CVSS: 10.0EPSS: 97%CPEs: 21EXPL: 2CVE-2013-5486 – Cisco Data Center Network Manager fileUploadServlet Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2013-5486
Directory traversal vulnerability in processImageSave.jsp in DCNM-SAN Server in Cisco Prime Data Center Network Manager (DCNM) before 6.2(1) allows remote attackers to write arbitrary files via the chartid parameter, aka Bug IDs CSCue77035 and CSCue77036. NOTE: this can be leveraged to execute arbitrary commands by using the JBoss autodeploy functionality. Vulnerabilidad de salto de directorio en processImageSave.jsp en DCNM-SAN Server en Cisco Prime Data Center Network Manager (DCNM) en versiones anteriores a 6.2(1) permite a atacantes remotos escribir archivos arbitrarios a través del parámetro chartid, vulnerabilidad también conocida como Bug IDs CSCue77035 y CSCue77036. NOTA: Ésto puede ser aprovechado para ejecutar comandos arbitrarios usando la funcionalidad de despliegue automático JBoss. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Cisco Data Center Network Manager. • https://www.exploit-db.com/exploits/30008 http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130918-dcnm http://www.exploit-db.com/exploits/30008 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.8EPSS: 92%CPEs: 21EXPL: 0CVE-2013-5487 – Cisco Data Center Network Manager downloadServlet Remote Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2013-5487
DCNM-SAN Server in Cisco Prime Data Center Network Manager (DCNM) before 6.2(1) allows remote attackers to read arbitrary files via unspecified vectors, aka Bug ID CSCue77029. DCNM-SAN Server en Cisco Prime Data Center Network Manager (DCNM) anteriores a 6.2(1) permite a atacantes remotos leer ficheros arbitrarios a través de vectores no especificados, también conocido como Bug ID CSCue77029. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Cisco Data Center Network Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DownloadServlet. Without prior authentication, an attacker could invoke the DownloadServlet to disclose an arbitrary file from the file system. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130918-dcnm • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.8EPSS: 0%CPEs: 11EXPL: 0CVE-2013-1196
https://notcve.org/view.php?id=CVE-2013-1196
The command-line interface in Cisco Secure Access Control System (ACS), Identity Services Engine Software, Context Directory Agent, Application Networking Manager (ANM), Prime Network Control System, Prime LAN Management Solution (LMS), Prime Collaboration, Unified Provisioning Manager, Network Services Manager, Prime Data Center Network Manager (DCNM), and Quad does not properly validate input, which allows local users to obtain root privileges via unspecified vectors, aka Bug IDs CSCug29384, CSCug13866, CSCug29400, CSCug29406, CSCug29411, CSCug29413, CSCug29416, CSCug29418, CSCug29422, CSCug29425, and CSCug29426, a different issue than CVE-2013-1125. La interfaz de línea de comandos en el sistema Cisco Secure Access Control (ACS), Servicios de Identidad del motor de software, Agente de Directorio Contexto, Gerente de Redes de Aplicaciones (ANM), Sistema de Control de Red Prime, LAN Management Solution Prime (LMS), Prime Collaboration, Provisioning Manager Unificado , Network Services Manager, el primer Data Center Network Manager (DCNM) y Quad no validan correctamente la entrada, lo que permite a usuarios locales obtener privilegios de root a través de vectores no especificados. Vulnerabilidad también conocida como Bug ID CSCug29384, CSCug13866, CSCug29400, CSCug29406, CSCug29411, CSCug29413, CSCug29416 , CSCug29418, CSCug29422, CSCug29425 y CSCug29426. Se trata de una cuestión diferente que CVE-2013-1125. • http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1196 • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 0%CPEs: 18EXPL: 0CVE-2012-5417
https://notcve.org/view.php?id=CVE-2012-5417
Cisco Prime Data Center Network Manager (DCNM) before 6.1(1) does not properly restrict access to certain JBoss MainDeployer functionality, which allows remote attackers to execute arbitrary commands via JBoss Application Server Remote Method Invocation (RMI) services, aka Bug ID CSCtz44924. Cisco Prime Data Center Network Manager (DCNM) antes de v6.1(1) no restrige correctamente el acceso a ciertas funcionalidades de JBoss MainDeployer, lo que permite a atacantes remotos ejecutar código arbitrario a través de servicios JBoss Application Server Remote Method Invocation (RMI), también conocido como Bug ID CSCtz44924. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20121031-dcnm http://www.securityfocus.com/bid/56348 http://www.securitytracker.com/id?1027712 • CWE-264: Permissions, Privileges, and Access Controls •