HighCVSS 8.5
EPSS 0.39%
A vulnerability exists in FlashBlade whereby sensitive information may be logged under specific conditions.
Vendor
PureStorage vulnerabilities
21 published CVES affecting PureStorage, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 21
- Critical
- 6
- High
- 8
- Medium
- 4
- Low
- 3
- Unscored
- 0
- CISA KEV
- 0
Products
Latest PureStorage CVEs
Newest publication first
-
-
MediumCVSS 6.9 EPSS 0.39%
Under certain administrative conditions, FlashArray Purity may apply snapshot retention policies earlier or later than configured.
-
HighCVSS 8.4 EPSS 0.14%
A vulnerability exists in PX Enterprise whereby sensitive information may be logged under specific conditions.
-
CriticalCVSS 9.8 EPSS 0.42%
A flaw exists whereby a user can make a specific call to a FlashArray endpoint allowing privilege escalation.
-
HighCVSS 8.8 EPSS 0.63%
A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a specifically crafted SNMP configuration.
-
HighCVSS 7.2 EPSS 0.64%
A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array.
-
HighCVSS 7.2 EPSS 0.47%
A condition exists in FlashArray Purity whereby a malicious user could use a remote administrative service to create an account on the array allowing privileged access.
-
CriticalCVSS 9.8 EPSS 0.60%
A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing remote access to the array.
-
CriticalCVSS 9.8 EPSS 0.95%
A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active potentially allowing a malicious actor to gain elevated privileges.
-
CriticalCVSS 9.3 EPSS 0.38%
A flaw exists in FlashBlade whereby a local account is permitted to authenticate to the management interface using an unintended method that allows an attacker to gain privileged access to the array.
-
HighCVSS 8.8 EPSS 0.56%
A flaw exists in VASA which allows users with access to a vSphere/ESXi VMware admin on a FlashArray to gain root access through privilege escalation.
-
MediumCVSS 4.9 EPSS 0.48%
A flaw exists in FlashArray Purity wherein under limited circumstances, an array administrator can alter the retention lock of a pgroup and disable pgroup SafeMode protection.
-
LowCVSS 2.7 EPSS 0.52%
A flaw exists in FlashArray Purity whereby an array administrator by configuring an external key manager can affect the availability of data on the system including snapshots protected by SafeMode.
-
LowCVSS 2.7 EPSS 0.59%
A flaw exists in FlashBlade Purity whereby a user with access to an administrative account on a FlashBlade that is configured with timezone-dependent snapshot schedules can configure a timezone to prevent the schedule from functioning properly.
-
MediumCVSS 4.3 EPSS 0.60%
A flaw exists in FlashBlade Purity whereby an authenticated user with access to FlashBlade’s object store protocol can impact the availability of the system’s data access and replication protocols.
-
LowCVSS 2.7 EPSS 0.55%
A flaw exists in FlashBlade Purity (OE) Version 4.1.0 whereby a user with privileges to extend an object’s retention period can affect the availability of the object lock.
-
CriticalCVSS 9.3 EPSS 1.3%
The PureStorage-OpenConnect/swagger repository through 1.1.5 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
-
CriticalCVSS 9.8 EPSS 1.4%
Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure Storage FlashBlade products running Purity//FB 3.3.0, 3.2.0 - 3.2.4, 3.1.0 - 3.1.12, 3.0.x and prior Purity//FB releases...
-
HighCVSS 8.8 EPSS 1.2%
Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure Storage FlashBlade products running Purity//FB 3.3.0, 3.2.0 - 3.2.4, 3.1.0 - 3.1.12, 3.0.x and prior Purity//FB releases...
-
HighCVSS 8.8 EPSS 1.2%
Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure Storage FlashBlade products running Purity//FB 3.3.0, 3.2.0 - 3.2.4, 3.1.0 - 3.1.12, 3.0.x and prior Purity//FB releases...
-
MediumCVSS 5.4 EPSS 0.60%
Stored Cross-site scripting (XSS) vulnerability in Pure Storage Purity 4.7.5 allows remote authenticated users to inject arbitrary web script or HTML via the "host" parameter on the 'System > Configuration > SNMP > Add SNMP Trap Manager' screen.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.