CVSS: 10.0EPSS: 77%CPEs: 10EXPL: 1CVE-2017-6622 – Cisco Prime Collaboration Provisioning ScriptMgr Servlet Authentication Bypass Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-6622
A vulnerability in the web interface for Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to bypass authentication and perform command injection with root privileges. The vulnerability is due to missing security constraints in certain HTTP request methods, which could allow access to files via the web interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to the targeted application. This vulnerability affects Cisco Prime Collaboration Provisioning Software Releases prior to 12.1. Cisco Bug IDs: CSCvc98724. • https://www.exploit-db.com/exploits/42888 http://www.securityfocus.com/bid/98520 http://www.securitytracker.com/id/1038507 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-pcp1 • CWE-264: Permissions, Privileges, and Access Controls CWE-862: Missing Authorization •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2016-1320
https://notcve.org/view.php?id=CVE-2016-1320
The CLI in Cisco Prime Collaboration 9.0 and 11.0 allows local users to execute arbitrary OS commands as root by leveraging administrator privileges, aka Bug ID CSCux69286. El CLI en Cisco Prime Collaboration 9.0 y 11.0 permite a usuarios locales ejecutar comandos SO arbitrarios como root aprovechando privilegios de administrador, también conocida como Bug ID CSCux69286. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160209-pcp https://www.tenable.com/security/research/tra-2016-38 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.0EPSS: 0%CPEs: 6EXPL: 0CVE-2015-4307
https://notcve.org/view.php?id=CVE-2015-4307
The web framework in Cisco Prime Collaboration Provisioning before 11.0 allows remote authenticated users to bypass intended access restrictions and create administrative accounts via a crafted URL, aka Bug ID CSCut64111. Vulnerabilidad en el framework web en Cisco Prime Collaboration Provisioning en versiones anteriores a 11.0, permite a usuarios remotos autenticados eludir las restricciones destinadas al acceso y crear cuentas administrativas a través de una URL manipulada, también conocida como Bug ID CSCut64111. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150916-pcp http://www.securitytracker.com/id/1033579 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.5EPSS: 0%CPEs: 6EXPL: 0CVE-2015-4306
https://notcve.org/view.php?id=CVE-2015-4306
The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended login-session read restrictions, and impersonate administrators of arbitrary tenant domains, by discovering a session identifier and constructing a crafted URL, aka Bug IDs CSCus88343 and CSCus88334. Vulnerabilidad en el framework web en Cisco Prime Collaboration Assurance en versiones anteriores a 10.5.1.53684-1, permite a usuarios remotos autenticados eludir las restricciones de lectura destinadas a la sesión de inicio y hacerse pasar por administradores de dominios arrendados arbitrarios mediante el descubrimiento de un identificador de sesión y la construcción de una URL manipulada, también conocida como Bug IDs CSCus88343 y CSCus88334. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150916-pca http://www.securitytracker.com/id/1033581 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.0EPSS: 0%CPEs: 6EXPL: 0CVE-2015-4305
https://notcve.org/view.php?id=CVE-2015-4305
The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended system-database read restrictions, and discover credentials or SNMP communities for arbitrary tenant domains, via a crafted URL, aka Bug ID CSCus62656. Vulnerabilidad en el framework web en Cisco Prime Collaboration Assurance en versiones anteriores a 10.5.1.53684-1, permite a usuarios remotos autenticados eludir las restricciones de lectura destinadas al sistema de base de datos y descubrir las credenciales o comunidades SNMP para dominios arrendados arbitrarios, a través de una URL manipulada, también conocida como Bug ID CSCus62656. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150916-pca http://tools.cisco.com/security/center/viewAlert.x?alertId=40520 http://www.securitytracker.com/id/1033581 • CWE-264: Permissions, Privileges, and Access Controls •