CVSS: 10.0EPSS: 58%CPEs: 1EXPL: 2CVE-2019-15975 – Cisco Data Center Network Manager Authentication Bypass Vulnerabilities
https://notcve.org/view.php?id=CVE-2019-15975
Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. Múltiples vulnerabilidades en los mecanismos de autenticación de Cisco Data Center Network Manager (DCNM), podrían permitir a un atacante remoto no autenticado omitir la autenticación y ejecutar acciones arbitrarias con privilegios administrativos sobre un dispositivo afectado. Para más información sobre estas vulnerabilidades, véase la sección Detalles de este aviso. This vulnerability allows remote attackers to bypass authentication on affected installations of Cisco Data Center Network Manager. The specific flaw exists within the processing of the dbadmin/addUser functionality. • https://www.exploit-db.com/exploits/48018 http://packetstormsecurity.com/files/156238/Cisco-Data-Center-Network-Manager-11.2-Remote-Code-Execution.html https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200102-dcnm-auth-bypass • CWE-798: Use of Hard-coded Credentials •
CVSS: 8.1EPSS: 1%CPEs: 9EXPL: 1CVE-2018-0464 – Cisco Data Center Network Manager Path Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2018-0464
A vulnerability in Cisco Data Center Network Manager software could allow an authenticated, remote attacker to conduct directory traversal attacks and gain access to sensitive files on the targeted system. The vulnerability is due to improper validation of user requests within the management interface. An attacker could exploit this vulnerability by sending malicious requests containing directory traversal character sequences within the management interface. An exploit could allow the attacker to view or create arbitrary files on the targeted system. Una vulnerabilidad en el software Cisco Data Center Network Manager podría permitir a un atacante remoto autenticado llevar a cabo ataques de salto de directorio y obtener acceso a archivos sensibles en el sistema objetivo. • http://www.securityfocus.com/bid/105159 http://www.securitytracker.com/id/1041585 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180828-dcnm-traversal https://www.tenable.com/security/research/tra-2018-20 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2018-0440 – Cisco Data Center Network Manager Privilege Escalation to Underlying Operating System Vulnerability
https://notcve.org/view.php?id=CVE-2018-0440
A vulnerability in the web interface of Cisco Data Center Network Manager could allow an authenticated application administrator to execute commands on the underlying operating system with root-level privileges. The vulnerability is due to incomplete input validation of user input within an HTTP request. An attacker could exploit this vulnerability by authenticating to the application and then sending a crafted HTTP request to the targeted application. A successful exploit could allow the authenticated attacker to issue commands on the underlying operating system as the root user. Una vulnerabilidad en la interfaz web de Cisco Data Center Network Manager podría permitir que un administrador de la aplicación autenticado ejecute comandos en el sistema operativo subyacente con privilegios a nivel de root. • http://www.securitytracker.com/id/1041682 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-cdcnm-escalation • CWE-20: Improper Input Validation CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 0CVE-2018-0258
https://notcve.org/view.php?id=CVE-2018-0258
A vulnerability in the Cisco Prime File Upload servlet affecting multiple Cisco products could allow a remote attacker to upload arbitrary files to any directory of a vulnerable device (aka Path Traversal) and execute those files. This vulnerability affects the following products: Cisco Prime Data Center Network Manager (DCNM) Version 10.0 and later, and Cisco Prime Infrastructure (PI) All versions. Cisco Bug IDs: CSCvf32411, CSCvf81727. Una vulnerabilidad en el servlet Cisco Prime File Upload que afecta a múltiples productos Cisco podría permitir que un atacante remoto suba archivos arbitrarios a cualquier directorio de un dispositivo vulnerable (también conocido como salto de directorio) y los ejecute. Esta vulnerabilidad afecta a los siguientes productos: Cisco Prime Data Center Network Manager (DCNM) en su versión 10.0 y siguientes y Cisco Prime Infrastructure (PI) en todas las versiones. • http://www.securityfocus.com/bid/104074 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-prime-upload https://www.tenable.com/security/research/tra-2018-11 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-12346
https://notcve.org/view.php?id=CVE-2017-12346
Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) Software could allow a remote attacker to inject arbitrary values into DCNM configuration parameters, redirect a user to a malicious website, inject malicious content into a DCNM client interface, or conduct a cross-site scripting (XSS) attack against a user of the affected software. Cisco Bug IDs: CSCvf40477, CSCvf63150, CSCvf68218, CSCvf68235, CSCvf68247. Múltiples vulnerabilidades en el software Data Center Network Manager (DCNM) de Cisco podrían permitir que un atacante remoto inyecte valores arbitrarios en los parámetros de configuración de DCNM, redirija un usuario a una página web maliciosa, inyecte contenido malicioso en una interfaz de cliente de DCNM o realice un ataque Cross-Site Scripting (XSS) contra un usuario del software afectado. Cisco Bug IDs: CSCvf40477, CSCvf63150, CSCvf68218, CSCvf68235, CSCvf68247. • http://www.securityfocus.com/bid/101996 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-dcnm • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •