CVSS: 9.3EPSS: 0%CPEs: 5EXPL: 0CVE-2014-2196
https://notcve.org/view.php?id=CVE-2014-2196
Cisco Wide Area Application Services (WAAS) 5.1.1 before 5.1.1e, when SharePoint prefetch optimization is enabled, allows remote SharePoint servers to execute arbitrary code via a malformed response, aka Bug ID CSCue18479. Cisco Wide Area Application Services (WAAS) 5.1.1 anterior a 5.1.1e, cuando optimización de pre-captura SharePoint está habilitada, permite a servidores SharePoint remotos ejecutar código arbitrario a través de una respuesta malformada, también conocido como Bug ID CSCue18479. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140521-waas http://www.securitytracker.com/id/1030265 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 18%CPEs: 10EXPL: 0CVE-2013-5554 – Cisco WAAS Mobile Server ReportReceiver CAB Processing Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2013-5554
Directory traversal vulnerability in the web-management interface in the server in Cisco Wide Area Application Services (WAAS) Mobile before 3.5.5 allows remote attackers to upload and execute arbitrary files via a crafted POST request, aka Bug ID CSCuh69773. Vulnerabilidad de salto de directorio en la interfaz web-management en el servidor de Cisco Wide Area Application Services (WAAS) Mobile anterior a la versión 3.5.5 permite a atacantes remotos subir y ejecutar archivos arbitrarios a través de peticiones POST manipuladas, también conocido como Bug ID CSCuh69773. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of CISCO WAAS Mobile Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of CAB files uploaded through ReportReceiver. By uploading a crafted CAB file, an attacker is able to add a hostile web page to the web server. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131106-waasm • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.0EPSS: 0%CPEs: 120EXPL: 0CVE-2013-3444
https://notcve.org/view.php?id=CVE-2013-3444
The web framework in Cisco WAAS Software before 4.x and 5.x before 5.0.3e, 5.1.x before 5.1.1c, and 5.2.x before 5.2.1; Cisco ACNS Software 4.x and 5.x before 5.5.29.2; Cisco ECDS Software 2.x before 2.5.6; Cisco CDS-IS Software 2.x before 2.6.3.b50 and 3.1.x before 3.1.2b54; Cisco VDS-IS Software 3.2.x before 3.2.1.b9; Cisco VDS-SB Software 1.x before 1.1.0-b96; Cisco VDS-OE Software 1.x before 1.0.1; and Cisco VDS-OS Software 1.x in central-management mode allows remote authenticated users to execute arbitrary commands by appending crafted strings to values in GUI fields, aka Bug IDs CSCug40609, CSCug48855, CSCug48921, CSCug48872, CSCuh21103, CSCuh21020, and CSCug56790. El framework web en Cisco WAAS Software anterior a 4.x y 5.x anterior a 5.0.3e, 5.1.x anterior a 5.1.1c, y 5.2.x anterior a 5.2.1; Cisco ACNS Software 4.x y 5.x anterior a 5.5.29.2; Cisco ECDS Software 2.x anterior a 2.5.6; Cisco CDS-IS Software 2.x anterior a 2.6.3.b50 y 3.1.x anterior a 3.1.2b54; Cisco VDS-IS Software 3.2.x anterior a 3.2.1.b9; Cisco VDS-SB Software 1.x anterior a 1.1.0-b96; Cisco VDS-OE Software 1.x anterior a 1.0.1; y Cisco VDS-OS Software 1.x en modo central-management, permite a usuarios autenticados remotamente ejecutar comandos arbitrarios añadiendo cadenas con valores modificados en los campos GUI. Aka Bug IDs CSCug40609, CSCug48855, CSCug48921, CSCug48872, CSCuh21103, CSCuh21020, y CSCug56790. • http://secunia.com/advisories/54367 http://secunia.com/advisories/54369 http://secunia.com/advisories/54370 http://secunia.com/advisories/54372 http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130731-cm http://www.securityfocus.com/bid/61543 http://www.securitytracker.com/id/1028852 http://www.securitytracker.com/id/1028853 https://exchange.xforce.ibmcloud.com/vulnerabilities/86122 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 9%CPEs: 60EXPL: 0CVE-2013-3443
https://notcve.org/view.php?id=CVE-2013-3443
The web service framework in Cisco WAAS Software 4.x and 5.x before 5.0.3e, 5.1.x before 5.1.1c, and 5.2.x before 5.2.1 in a Central Manager (CM) configuration allows remote attackers to execute arbitrary code via a crafted POST request, aka Bug ID CSCuh26626. El framework web en Cisco WAAS Software anterior a 4.x y 5.x anterior a 5.0.3e, 5.1.x anterior a 5.1.1c, y 5.2.x anterior a 5.2.1 con una configuración como Central Manager (CM), permite a atacantes remotos ejecutar código arbitrario a través de una petición POST manipulada. Aka Bug ID CSCuh26626. • http://osvdb.org/95877 http://secunia.com/advisories/54367 http://secunia.com/advisories/54372 http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130731-waascm http://www.securityfocus.com/bid/61542 http://www.securitytracker.com/id/1028851 https://exchange.xforce.ibmcloud.com/vulnerabilities/86121 • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2012-1348
https://notcve.org/view.php?id=CVE-2012-1348
Cisco Wide Area Application Services (WAAS) appliances with software 4.4, 5.0, and 5.1 include a one-way hash of a password within output text, which might allow remote attackers to obtain sensitive information via a brute-force attack on the hash string, aka Bug ID CSCty17279. Los aplicativos Cisco Wide Area Application Services (WAAS) con software v4.4, v5.0, y v5.1 incluye un hash de un solo sentido de una contraseña sin salida de texto, lo que podría permitir a atacantes remotos obtener información sensible a través de ataques de fuerza bruta sobre la cadena hash, también conocido como Bug ID CSCty17279. • http://www.cisco.com/en/US/docs/app_ntwk_services/waas/waas/v501/release/notes/ws501xrn.pdf • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •