CVSS: 10.0EPSS: 93%CPEs: 1EXPL: 0CVE-2020-27131 – Cisco Security Manager Java Deserialization Vulnerabilities
https://notcve.org/view.php?id=CVE-2020-27131
Multiple vulnerabilities in the Java deserialization function that is used by Cisco Security Manager could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. These vulnerabilities are due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit these vulnerabilities by sending a malicious serialized Java object to a specific listener on an affected system. A successful exploit could allow the attacker to execute arbitrary commands on the device with the privileges of NT AUTHORITY\SYSTEM on the Windows target host. Cisco has not released software updates that address these vulnerabilities. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csm-java-rce-mWJEedcD • CWE-20: Improper Input Validation CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-27125 – Cisco Security Manager Static Credential Vulnerability
https://notcve.org/view.php?id=CVE-2020-27125
A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information on an affected system. The vulnerability is due to insufficient protection of static credentials in the affected software. An attacker could exploit this vulnerability by viewing source code. A successful exploit could allow the attacker to view static credentials, which the attacker could use to carry out further attacks. Una vulnerabilidad en Cisco Security Manager podría permitir a un atacante no autenticado remoto acceder a información confidencial en un sistema afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csm-rce-8gjUz9fW • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 90%CPEs: 1EXPL: 0CVE-2019-12630 – Cisco Security Manager Java Deserialization Vulnerability
https://notcve.org/view.php?id=CVE-2019-12630
A vulnerability in the Java deserialization function used by Cisco Security Manager could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a malicious serialized Java object to a specific listener on an affected system. A successful exploit could allow the attacker to execute arbitrary commands on the device with the privileges of casuser. Una vulnerabilidad en la función de deserialización de Java utilizada por Cisco Security Manager, podría permitir a un atacante remoto no autenticado ejecutar comandos arbitrarios sobre un dispositivo afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-sm-java-deserial • CWE-20: Improper Input Validation CWE-502: Deserialization of Untrusted Data •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2014-0602
https://notcve.org/view.php?id=CVE-2014-0602
Directory traversal vulnerability in the DumpToFile method in the NQMcsVarSet ActiveX control in NetIQ Security Manager through 6.5.4 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-3460. Vulnerabilidad de salto de directorio en el método DumpToFile en el control NQMcsVarSet ActiveX en NetIQ Security Manager hasta 6.5.4 permite a atacantes remotos ejecutar código arbitrario a través de vectores no especificados, una vulnerabilidad diferente a CVE-2014-3460. • https://www.netiq.com/support/kb/doc.php?id=7015309 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.3EPSS: 0%CPEs: 18EXPL: 0CVE-2014-3266
https://notcve.org/view.php?id=CVE-2014-3266
Cross-site scripting (XSS) vulnerability in the web framework in Cisco Security Manager 4.6 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun65189. Vulnerabilidad de XSS en el Framework web en Cisco Security Manager 4.6 y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de un parámetro no especificado, también conocido como Bug ID CSCun65189. • http://secunia.com/advisories/58923 http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3266 http://tools.cisco.com/security/center/viewAlert.x?alertId=34340 http://www.securityfocus.com/bid/67569 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •