Hp Airwave vulnerabilities

CVE-2015-2202 [HIGH] CWE-20 CVE-2015-2202: Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows administrative users to escalate privilege Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows administrative users to escalate privileges to root on the underlying OS.

CVE-2015-2201 [HIGH] CWE-78 CVE-2015-2201: Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows VisualRF remote OS command execution and f Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows VisualRF remote OS command execution and file disclosure by administrative users.

CVE-2015-1391 [HIGH] CWE-352 CVE-2015-1391: Aruba AirWave before 8.0.7 allows bypass of a CSRF protection mechanism. Aruba AirWave before 8.0.7 allows bypass of a CSRF protection mechanism.

CVE-2015-1390 [MEDIUM] CWE-79 CVE-2015-1390: Aruba AirWave before 8.0.7 allows XSS attacks agsinat an administrator. Aruba AirWave before 8.0.7 allows XSS attacks agsinat an administrator.

CVE-2016-8526 [HIGH] CWE-611 CVE-2016-8526: Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to an XML external entiti Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to an XML external entities (XXE). XXEs are a way to permit XML parsers to access storage that exist on external systems. If an unprivileged user is permitted to control the contents of XML files, XXE can be used as an attack vector. Because the XML parser has access to the local

CVE-2016-8527 [MEDIUM] CWE-79 CVE-2016-8527: Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site scripting (XSS). The vulnerability is present in the VisualRF component of AirWave. By exploiting this vulnerability, an attacker who can trick a logged-in AirWave administrative user into clicking a link could obtain sensitive information, such as sess