CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2017-3817
https://notcve.org/view.php?id=CVE-2017-3817
A vulnerability in the role-based resource checking functionality of Cisco Unified Computing System (UCS) Director could allow an authenticated, remote attacker to view unauthorized information for any virtual machine in a UCS domain. More Information: CSCvc32434. Known Affected Releases: 5.5(0.1) 6.0(0.0). Una vulnerabilidad en la funcionalidad de comprobación de recursos basada en roles del Director del Unified Computing System (UCS) de Cisco podría permitir a un atacante remoto autenticado ver información no autorizada para cualquier máquina virtual en un dominio UCS. Más información: CSCvc32434. • http://www.securityfocus.com/bid/97430 http://www.securitytracker.com/id/1038194 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-ucs-director • CWE-863: Incorrect Authorization •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-3868
https://notcve.org/view.php?id=CVE-2017-3868
A vulnerability in the web-based management interface of Cisco UCS Director could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. More Information: CSCvc44344. Known Affected Releases: 6.0(0.0). Una vulnerabilidad en la interfaz de administración basada en web de Cisco UCS Director podría permitir que un atacante remoto no autenticado lleve a cabo un ataque XSS contra un usuario de la interfaz de administración basada en web de un dispositivo afectado. Más información: CSCvc44344. • http://www.securityfocus.com/bid/96921 http://www.securitytracker.com/id/1038039 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-ucs • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2017-3801
https://notcve.org/view.php?id=CVE-2017-3801
A vulnerability in the web-based GUI of Cisco UCS Director 6.0.0.0 and 6.0.0.1 could allow an authenticated, local attacker to execute arbitrary workflow items with just an end-user profile, a Privilege Escalation Vulnerability. The vulnerability is due to improper role-based access control (RBAC) after the Developer Menu is enabled in Cisco UCS Director. An attacker could exploit this vulnerability by enabling Developer Mode for his/her user profile with an end-user profile and then adding new catalogs with arbitrary workflow items to his/her profile. An exploit could allow an attacker to perform any actions defined by these workflow items, including actions affecting other tenants. Cisco Bug IDs: CSCvb64765. • http://www.securityfocus.com/bid/96235 http://www.securitytracker.com/id/1037830 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-ucs • CWE-264: Permissions, Privileges, and Access Controls CWE-863: Incorrect Authorization •