CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-6611
https://notcve.org/view.php?id=CVE-2017-6611
A vulnerability in the web framework code of Cisco Prime Infrastructure 2.2(2) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of the affected system. The vulnerability is due to insufficient input validation of some parameters passed to the web server. An attacker could exploit this vulnerability by convincing the user to access a malicious link or by intercepting the user request and injecting the malicious code. An exploit could allow the attacker to execute arbitrary script code in the context of the affected site or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCuw65830. • http://www.securityfocus.com/bid/97931 http://www.securitytracker.com/id/1038330 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-cpi • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 9EXPL: 0CVE-2017-3884
https://notcve.org/view.php?id=CVE-2017-3884
A vulnerability in the web interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to access sensitive data. The attacker does not need administrator credentials and could use this information to conduct additional reconnaissance attacks. More Information: CSCvc60031 (Fixed) CSCvc60041 (Fixed) CSCvc60095 (Open) CSCvc60102 (Open). Known Affected Releases: 2.2 2.2(3) 3.0 3.1(0.0) 3.1(0.128) 3.1(4.0) 3.1(5.0) 3.2(0.0) 2.0(4.0.45D). Una vulnerabilidad en la interfaz web de Cisco Prime Infrastructure y del administrador Evolved Programmable Network de Cisco (EPN) podría permitir a un atacante remoto autenticado acceder a datos confidenciales. • http://www.securityfocus.com/bid/97470 http://www.securitytracker.com/id/1038189 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-cpi • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2017-3848
https://notcve.org/view.php?id=CVE-2017-3848
A vulnerability in the HTTP web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of the affected system. More Information: CSCuw63001 CSCuw63003. Known Affected Releases: 2.2(2). Known Fixed Releases: 3.1(0.0). Una vulnerabilidad en la interfaz de administración basada en web HTTP de Cisco Prime Infrastructure podría permitir que un atacante remoto no autenticado lleve a cabo un ataque XSS contra un usuario de la interfaz web del sistema afectado. • http://www.securityfocus.com/bid/96505 http://www.securitytracker.com/id/1037947 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170301-cpi • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-3869
https://notcve.org/view.php?id=CVE-2017-3869
An API Credentials Management vulnerability in the APIs for Cisco Prime Infrastructure could allow an authenticated, remote attacker to access an API that should be restricted to a privileged user. The attacker needs to have valid credentials. More Information: CSCuy36192. Known Affected Releases: 3.1(1) 3.1(1). Una vulnerabilidad de API Credentials Management en las API de Cisco Prime Infrastructure podría permitir a un atacante remoto autenticado acceder a una API que debería estar restringida a un usuario privilegiado. • http://www.securityfocus.com/bid/96931 http://www.securitytracker.com/id/1038048 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-cpi •
CVSS: 8.8EPSS: 0%CPEs: 18EXPL: 0CVE-2016-6443
https://notcve.org/view.php?id=CVE-2016-6443
A vulnerability in the Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL database interface could allow an authenticated, remote attacker to impact system confidentiality by executing a subset of arbitrary SQL queries that can cause product instability. More Information: CSCva27038, CSCva28335. Known Affected Releases: 3.1(0.128), 1.2(400), 2.0(1.0.34A). Una vulnerabilidad en Cisco Prime Infrastructure y en la interfaz de la base de datos SQL de Evolved Programmable Network Manager podría permitir a un atacante remoto autenticado impactar la confidencialidad del sistema ejecutando un subconjunto de consultas SQL arbitrarias que pueden provocar inestabilidad en el producto. Más información: CSCva27038, CSCva28335. • http://www.securityfocus.com/bid/93522 http://www.securitytracker.com/id/1037006 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161012-prime • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •