CVSS: 10.0EPSS: 58%CPEs: 1EXPL: 2CVE-2019-15975 – Cisco Data Center Network Manager Authentication Bypass Vulnerabilities
https://notcve.org/view.php?id=CVE-2019-15975
Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. Múltiples vulnerabilidades en los mecanismos de autenticación de Cisco Data Center Network Manager (DCNM), podrían permitir a un atacante remoto no autenticado omitir la autenticación y ejecutar acciones arbitrarias con privilegios administrativos sobre un dispositivo afectado. Para más información sobre estas vulnerabilidades, véase la sección Detalles de este aviso. This vulnerability allows remote attackers to bypass authentication on affected installations of Cisco Data Center Network Manager. The specific flaw exists within the processing of the dbadmin/addUser functionality. • https://www.exploit-db.com/exploits/48018 http://packetstormsecurity.com/files/156238/Cisco-Data-Center-Network-Manager-11.2-Remote-Code-Execution.html https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200102-dcnm-auth-bypass • CWE-798: Use of Hard-coded Credentials •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2018-0440 – Cisco Data Center Network Manager Privilege Escalation to Underlying Operating System Vulnerability
https://notcve.org/view.php?id=CVE-2018-0440
A vulnerability in the web interface of Cisco Data Center Network Manager could allow an authenticated application administrator to execute commands on the underlying operating system with root-level privileges. The vulnerability is due to incomplete input validation of user input within an HTTP request. An attacker could exploit this vulnerability by authenticating to the application and then sending a crafted HTTP request to the targeted application. A successful exploit could allow the authenticated attacker to issue commands on the underlying operating system as the root user. Una vulnerabilidad en la interfaz web de Cisco Data Center Network Manager podría permitir que un administrador de la aplicación autenticado ejecute comandos en el sistema operativo subyacente con privilegios a nivel de root. • http://www.securitytracker.com/id/1041682 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-cdcnm-escalation • CWE-20: Improper Input Validation CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-12343
https://notcve.org/view.php?id=CVE-2017-12343
Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) Software could allow a remote attacker to inject arbitrary values into DCNM configuration parameters, redirect a user to a malicious website, inject malicious content into a DCNM client interface, or conduct a cross-site scripting (XSS) attack against a user of the affected software. Cisco Bug IDs: CSCvf40477, CSCvf63150, CSCvf68218, CSCvf68235, CSCvf68247. Múltiples vulnerabilidades en el software Data Center Network Manager (DCNM) de Cisco podrían permitir que un atacante remoto inyecte valores arbitrarios en los parámetros de configuración de DCNM, redirija un usuario a una página web maliciosa, inyecte contenido malicioso en una interfaz de cliente de DCNM o realice un ataque Cross-Site Scripting (XSS) contra un usuario del software afectado. Cisco Bug IDs: CSCvf40477, CSCvf63150, CSCvf68218, CSCvf68235, CSCvf68247. • http://www.securityfocus.com/bid/101996 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-dcnm • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •