CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-1856 – Cisco Prime Collaboration Assurance Cross-Site Scripting Vulnerability
https://notcve.org/view.php?id=CVE-2019-1856
A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance (PCA) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to the insufficient validation of data supplied by external devices to the web-based management interface of an affected PCA device. An attacker in control of devices integrated with an affected PCA device could exploit this vulnerability by using crafted data in certain fields of the controlled devices. A successful exploit could allow the attacker to execute arbitrary script code in the context of the PCA web-based management interface or allow the attacker to access sensitive browser-based information. Una vulnerabilidad en la interfaz de gestión basada en web de Cisco Prime Collaboration Assurance (PCA) podría permitir a un atacante remoto no autenticado realizar un ataque de XSS contra un usuario de la interfaz de gestión basada en web de un dispositivo afectado. • http://www.securityfocus.com/bid/108148 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-pca-xss • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 0%CPEs: 3EXPL: 0CVE-2019-1662 – Cisco Prime Collaboration Assurance Software Unauthenticated Access Vulnerability
https://notcve.org/view.php?id=CVE-2019-1662
A vulnerability in the Quality of Voice Reporting (QOVR) service of Cisco Prime Collaboration Assurance (PCA) Software could allow an unauthenticated, remote attacker to access the system as a valid user. The vulnerability is due to insufficient authentication controls. An attacker could exploit this vulnerability by connecting to the QOVR service with a valid username. A successful exploit could allow the attacker to perform actions with the privileges of the user that is used for access. This vulnerability affects Cisco PCA Software Releases prior to 12.1 SP2. • http://www.securityfocus.com/bid/107096 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-pca-access • CWE-287: Improper Authentication •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-15450 – Cisco Prime Collaboration Assurance File Overwrite Vulnerability
https://notcve.org/view.php?id=CVE-2018-15450
A vulnerability in the web-based UI of Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to overwrite files on the file system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by using a specific UI input field to provide a custom path location. A successful exploit could allow the attacker to overwrite files on the file system. Una vulnerabilidad en la interfaz de usuario web de Cisco Prime Collaboration Assurance podría permitir que un atacante remoto autenticado sobrescriba archivos en el sistema de archivos. • http://www.securityfocus.com/bid/105864 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-pca-overwrite • CWE-20: Improper Input Validation CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-15438 – Cisco Prime Collaboration Assurance Cross-Site Request Forgery Vulnerability
https://notcve.org/view.php?id=CVE-2018-15438
A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to use a web browser to perform arbitrary actions with the privileges of the user on an affected system. Una vulnerabilidad en la interfaz de gestión web de Cisco Prime Collaboration Assurance podría permitir que un atacante remoto sin autenticar lleve a cabo un ataque de Cross-Site Request Forgery (CSRF) y realice acciones arbitrarias en un sistema afectado. • http://www.securityfocus.com/bid/105670 http://www.securitytracker.com/id/1041930 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-cpca-csrf • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-0458 – Cisco Prime Collaboration Assurance Cross-Site Scripting Vulnerability
https://notcve.org/view.php?id=CVE-2018-0458
A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a customized link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information. Una vulnerabilidad en la interfaz de gestión web de Cisco Prime Collaboration Assurance podría permitir que un atacante remoto autenticado lleve a cabo un ataque Cross-Site Scripting (XSS) contra un usuario de dicha interfaz en un dispositivo afectado. • http://www.securityfocus.com/bid/105293 http://www.securitytracker.com/id/1041685 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-pca-xss • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •