First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-37095

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A directory traversal information disclosure vulnerability exists in HPE StoreOnce Software.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Hewlett Packard Enterprise (HPE)	HPE StoreOnce Software	< 4.3.11

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbst04847en_us&docLocale=en_USVendor Advisory

Timeline

Published: Jun 2, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-370969.8A command injection remote code execution vulnerability exists in HPE StoreOnce Software.CVE-2025-370977.5A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of service CVE-2025-370987.5A path traversal vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646.CVE-2025-370999.8A remote code execution vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646.CVE-2025-37109.8The LCD KVM over IP Switch CL5708IM has a Stack-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthe CVE-2025-371007.7A vulnerability in the APIs of HPE Aruba Networking Private 5G Core could potentially expose sensitive information to unauthorized users. A CVE-2025-371018.7A potential security vulnerability has been identified in HPE OneView for VMware vCenter (OV4VC). This vulnerability could be exploited allo CVE-2025-371027.2An authenticated command injection vulnerability exists in the Command line interface of HPE Networking Instant On Access Points. A succe CVE-2025-371039.8Hard-coded login credentials were found in HPE Networking Instant On Access Points, allowing anyone with knowledge of it to bypass normal CVE-2025-371047.1A security vulnerability has been identified in HPE Telco Service Orchestrator software. The vulnerability could allow authenticated clients CVE-2025-371059.8An hsqldb-related remote code execution vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18.CVE-2025-371069.8An authentication bypass and disclosure of information vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18.

CVE-2025-37095: Critical severity, CVSS 9.8 | Vulnix