There is a remote escalation of privilege possible for a malicious user that has a OneView account in OneView and Synergy Composer

HPE OneView may allow command injection with local privilege escalation

An HPE OneView appliance dump may expose SAN switch administrative credentials

A local authentication restriction bypass vulnerability was discovered in HPE OneView version(s): Prior to 6.6

HPE OneView may allow clusterService Authentication Bypass resulting in denial of service

A remote unauthenticated disclosure of information vulnerability was discovered in HPE OneView version(s): Prior to 6.6

An HPE OneView appliance dump may expose FTP credentials for c7000 Interconnect Modules