CVSS: 9.0EPSS: 0%CPEs: 14EXPL: 0CVE-2019-1871 – Cisco Integrated Management Controller Buffer Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2019-1871
A vulnerability in the Import Cisco IMC configuration utility of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to cause a denial of service (DoS) condition and implement arbitrary commands with root privileges on an affected device. The vulnerability is due to improper bounds checking by the import-config process. An attacker could exploit this vulnerability by sending malicious packets to an affected device. When the packets are processed, an exploitable buffer overflow condition may occur. A successful exploit could allow the attacker to implement arbitrary code on the affected device with elevated privileges. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imc-bo • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.0EPSS: 0%CPEs: 28EXPL: 0CVE-2019-1634 – Cisco Integrated Management Controller Command Injection Vulnerability
https://notcve.org/view.php?id=CVE-2019-1634
A vulnerability in the Intelligent Platform Management Interface (IPMI) of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges on the underlying operating system (OS). The vulnerability is due to insufficient input validation of user-supplied commands. An attacker who has administrator privileges and access to the network where the IPMI resides could exploit this vulnerability by submitting crafted input to the affected commands. A successful exploit could allow the attacker to gain root privileges on the affected device. Una vulnerabilidad en la Interfaz de administración de plataforma inteligente (IPMI) de Cisco Integrated Management Controller (IMC) podría permitir que un atacante remoto autenticado inyecte comandos arbitrarios que se ejecutan con privilegios de raíz en el sistema operativo (SO) subyacente. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imc-cmdinject-1634 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 26EXPL: 0CVE-2019-1850 – Cisco Integrated Management Controller Command Injection Vulnerability
https://notcve.org/view.php?id=CVE-2019-1850
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges on an affected device. An attacker would need to have valid administrator credentials on the device. The vulnerability is due to insufficient validation of user-supplied input by the affected software. An attacker with elevated privileges could exploit this vulnerability by sending crafted commands to the administrative web management interface of the affected software. A successful exploit could allow the attacker to inject and execute arbitrary, system-level commands with root privileges on an affected device. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imc-cmdinj-1850 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.0EPSS: 2%CPEs: 8EXPL: 0CVE-2014-3348
https://notcve.org/view.php?id=CVE-2014-3348
The SSH module in the Integrated Management Controller (IMC) before 2.3.1 in Cisco Unified Computing System on E-Series blade servers allows remote attackers to cause a denial of service (IMC hang) via a crafted SSH packet, aka Bug ID CSCuo69206. El módulo SSH en Integrated Management Controller (IMC) anterior a 2.3.1 en Cisco Unified Computing System en los servidores Blade de la serie E permite a atacantes remotos causar una denegación de servicio (cuelgue de IMC) a través de un paquete SSH manipulado, también conocido como Bug ID CSCuo69206. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140908-ucse http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3348 http://tools.cisco.com/security/center/viewAlert.x?alertId=35588 http://www.securityfocus.com/bid/69652 http://www.securitytracker.com/id/1030813 https://exchange.xforce.ibmcloud.com/vulnerabilities/95782 • CWE-20: Improper Input Validation •