VulnerabilitycriticalExploited in the wild

HPE Issues Security Patch for StoreOnce Bug Allowing Remote Authentication Bypass

The Hacker Newsby @TheHackersNewsJun 4, 2025 · 05:23 UTC (Jun 4, 2025)2 min read4

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2025-37093 CVE-2025-37089 CVE-2025-37090 CVE-2025-37091 CVE-2025-37092 CVE-2025-37094 CVE-2025-37095 CVE-2025-37096 CVE-2025-31651 CVE-2024-38475 CVE-2024-38476

Tags: cve-2025-37093 cve-2025-37089 cve-2025-37090 cve-2025-37091 cve-2025-37092 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2024-38475 +1 related CVE CVE-2024-38476	Improper Output Escaping in Apache HTTP Server mod_rewrite Enables File Disclosure/Code Execution	9.1 group max	100%	KEV	Jul 1, 2024 KEV May 1, 2025
CVE-2025-31651	Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat	9.8	4%		Apr 28, 2025
CVE-2025-37091 +7 related CVEs CVE-2025-37093 CVE-2025-37094 CVE-2025-37089 CVE-2025-37092 CVE-2025-37096 CVE-2025-37090 CVE-2025-37095	A command injection remote code execution vulnerability exists in HPE StoreOnce Software	9.8 group max	1%		Jun 2, 2025

From the original article

2 min read at thehackernews.com

Hewlett Packard Enterprise (HPE) has released security updates to address as many as eight vulnerabilities in its StoreOnce data backup and deduplication solution that could result in an authentication bypass and remote code execution.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.