CVSS: 6.5EPSS: 14%CPEs: 2EXPL: 0CVE-2019-1819 – Cisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2019-1819
16 May 2019 — A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired fi... • http://www.securityfocus.com/bid/108351 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 14%CPEs: 2EXPL: 0CVE-2019-1820 – Cisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2019-1820
16 May 2019 — A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired fi... • http://www.securityfocus.com/bid/108345 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 93%CPEs: 3EXPL: 4CVE-2019-1821 – Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerabilities
https://notcve.org/view.php?id=CVE-2019-1821
16 May 2019 — A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker... • https://packetstorm.news/files/id/153350 • CWE-20: Improper Input Validation •
CVSS: 9.0EPSS: 3%CPEs: 2EXPL: 0CVE-2019-1822 – Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerabilities
https://notcve.org/view.php?id=CVE-2019-1822
16 May 2019 — A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker... • http://www.securityfocus.com/bid/108339 • CWE-20: Improper Input Validation •
CVSS: 9.0EPSS: 2%CPEs: 3EXPL: 0CVE-2019-1823 – Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerabilities
https://notcve.org/view.php?id=CVE-2019-1823
16 May 2019 — A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker... • http://www.securityfocus.com/bid/108339 • CWE-20: Improper Input Validation •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2019-1824 – Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL Injection Vulnerabilities
https://notcve.org/view.php?id=CVE-2019-1824
16 May 2019 — A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute arbitrary SQL queries. This vulnerability exist because the software improperly validates user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains malicious SQL statements to the affected application. A successful exploit could allow the att... • http://www.securityfocus.com/bid/108337 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.1EPSS: 0%CPEs: 3EXPL: 0CVE-2019-1825 – Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL Injection Vulnerabilities
https://notcve.org/view.php?id=CVE-2019-1825
16 May 2019 — A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute arbitrary SQL queries. This vulnerability exist because the software improperly validates user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains malicious SQL statements to the affected application. A successful exploit could allow the att... • http://www.securityfocus.com/bid/108337 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 0CVE-2019-1659 – Cisco Prime Infrastructure Certificate Validation Vulnerability
https://notcve.org/view.php?id=CVE-2019-1659
21 Feb 2019 — A vulnerability in the Identity Services Engine (ISE) integration feature of Cisco Prime Infrastructure (PI) could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack against the Secure Sockets Layer (SSL) tunnel established between ISE and PI. The vulnerability is due to improper validation of the server SSL certificate when establishing the SSL tunnel with ISE. An attacker could exploit this vulnerability by using a crafted SSL certificate and could then intercept communication... • http://www.securityfocus.com/bid/107092 • CWE-295: Improper Certificate Validation •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-6724
https://notcve.org/view.php?id=CVE-2017-6724
04 Jul 2017 — A vulnerability in the web framework code of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected system. More Information: CSCuw65843. Known Affected Releases: 3.1(0.0). Una vulnerabilidad en el código del framework Web de Prime Infrastructure de Cisco, podría permitir a un atacante remoto no identificado conducir un ataque de tipo cross-site scripting (XSS) contra un usuario de la interf... • http://www.securityfocus.com/bid/99203 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.0EPSS: 0%CPEs: 30EXPL: 1CVE-2017-6662 – Cisco Prime Infrastructure 3.1.6 XXE Injection / XSS / LFD / SQL Injection
https://notcve.org/view.php?id=CVE-2017-6662
22 Jun 2017 — A vulnerability in the web-based user interface of Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker read and write access to information stored in the affected system as well as perform remote code execution. The attacker must have valid user credentials. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by convincing the adminis... • https://packetstorm.news/files/id/143111 • CWE-20: Improper Input Validation CWE-611: Improper Restriction of XML External Entity Reference •