CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-12712 – Cisco Prime Infrastructure Cross-Site Scripting Vulnerability
https://notcve.org/view.php?id=CVE-2019-12712
02 Oct 2019 — A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected software. The vulnerability is due to insufficient validation of user-supplied input in multiple sections of the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a ... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-pi-xss-12712 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-1906 – Cisco Prime Infrastructure Virtual Domain Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2019-1906
20 Jun 2019 — A vulnerability in the Virtual Domain system of Cisco Prime Infrastructure (PI) could allow an authenticated, remote attacker to change the virtual domain configuration, which could lead to privilege escalation. The vulnerability is due to improper validation of API requests. An attacker could exploit this vulnerability by manipulating requests sent to an affected PI server. A successful exploit could allow the attacker to change the virtual domain configuration and possibly elevate privileges. Una vulnerab... • http://www.securityfocus.com/bid/108855 • CWE-20: Improper Input Validation CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.5EPSS: 14%CPEs: 2EXPL: 0CVE-2019-1818 – Cisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2019-1818
16 May 2019 — A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired fi... • http://www.securityfocus.com/bid/108352 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 14%CPEs: 2EXPL: 0CVE-2019-1819 – Cisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2019-1819
16 May 2019 — A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired fi... • http://www.securityfocus.com/bid/108351 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 14%CPEs: 2EXPL: 0CVE-2019-1820 – Cisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2019-1820
16 May 2019 — A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired fi... • http://www.securityfocus.com/bid/108345 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 93%CPEs: 3EXPL: 4CVE-2019-1821 – Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerabilities
https://notcve.org/view.php?id=CVE-2019-1821
16 May 2019 — A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker... • https://packetstorm.news/files/id/153350 • CWE-20: Improper Input Validation •
CVSS: 9.0EPSS: 3%CPEs: 2EXPL: 0CVE-2019-1822 – Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerabilities
https://notcve.org/view.php?id=CVE-2019-1822
16 May 2019 — A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker... • http://www.securityfocus.com/bid/108339 • CWE-20: Improper Input Validation •
CVSS: 9.0EPSS: 2%CPEs: 3EXPL: 0CVE-2019-1823 – Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerabilities
https://notcve.org/view.php?id=CVE-2019-1823
16 May 2019 — A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker... • http://www.securityfocus.com/bid/108339 • CWE-20: Improper Input Validation •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2019-1824 – Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL Injection Vulnerabilities
https://notcve.org/view.php?id=CVE-2019-1824
16 May 2019 — A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute arbitrary SQL queries. This vulnerability exist because the software improperly validates user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains malicious SQL statements to the affected application. A successful exploit could allow the att... • http://www.securityfocus.com/bid/108337 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.1EPSS: 0%CPEs: 3EXPL: 0CVE-2019-1825 – Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL Injection Vulnerabilities
https://notcve.org/view.php?id=CVE-2019-1825
16 May 2019 — A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute arbitrary SQL queries. This vulnerability exist because the software improperly validates user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains malicious SQL statements to the affected application. A successful exploit could allow the att... • http://www.securityfocus.com/bid/108337 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •