CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-1396 – Cisco Application Services Engine Unauthorized Access Vulnerabilities
https://notcve.org/view.php?id=CVE-2021-1396
Multiple vulnerabilities in Cisco Application Services Engine could allow an unauthenticated, remote attacker to gain privileged access to host-level operations or to learn device-specific information, create diagnostic files, and make limited configuration changes. For more information about these vulnerabilities, see the Details section of this advisory. Múltiples vulnerabilidades en Cisco Application Services Engine podrían permitir a un atacante remoto no autenticado conseguir acceso privilegiado a operaciones a nivel de host o aprender información específica del dispositivo, crear archivos de diagnóstico y realizar cambios de configuración limitados. Para más información sobre estas vulnerabilidades, consulte la sección Detalles de este aviso • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-case-mvuln-dYrDPC6w • CWE-306: Missing Authentication for Critical Function •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 0CVE-2021-1393 – Cisco Application Services Engine Unauthorized Access Vulnerabilities
https://notcve.org/view.php?id=CVE-2021-1393
Multiple vulnerabilities in Cisco Application Services Engine could allow an unauthenticated, remote attacker to gain privileged access to host-level operations or to learn device-specific information, create diagnostic files, and make limited configuration changes. For more information about these vulnerabilities, see the Details section of this advisory. Múltiples vulnerabilidades en Cisco Application Services Engine podrían permitir a un atacante remoto no autenticado conseguir acceso privilegiado a operaciones a nivel de host o aprender información específica del dispositivo, crear archivos de diagnóstico y realizar cambios de configuración limitados. Para más información sobre estas vulnerabilidades, consulte la sección Detalles de este aviso • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-case-mvuln-dYrDPC6w • CWE-306: Missing Authentication for Critical Function •
CVSS: 10.0EPSS: 2%CPEs: 2EXPL: 0CVE-2021-1388 – Cisco ACI Multi-Site Orchestrator Application Services Engine Deployment Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2021-1388
A vulnerability in an API endpoint of Cisco ACI Multi-Site Orchestrator (MSO) installed on the Application Services Engine could allow an unauthenticated, remote attacker to bypass authentication on an affected device. The vulnerability is due to improper token validation on a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted request to the affected API. A successful exploit could allow the attacker to receive a token with administrator-level privileges that could be used to authenticate to the API on affected MSO and managed Cisco Application Policy Infrastructure Controller (APIC) devices. Una vulnerabilidad en un endpoint de la API de Cisco ACI Multi-Site Orchestrator (MSO) instalado en Application Services Engine, podría permitir a un atacante remoto no autenticado omitir la autenticación en un dispositivo afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-mso-authbyp-bb5GmBQv • CWE-269: Improper Privilege Management •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-3335 – Cisco Application Services Engine Software Authorization Vulnerability
https://notcve.org/view.php?id=CVE-2020-3335
A vulnerability in the key store of Cisco Application Services Engine Software could allow an authenticated, local attacker to read sensitive information of other users on an affected device. The vulnerability is due to insufficient authorization limitations. An attacker could exploit this vulnerability by logging in to an affected device locally with valid credentials. A successful exploit could allow the attacker to read the sensitive information of other users on the affected device. Una vulnerabilidad en el almacén de claves de Cisco Application Services Engine Software, podría permitir a un atacante local autenticado leer información confidencial de otros usuarios sobre un dispositivo afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-APIC-KSV-3wzbHYT4 • CWE-306: Missing Authentication for Critical Function CWE-863: Incorrect Authorization •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-3333 – Cisco Application Services Engine Software Unauthenticated Event Policies Update Vulnerability
https://notcve.org/view.php?id=CVE-2020-3333
A vulnerability in the API of Cisco Application Services Engine Software could allow an unauthenticated, remote attacker to update event policies on an affected device. The vulnerability is due to insufficient authentication of users who modify policies on an affected device. An attacker could exploit this vulnerability by crafting a malicious HTTP request to contact an affected device. A successful exploit could allow the attacker to update event policies on the affected device. Una vulnerabilidad en la API de Cisco Application Services Engine Software, podría permitir a un atacante remoto no autenticado actualizar las políticas de eventos sobre un dispositivo afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-APIC-EPU-F8y5kUOP • CWE-306: Missing Authentication for Critical Function •