CVSS: 10.0EPSS: 88%CPEs: 1EXPL: 0CVE-2020-27131 – Cisco Security Manager Java Deserialization Vulnerabilities
https://notcve.org/view.php?id=CVE-2020-27131
17 Nov 2020 — Multiple vulnerabilities in the Java deserialization function that is used by Cisco Security Manager could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. These vulnerabilities are due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit these vulnerabilities by sending a malicious serialized Java object to a specific listener on an affected system. A successful exploit could allow the attacker to execute arbi... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csm-java-rce-mWJEedcD • CWE-20: Improper Input Validation CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-27125 – Cisco Security Manager Static Credential Vulnerability
https://notcve.org/view.php?id=CVE-2020-27125
17 Nov 2020 — A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information on an affected system. The vulnerability is due to insufficient protection of static credentials in the affected software. An attacker could exploit this vulnerability by viewing source code. A successful exploit could allow the attacker to view static credentials, which the attacker could use to carry out further attacks. Una vulnerabilidad en Cisco Security Manager podría permitir a un... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csm-rce-8gjUz9fW • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 83%CPEs: 1EXPL: 0CVE-2019-12630 – Cisco Security Manager Java Deserialization Vulnerability
https://notcve.org/view.php?id=CVE-2019-12630
02 Oct 2019 — A vulnerability in the Java deserialization function used by Cisco Security Manager could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a malicious serialized Java object to a specific listener on an affected system. A successful exploit could allow the attacker to execute arbitrary commands on the dev... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-sm-java-deserial • CWE-20: Improper Input Validation CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2014-0602
https://notcve.org/view.php?id=CVE-2014-0602
07 Jul 2014 — Directory traversal vulnerability in the DumpToFile method in the NQMcsVarSet ActiveX control in NetIQ Security Manager through 6.5.4 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-3460. Vulnerabilidad de salto de directorio en el método DumpToFile en el control NQMcsVarSet ActiveX en NetIQ Security Manager hasta 6.5.4 permite a atacantes remotos ejecutar código arbitrario a través de vectores no especificados, una vulnerabilidad diferente ... • https://www.netiq.com/support/kb/doc.php?id=7015309 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.8EPSS: 0%CPEs: 18EXPL: 0CVE-2014-3267
https://notcve.org/view.php?id=CVE-2014-3267
23 May 2014 — Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Security Manager 4.6 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make unspecified changes, aka Bug ID CSCuo46427. Vulnerabilidad de CSRF en el Framework web en Cisco Security Manager 4.6 y anteriores permite a atacantes remotos secuestrar la autenticación de usuarios arbitrarios para solicitudes que realizan cambios no especificados, también conocido como Bug ID CSCuo46427. • http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3267 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 18EXPL: 0CVE-2014-3266
https://notcve.org/view.php?id=CVE-2014-3266
23 May 2014 — Cross-site scripting (XSS) vulnerability in the web framework in Cisco Security Manager 4.6 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun65189. Vulnerabilidad de XSS en el Framework web en Cisco Security Manager 4.6 y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de un parámetro no especificado, también conocido como Bug ID CSCun65189. • http://secunia.com/advisories/58923 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 31EXPL: 0CVE-2014-2138
https://notcve.org/view.php?id=CVE-2014-2138
02 Apr 2014 — CRLF injection vulnerability in the web framework in Cisco Security Manager 4.2 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks via a crafted URL, aka Bug ID CSCun82349. Vulnerabilidad de inyección CRLF en el framework web en Cisco Security Manager 4.2 y anteriores permite a atacantes remotos inyectar cabeceras HTTP arbitrarias y realizar ataques de redirección a través de una URL manipulada, también conocido como Bug ID CSCun82349. • http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2138 • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 7%CPEs: 21EXPL: 0CVE-2010-3036
https://notcve.org/view.php?id=CVE-2010-3036
29 Oct 2010 — Multiple buffer overflows in the authentication functionality in the web-server module in Cisco CiscoWorks Common Services before 4.0 allow remote attackers to execute arbitrary code via a session on TCP port (1) 443 or (2) 1741, aka Bug ID CSCti41352. Multiples desbordamientos de búfer en la función de autenticación en el módulo web-server de Cisco CiscoWorks Common Services anterior a v4.0 permite a los atacantes remotos ejecutar código a su elección a través de sesiones TCP en el puerto (1) 443 o (2) 174... • http://osvdb.org/68927 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 1%CPEs: 33EXPL: 0CVE-2009-1161
https://notcve.org/view.php?id=CVE-2009-1161
21 May 2009 — Directory traversal vulnerability in the TFTP service in Cisco CiscoWorks Common Services (CWCS) 3.0.x through 3.2.x on Windows, as used in Cisco Unified Service Monitor, Security Manager, TelePresence Readiness Assessment Manager, Unified Operations Manager, Unified Provisioning Manager, and other products, allows remote attackers to access arbitrary files via unspecified vectors. Vulnerabilidad de salto de directorio en el servicio TFTP en Cisco CiscoWorks Common Services (CWCS) v3.0.x hasta v3.2.x en Win... • http://jvn.jp/en/jp/JVN62527913/index.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 86%CPEs: 296EXPL: 2CVE-2005-0356 – TCP TIMESTAMPS - Denial of Service
https://notcve.org/view.php?id=CVE-2005-0356
31 May 2005 — Multiple TCP implementations with Protection Against Wrapped Sequence Numbers (PAWS) with the timestamps option enabled allow remote attackers to cause a denial of service (connection loss) via a spoofed packet with a large timer value, which causes the host to discard later packets because they appear to be too old. • https://www.exploit-db.com/exploits/1008 •