CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2011-4237
https://notcve.org/view.php?id=CVE-2011-4237
CRLF injection vulnerability in autologin.jsp in Cisco CiscoWorks Common Services 4.0, as used in Cisco Prime LAN Management Solution and other products, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the URL parameter, aka Bug ID CSCtu18693. Vulnerabilidad de inyección CRLF en autologin.jsp en Cisco CiscoWorks Common Services v4.0, tal como se utiliza en Cisco Prime LAN Management Solution y otros productos, permite a atacantes remotos inyectar cabeceras HTTP de su elección y llevar a cabo ataques de división de respuesta HTTP a través del parámetro URL, ID de error conocido CSCtu18693. • http://secunia.com/advisories/49094 http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_lan_management_solution/4.2/release/notes/lms42rel.html http://www.nessus.org/plugins/index.php?view=single&id=58950 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.0EPSS: 0%CPEs: 10EXPL: 0CVE-2011-2042
https://notcve.org/view.php?id=CVE-2011-2042
The Sybase SQL Anywhere database component in Cisco CiscoWorks Common Services 3.x and 4.x before 4.1 allows remote attackers to obtain potentially sensitive information about the engine name and database port via an unspecified request to UDP port 2638, aka Bug ID CSCsk35018. El componente de base de datos Sybase SQL Anywhere de Cisco CiscoWorks Common Services v3.x y v4.x anterior a v4.1 permite a atacantes remotos obtener información potencialmente sensible acerca del nombre del motor y el puerto de la base de datos a través de una petición no especificada para el puerto UDP 2638, también conocido como Bug ID CSCsk35018. • http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_common_services_software/3.3/release/notes/cs33rel.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.0EPSS: 0%CPEs: 9EXPL: 0CVE-2011-3310
https://notcve.org/view.php?id=CVE-2011-3310
The Home Page component in Cisco CiscoWorks Common Services before 4.1 on Windows, as used in CiscoWorks LAN Management Solution, Cisco Security Manager, Cisco Unified Service Monitor, Cisco Unified Operations Manager, CiscoWorks QoS Policy Manager, and CiscoWorks Voice Manager, allows remote authenticated users to execute arbitrary commands via a crafted URL, aka Bug IDs CSCtq48990, CSCtq63992, CSCtq64011, CSCtq64019, CSCtr23090, and CSCtt25535. El componente de página de inicio ("Home Page") de Cisco CiscoWorks Common Services en versiones anteriores a 4.1 en Windows, tal como se usa en CiscoWorks LAN Management Solution, Cisco Security Manager, Cisco Unified Service Monitor, Cisco Unified Operations Manager, CiscoWorks QoS Policy Manager y CiscoWorks Voice Manager, permite a usuarios autenticados remotos ejecutar comandos arbitrarios a través de una URL modificada. También conocido como Bug IDs CSCtq48990, CSCtq63992, CSCtq64011, CSCtq64019, CSCtr23090 y CSCtt25535. • http://secunia.com/advisories/46533 http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111019-cs http://www.securityfocus.com/bid/50284 https://exchange.xforce.ibmcloud.com/vulnerabilities/70759 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.3EPSS: 5%CPEs: 11EXPL: 6CVE-2011-0961 – CiscoWorks Common Services Framework 3.1.1 Help Servlet - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2011-0961
Cross-site scripting (XSS) vulnerability in cwhp/device.center.do in the Help servlet in Cisco CiscoWorks Common Services 3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the device parameter, aka Bug ID CSCto12704. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en cwhp/device.center.do en el servlet Help en Cisco CiscoWorks Common Services v3.3 y anteriores, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro "device", también conocido cómo Bug ID CSCto12704. Cisco Unified Operations Manager suffers from cross site scripting, remote SQL injection, and directory traversal vulnerabilities. Versions 8.0 and 8.5 are affected. • https://www.exploit-db.com/exploits/35779 https://www.exploit-db.com/exploits/17304 http://archives.neohapsis.com/archives/fulldisclosure/2011-05/0371.html http://tools.cisco.com/security/center/viewAlert.x?alertId=23088 http://www.exploit-db.com/exploits/17304 http://www.securityfocus.com/bid/47902 http://www.senseofsecurity.com.au/advisories/SOS-11-006.pdf https://exchange.xforce.ibmcloud.com/vulnerabilities/67523 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 8%CPEs: 11EXPL: 5CVE-2011-0966 – CiscoWorks Common Services 3.1.1 - Auditing Directory Traversal
https://notcve.org/view.php?id=CVE-2011-0966
Directory traversal vulnerability in cwhp/auditLog.do in the Homepage Auditing component in Cisco CiscoWorks Common Services 3.3 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, aka Bug ID CSCto35577. Vulnerabilidad de salto de directorio en cwhp/auditLog.do en el componente Homepage Auditing en Cisco CiscoWorks Common Services v3.3 y anteriores permite a atacantes remotos leer archivos de su elección a través de un .. (punto punto) en el parámetro de archivo, también conocido como Bug ID CSCto35577. Cisco Unified Operations Manager suffers from cross site scripting, remote SQL injection, and directory traversal vulnerabilities. • https://www.exploit-db.com/exploits/35781 https://www.exploit-db.com/exploits/17304 http://archives.neohapsis.com/archives/fulldisclosure/2011-05/0371.html http://tools.cisco.com/security/center/viewAlert.x?alertId=23089 http://www.exploit-db.com/exploits/17304 http://www.senseofsecurity.com.au/advisories/SOS-11-006.pdf https://exchange.xforce.ibmcloud.com/vulnerabilities/67525 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •