configured with timezone-dependent snapshot… |
CVE-2023-31042 | High | 7.7 | 2023-10-02 | A flaw exists in FlashBlade Purity whereby an authenticated user with access to FlashBlade’s object store protocol can impact the availability of the system’s… |
CVE-2023-28372 | Medium | 6.5 | 2023-10-02 | A flaw exists in FlashBlade Purity (OE) Version 4.1.0 whereby a user with privileges to extend an object’s retention period can affect the availability of the… |
CVE-2022-31524 | Critical | 9.3 | 2022-07-11 | The PureStorage-OpenConnect/swagger repository through 1.1.5 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-32554 | Critical | 9.8 | 2022-06-23 | Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure… |
CVE-2022-32553 | High | 8.8 | 2022-06-23 | Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure… |
CVE-2022-32552 | High | 8.8 | 2022-06-23 | Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure… |
CVE-2017-7352 | Medium | 5.4 | 2017-10-11 | Stored Cross-site scripting (XSS) vulnerability in Pure Storage Purity 4.7.5 allows remote authenticated users to inject arbitrary web script or HTML via the "… |