CVE-2019-11994

A security vulnerability has been identified in HPE SimpliVity 380 Gen 9, HPE SimpliVity 380 Gen 10, HPE SimpliVity 380 Gen 10 G, HPE SimpliVity 2600 Gen 10, SimpliVity OmniCube, SimpliVity OmniStack for Cisco, SimpliVity OmniStack for Lenovo and SimpliVity OmniStack for Dell nodes. An API is used to execute a command manifest file during upgrade does not correctly prevent directory traversal and so can be used to execute manifest files in arbitrary locations on the node. The API does not require user authentication and is accessible over the management network, resulting in the potential for unauthenticated remote execution of manifest files. For all customers running HPE OmniStack version 3.7.9 and earlier. HPE recommends upgrading the OmniStack software to version 3.7.10 or later, which contains a permanent resolution. Customers and partners who can upgrade to 3.7.10 should upgrade at the earliest convenience. For all customers and partners unable to upgrade their environments to the recommended version 3.7.10, HPE has created a Temporary Workaround https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=mmr_sf-EN_US000061901&withFrame for you to implement. All customer should upgrade to the recommended 3.7.10 or later version at the earliest convenience.

• CWE-22

• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03956en_usVendor Advisory
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03956en_usVendor Advisory

Published

Jan 3, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11989A security vulnerability in HPE IceWall SSO Agent Option and…
• CVE-2019-1199A remote code execution vulnerability exists in Microsoft Ou…
• CVE-2019-11990Security vulnerabilities in HPE UIoT versions 1.6, 1.5, 1.4.…
• CVE-2019-11991HPE has identified a vulnerability in HPE 3PAR Service Proce…
• CVE-2019-11992A security vulnerability in HPE OneView for VMware vCenter 9…6.1
• CVE-2019-11993A security vulnerability has been identified in HPE SimpliVi…7.5
• CVE-2019-11995Security vulnerabilities in HPE UIoT version 1.2.4.2 could a…7.5
• CVE-2019-11996Potential security vulnerabilities have been identified with…9.8
• CVE-2019-11997A potential security vulnerability has been identified in HP…6.1
• CVE-2019-11998HPE Superdome Flex Server is vulnerable to multiple remote v…5.5
• CVE-2019-11999Potential security vulnerabilities have been identified in H…6.9
• CVE-2019-1200A remote code execution vulnerability exists in Microsoft Ou…