CVE-2016-8527

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site scripting (XSS). The vulnerability is present in the VisualRF component of AirWave. By exploiting this vulnerability, an attacker who can trick a logged-in AirWave administrative user into clicking a link could obtain sensitive information, such as session cookies or passwords. The vulnerability requires that an administrative users click on the malicious link while currently logged into AirWave in the same browser.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Aug 6, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-85288.8A Remote Escalation of Privilege vulnerability in HPE Helion Eucalyptus version 3.3.0 through 4.3.1 was found.CVE-2016-85297.6A Remote Arbitrary Command Execution vulnerability in HPE StoreVirtual 4000 Storage and StoreVirtual VSA Software running LeftHand OS versioCVE-2016-85307.5A remote denial of service vulnerability in HPE iMC PLAT version v7.2 E0403P06 and earlier was found. The problem was resolved in iMC PLAT 7CVE-2016-85315.3A remote information disclosure vulnerability in HPE Matrix Operating Environment version 7.6 was found.CVE-2016-85325.4A cross site scripting vulnerability in HPE Matrix Operating Environment version 7.6 was found.CVE-2016-85338.8A remote priviledge escalation vulnerability in HPE Matrix Operating Environment version 7.6 was found.CVE-2016-85348.8A remote privilege elevation vulnerability in HPE Matrix Operating Environment version 7.6 was found.CVE-2016-85353.5A remote HTTP parameter Pollution vulnerability in HPE Matrix Operating Environment version 7.6 was found.CVE-2016-85616.6A vulnerability has been identified in SIMATIC CP 1543-1 (All versions < V2.0.28), SIPLUS NET CP 1543-1 (All versions < V2.0.28). Users withCVE-2016-85627.5A vulnerability has been identified in SIMATIC CP 1543-1 (All versions < V2.0.28), SIPLUS NET CP 1543-1 (All versions < V2.0.28). Under specCVE-2016-85637.5Siemens Automation License Manager (ALM) before 5.3 SP3 Update 1 allows remote attackers to cause a denial of service (ALM service outage) vCVE-2016-85646.5SQL injection vulnerability in Siemens Automation License Manager (ALM) before 5.3 SP3 Update 1 allows remote attackers to execute arbitrary
CVE-2016-8527: Medium severity, CVSS 6.1 | Vulnix