CVSS: 7.8EPSS: 0%CPEs: 148EXPL: 0CVE-2024-20366
https://notcve.org/view.php?id=CVE-2024-20366
A vulnerability in the Tail-f High Availability Cluster Communications (HCC) function pack of Cisco Crosswork Network Services Orchestrator (NSO) could allow an authenticated, local attacker to elevate privileges to root on an affected device. This vulnerability exists because a user-controlled search path is used to locate executable files. An attacker could exploit this vulnerability by configuring the application in a way that causes a malicious file to be executed. A successful exploit could allow the attacker to execute arbitrary code on an affected device as the root user. To exploit this vulnerability, the attacker would need valid credentials on an affected device. Una vulnerabilidad en el paquete de funciones Tail-f High Availability Cluster Communications (HCC) de Cisco Crosswork Network Services Orchestrator (NSO) podría permitir a un atacante local autenticado elevar los privilegios a root en un dispositivo afectado. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nso-hcc-priv-esc-OWBWCs5D • CWE-73: External Control of File Name or Path •
CVSS: 6.8EPSS: 0%CPEs: 37EXPL: 0CVE-2024-20391
https://notcve.org/view.php?id=CVE-2024-20391
A vulnerability in the Network Access Manager (NAM) module of Cisco Secure Client could allow an unauthenticated attacker with physical access to an affected device to elevate privileges to SYSTEM. This vulnerability is due to a lack of authentication on a specific function. A successful exploit could allow the attacker to execute arbitrary code with SYSTEM privileges on an affected device. Una vulnerabilidad en el módulo Network Access Manager (NAM) de Cisco Secure Client podría permitir que un atacante no autenticado con acceso físico a un dispositivo afectado eleve privilegios al SYSTEM. Esta vulnerabilidad se debe a la falta de autenticación en una función específica. Un exploit exitoso podría permitir al atacante ejecutar código arbitrario con privilegios de SYSTEM en un dispositivo afectado. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-nam-priv-esc-szu2vYpZ • CWE-306: Missing Authentication for Critical Function •
CVSS: 4.7EPSS: 0%CPEs: 93EXPL: 0CVE-2024-20369
https://notcve.org/view.php?id=CVE-2024-20369
A vulnerability in the web-based management interface of Cisco Crosswork Network Services Orchestrator (NSO) could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of a parameter in an HTTP request. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious website. Una vulnerabilidad en la interfaz de administración basada en web de Cisco Crosswork Network Services Orchestrator (NSO) podría permitir que un atacante remoto no autenticado redirija a un usuario a una página web maliciosa. Esta vulnerabilidad se debe a una validación de entrada incorrecta de un parámetro en una solicitud HTTP. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nso-ordir-MNM8YqzO • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 7.5EPSS: 0%CPEs: 30EXPL: 0CVE-2024-20376
https://notcve.org/view.php?id=CVE-2024-20376
A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a DoS condition. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an affected device. A successful exploit could allow the attacker to cause the affected device to reload. Una vulnerabilidad en la interfaz de administración basada en web del firmware del teléfono IP de Cisco podría permitir que un atacante remoto no autenticado provoque la recarga de un dispositivo afectado, lo que resultaría en una condición DoS. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipphone-multi-vulns-cXAhCvS • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 30EXPL: 0CVE-2024-20378
https://notcve.org/view.php?id=CVE-2024-20378
A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device. This vulnerability is due to a lack of authentication for specific endpoints of the web-based management interface on an affected device. An attacker could exploit this vulnerability by connecting to the affected device. A successful exploit could allow the attacker to gain unauthorized access to the device, enabling the recording of user credentials and traffic to and from the affected device, including VoIP calls that could be replayed. Una vulnerabilidad en la interfaz de administración basada en web del firmware del teléfono IP de Cisco podría permitir que un atacante remoto no autenticado recupere información confidencial de un dispositivo afectado. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipphone-multi-vulns-cXAhCvS • CWE-305: Authentication Bypass by Primary Weakness •