CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-27125 – Cisco Security Manager Static Credential Vulnerability
https://notcve.org/view.php?id=CVE-2020-27125
17 Nov 2020 — A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information on an affected system. The vulnerability is due to insufficient protection of static credentials in the affected software. An attacker could exploit this vulnerability by viewing source code. A successful exploit could allow the attacker to view static credentials, which the attacker could use to carry out further attacks. Una vulnerabilidad en Cisco Security Manager podría permitir a un... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csm-rce-8gjUz9fW • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 83%CPEs: 1EXPL: 0CVE-2019-12630 – Cisco Security Manager Java Deserialization Vulnerability
https://notcve.org/view.php?id=CVE-2019-12630
02 Oct 2019 — A vulnerability in the Java deserialization function used by Cisco Security Manager could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a malicious serialized Java object to a specific listener on an affected system. A successful exploit could allow the attacker to execute arbitrary commands on the dev... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-sm-java-deserial • CWE-20: Improper Input Validation CWE-502: Deserialization of Untrusted Data •
CVSS: 7.8EPSS: 2%CPEs: 291EXPL: 0CVE-2015-6360 – libsrtp: improper handling of CSRC count and extension header length in RTP header
https://notcve.org/view.php?id=CVE-2015-6360
04 Apr 2016 — The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial of service via crafted fields in SRTP packets, aka Bug ID CSCux00686. La característica de procesado de cifrado en Cisco libSRTP en versiones anteriores a 1.5.3 permite a atacantes remotos provocar una denegación de servicio a través de campos manipulados en paquetes SRTP, también conocida como Bug ID CSCux00686. Randell Jesup and the Firefox team discovered that srtp, Cisco's reference implementation o... • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160420-libsrtp • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2014-0602
https://notcve.org/view.php?id=CVE-2014-0602
07 Jul 2014 — Directory traversal vulnerability in the DumpToFile method in the NQMcsVarSet ActiveX control in NetIQ Security Manager through 6.5.4 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-3460. Vulnerabilidad de salto de directorio en el método DumpToFile en el control NQMcsVarSet ActiveX en NetIQ Security Manager hasta 6.5.4 permite a atacantes remotos ejecutar código arbitrario a través de vectores no especificados, una vulnerabilidad diferente ... • https://www.netiq.com/support/kb/doc.php?id=7015309 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.8EPSS: 0%CPEs: 18EXPL: 0CVE-2014-3267
https://notcve.org/view.php?id=CVE-2014-3267
23 May 2014 — Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Security Manager 4.6 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make unspecified changes, aka Bug ID CSCuo46427. Vulnerabilidad de CSRF en el Framework web en Cisco Security Manager 4.6 y anteriores permite a atacantes remotos secuestrar la autenticación de usuarios arbitrarios para solicitudes que realizan cambios no especificados, también conocido como Bug ID CSCuo46427. • http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3267 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 18EXPL: 0CVE-2014-3266
https://notcve.org/view.php?id=CVE-2014-3266
23 May 2014 — Cross-site scripting (XSS) vulnerability in the web framework in Cisco Security Manager 4.6 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun65189. Vulnerabilidad de XSS en el Framework web en Cisco Security Manager 4.6 y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de un parámetro no especificado, también conocido como Bug ID CSCun65189. • http://secunia.com/advisories/58923 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 31EXPL: 0CVE-2014-2138
https://notcve.org/view.php?id=CVE-2014-2138
02 Apr 2014 — CRLF injection vulnerability in the web framework in Cisco Security Manager 4.2 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks via a crafted URL, aka Bug ID CSCun82349. Vulnerabilidad de inyección CRLF en el framework web en Cisco Security Manager 4.2 y anteriores permite a atacantes remotos inyectar cabeceras HTTP arbitrarias y realizar ataques de redirección a través de una URL manipulada, también conocido como Bug ID CSCun82349. • http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2138 • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 7%CPEs: 21EXPL: 0CVE-2010-3036
https://notcve.org/view.php?id=CVE-2010-3036
29 Oct 2010 — Multiple buffer overflows in the authentication functionality in the web-server module in Cisco CiscoWorks Common Services before 4.0 allow remote attackers to execute arbitrary code via a session on TCP port (1) 443 or (2) 1741, aka Bug ID CSCti41352. Multiples desbordamientos de búfer en la función de autenticación en el módulo web-server de Cisco CiscoWorks Common Services anterior a v4.0 permite a los atacantes remotos ejecutar código a su elección a través de sesiones TCP en el puerto (1) 443 o (2) 174... • http://osvdb.org/68927 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 1%CPEs: 33EXPL: 0CVE-2009-1161
https://notcve.org/view.php?id=CVE-2009-1161
21 May 2009 — Directory traversal vulnerability in the TFTP service in Cisco CiscoWorks Common Services (CWCS) 3.0.x through 3.2.x on Windows, as used in Cisco Unified Service Monitor, Security Manager, TelePresence Readiness Assessment Manager, Unified Operations Manager, Unified Provisioning Manager, and other products, allows remote attackers to access arbitrary files via unspecified vectors. Vulnerabilidad de salto de directorio en el servicio TFTP en Cisco CiscoWorks Common Services (CWCS) v3.0.x hasta v3.2.x en Win... • http://jvn.jp/en/jp/JVN62527913/index.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 1%CPEs: 8EXPL: 0CVE-2008-3820
https://notcve.org/view.php?id=CVE-2008-3820
22 Jan 2009 — Cisco Security Manager 3.1 and 3.2 before 3.2.2, when Cisco IPS Event Viewer (IEV) is used, exposes TCP ports used by the MySQL daemon and IEV server, which allows remote attackers to obtain "root access" to IEV via unspecified use of TCP sessions to these ports. Cisco Security Manager v3.1 y v3.2 antes de v3.2.2, cuando se usa Cisco IPS Event Viewer (IEV), expone los puertos TCP utilizados por el demonio de MySQL y el servidor IEV, lo que permite a atacantes remotos obtener "acceso de root" a IEV, mediante... • http://secunia.com/advisories/33633 •