CVSS: 9.1EPSS: 3%CPEs: 6EXPL: 0CVE-2021-1581 – Cisco Application Policy Infrastructure Controller Command Injection and File Upload Vulnerabilities
https://notcve.org/view.php?id=CVE-2021-1581
25 Aug 2021 — Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow a remote attacker to perform a command injection or file upload attack on an affected system. For more information about these vulnerabilities, see the Details section of this advisory. Múltiples vulnerabilidades en la interfaz de usuario web y los endpoints de la API de Cisco Application Policy Infrastructure Controller (APIC) o Cisco Cloud APIC podrían permi... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-capic-mdvul-HBsJBuvW • CWE-284: Improper Access Control •
CVSS: 9.0EPSS: 0%CPEs: 6EXPL: 0CVE-2021-1580 – Cisco Application Policy Infrastructure Controller Command Injection and File Upload Vulnerabilities
https://notcve.org/view.php?id=CVE-2021-1580
25 Aug 2021 — Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow a remote attacker to perform a command injection or file upload attack on an affected system. For more information about these vulnerabilities, see the Details section of this advisory. Múltiples vulnerabilidades en la interfaz de usuario web y los endpoints de la API de Cisco Application Policy Infrastructure Controller (APIC) o Cisco Cloud APIC podrían permi... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-capic-mdvul-HBsJBuvW • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-284: Improper Access Control •
CVSS: 9.0EPSS: 0%CPEs: 6EXPL: 0CVE-2021-1579 – Cisco Application Policy Infrastructure Controller App Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2021-1579
25 Aug 2021 — A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an authenticated, remote attacker with Administrator read-only credentials to elevate privileges on an affected system. This vulnerability is due to an insufficient role-based access control (RBAC). An attacker with Administrator read-only credentials could exploit this vulnerability by sending a specific API request using an ap... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-capic-chvul-CKfGYBh8 • CWE-250: Execution with Unnecessary Privileges CWE-269: Improper Privilege Management •
CVSS: 9.0EPSS: 0%CPEs: 4EXPL: 0CVE-2021-1578 – Cisco Application Policy Infrastructure Controller Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2021-1578
25 Aug 2021 — A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an authenticated, remote attacker to elevate privileges to Administrator on an affected device. This vulnerability is due to an improper policy default setting. An attacker could exploit this vulnerability by using a non-privileged credential for Cisco ACI Multi-Site Orchestrator (MSO) to send a specific API request to a managed... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-capic-pesc-pkmGK4J • CWE-636: Not Failing Securely ('Failing Open') CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 9.1EPSS: 1%CPEs: 6EXPL: 0CVE-2021-1577 – Cisco Application Policy Infrastructure Controller Arbitrary File Read and Write Vulnerability
https://notcve.org/view.php?id=CVE-2021-1577
25 Aug 2021 — A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an unauthenticated, remote attacker to read or write arbitrary files on an affected system. This vulnerability is due to improper access control. An attacker could exploit this vulnerability by using a specific API endpoint to upload a file to an affected device. A successful exploit could allow the attacker to read or write arb... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-capic-frw-Nt3RYxR2 • CWE-284: Improper Access Control •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-1396 – Cisco Application Services Engine Unauthorized Access Vulnerabilities
https://notcve.org/view.php?id=CVE-2021-1396
24 Feb 2021 — Multiple vulnerabilities in Cisco Application Services Engine could allow an unauthenticated, remote attacker to gain privileged access to host-level operations or to learn device-specific information, create diagnostic files, and make limited configuration changes. For more information about these vulnerabilities, see the Details section of this advisory. Múltiples vulnerabilidades en Cisco Application Services Engine podrían permitir a un atacante remoto no autenticado conseguir acceso privilegiado a oper... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-case-mvuln-dYrDPC6w • CWE-306: Missing Authentication for Critical Function •
CVSS: 10.0EPSS: 1%CPEs: 3EXPL: 0CVE-2021-1393 – Cisco Application Services Engine Unauthorized Access Vulnerabilities
https://notcve.org/view.php?id=CVE-2021-1393
24 Feb 2021 — Multiple vulnerabilities in Cisco Application Services Engine could allow an unauthenticated, remote attacker to gain privileged access to host-level operations or to learn device-specific information, create diagnostic files, and make limited configuration changes. For more information about these vulnerabilities, see the Details section of this advisory. Múltiples vulnerabilidades en Cisco Application Services Engine podrían permitir a un atacante remoto no autenticado conseguir acceso privilegiado a oper... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-case-mvuln-dYrDPC6w • CWE-306: Missing Authentication for Critical Function •
CVSS: 10.0EPSS: 2%CPEs: 2EXPL: 0CVE-2021-1388 – Cisco ACI Multi-Site Orchestrator Application Services Engine Deployment Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2021-1388
24 Feb 2021 — A vulnerability in an API endpoint of Cisco ACI Multi-Site Orchestrator (MSO) installed on the Application Services Engine could allow an unauthenticated, remote attacker to bypass authentication on an affected device. The vulnerability is due to improper token validation on a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted request to the affected API. A successful exploit could allow the attacker to receive a token with administrator-level privileges that could be u... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-mso-authbyp-bb5GmBQv • CWE-269: Improper Privilege Management •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-3335 – Cisco Application Services Engine Software Authorization Vulnerability
https://notcve.org/view.php?id=CVE-2020-3335
03 Jun 2020 — A vulnerability in the key store of Cisco Application Services Engine Software could allow an authenticated, local attacker to read sensitive information of other users on an affected device. The vulnerability is due to insufficient authorization limitations. An attacker could exploit this vulnerability by logging in to an affected device locally with valid credentials. A successful exploit could allow the attacker to read the sensitive information of other users on the affected device. Una vulnerabilidad e... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-APIC-KSV-3wzbHYT4 • CWE-306: Missing Authentication for Critical Function CWE-863: Incorrect Authorization •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-3333 – Cisco Application Services Engine Software Unauthenticated Event Policies Update Vulnerability
https://notcve.org/view.php?id=CVE-2020-3333
03 Jun 2020 — A vulnerability in the API of Cisco Application Services Engine Software could allow an unauthenticated, remote attacker to update event policies on an affected device. The vulnerability is due to insufficient authentication of users who modify policies on an affected device. An attacker could exploit this vulnerability by crafting a malicious HTTP request to contact an affected device. A successful exploit could allow the attacker to update event policies on the affected device. Una vulnerabilidad en la AP... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-APIC-EPU-F8y5kUOP • CWE-306: Missing Authentication for Critical Function •