CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-34707 – Cisco Evolved Programmable Network Manager Sensitive Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2021-34707
A vulnerability in the REST API of Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker to access sensitive data on an affected system. This vulnerability exists because the application does not sufficiently protect sensitive data when responding to an API request. An attacker could exploit the vulnerability by sending a specific API request to the affected application. A successful exploit could allow the attacker to obtain sensitive information about the application. Una vulnerabilidad en la API REST de Cisco Evolved Programmable Network Manager (EPNM) podría permitir a un atacante remoto autenticado acceder a datos confidenciales en un sistema afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-epnm-info-disc-PjTZ5r6C • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0CVE-2021-1487 – Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Command Injection Vulnerability
https://notcve.org/view.php?id=CVE-2021-1487
A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute arbitrary commands on an affected system. The vulnerability is due to insufficient validation of user-supplied input to the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to the interface. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system (OS) with the permissions of a special non-root user. In this way, an attacker could take control of the affected system, which would allow them to obtain and alter sensitive data. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-epnm-cmd-inj-YU5e6tB3 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 4.4EPSS: 0%CPEs: 8EXPL: 0CVE-2021-1306 – Cisco ADE-OS Local File Inclusion Vulnerability
https://notcve.org/view.php?id=CVE-2021-1306
A vulnerability in the restricted shell of Cisco Evolved Programmable Network (EPN) Manager, Cisco Identity Services Engine (ISE), and Cisco Prime Infrastructure could allow an authenticated, local attacker to identify directories and write arbitrary files to the file system. This vulnerability is due to improper validation of parameters that are sent to a CLI command within the restricted shell. An attacker could exploit this vulnerability by logging in to the device and issuing certain CLI commands. A successful exploit could allow the attacker to identify file directories on the affected device and write arbitrary files to the file system on the affected device. To exploit this vulnerability, the attacker must be an authenticated shell user. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ade-xcvAQEOZ • CWE-73: External Control of File Name or Path CWE-610: Externally Controlled Reference to a Resource in Another Sphere •
CVSS: 8.0EPSS: 1%CPEs: 30EXPL: 0CVE-2017-6662 – Cisco Prime Infrastructure 3.1.6 XXE Injection / XSS / LFD / SQL Injection
https://notcve.org/view.php?id=CVE-2017-6662
A vulnerability in the web-based user interface of Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker read and write access to information stored in the affected system as well as perform remote code execution. The attacker must have valid user credentials. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file with malicious entries which could allow the attacker to read and write files and execute remote code within the application, aka XML Injection. Cisco Prime Infrastructure software releases 1.1 through 3.1.6 are vulnerable. • http://www.securityfocus.com/bid/99194 http://www.securitytracker.com/id/1038750 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-piepnm1 • CWE-20: Improper Input Validation CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2017-6699 – Cisco Prime Infrastructure 3.1.6 XXE Injection / XSS / LFD / SQL Injection
https://notcve.org/view.php?id=CVE-2017-6699
A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. More Information: CSCvc24616 CSCvc35363 CSCvc49574. Known Affected Releases: 3.1(1) 2.0(4.0.45B). Una vulnerabilidad en la interfaz de administración basada en web de Prime Infrastructure (PI) y Evolved Programmable Network Manager (EPNM) de Cisco, podría permitir a un atacante remoto no autenticado conducir un ataque de tipo cross-site scripting (XSS) reflejado contra un usuario de la interfaz de administración basada en web en un dispositivo afectado. Más información: CSCvc24616 CSCvc35363 CSCvc49574. • http://www.securityfocus.com/bid/99221 http://www.securitytracker.com/id/1038751 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-piepnm3 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •