CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-15404 – Cisco Integrated Management Controller Supervisor and Cisco UCS Director System Resources Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2018-15404
A vulnerability in the web interface of Cisco Integrated Management Controller (IMC) Supervisor and Cisco UCS Director could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected system. The vulnerability is due to insufficient restrictions on the size or total amount of resources allowed via the web interface. An attacker who has valid credentials for the application could exploit this vulnerability by sending a crafted or malformed HTTP request to the web interface. A successful exploit could allow the attacker to cause oversubscription of system resources or cause a component to become unresponsive, resulting in a DoS condition. Una vulnerabilidad en la interfaz web de Cisco Integrated Management Controller (IMC) Supervisor y Cisco UCS Director podría permitir que un atacante remoto autenticado provoque una denegación de servicio (DoS) en un sistema afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-imcs-ucsd-dos • CWE-399: Resource Management Errors CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 9.4EPSS: 0%CPEs: 11EXPL: 0CVE-2015-6259
https://notcve.org/view.php?id=CVE-2015-6259
The JavaServer Pages (JSP) component in Cisco Integrated Management Controller (IMC) Supervisor before 1.0.0.1 and UCS Director (formerly Cloupia Unified Infrastructure Controller) before 5.2.0.1 allows remote attackers to write to arbitrary files via crafted HTTP requests, aka Bug IDs CSCus36435 and CSCus62625. Vulnerabilidad en el componente JavaServer Pages (JSP) en Cisco Integrated Management Controller (IMC) Supervisor en versiones anteriores a 1.0.0.1 y UCS Director (anteriormente Cloupia Unified Infrastructure Controller) en versiones anteriores a 5.2.0.1, permite a atacantes remotos escribir en archivos arbitrarios a través de peticiones HTTP manipuladas, también conocida como Bug IDs CSCus36435 y CSCus62625. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150902-cimcs http://www.securitytracker.com/id/1033451 • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 2%CPEs: 8EXPL: 0CVE-2014-3348
https://notcve.org/view.php?id=CVE-2014-3348
The SSH module in the Integrated Management Controller (IMC) before 2.3.1 in Cisco Unified Computing System on E-Series blade servers allows remote attackers to cause a denial of service (IMC hang) via a crafted SSH packet, aka Bug ID CSCuo69206. El módulo SSH en Integrated Management Controller (IMC) anterior a 2.3.1 en Cisco Unified Computing System en los servidores Blade de la serie E permite a atacantes remotos causar una denegación de servicio (cuelgue de IMC) a través de un paquete SSH manipulado, también conocido como Bug ID CSCuo69206. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140908-ucse http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3348 http://tools.cisco.com/security/center/viewAlert.x?alertId=35588 http://www.securityfocus.com/bid/69652 http://www.securitytracker.com/id/1030813 https://exchange.xforce.ibmcloud.com/vulnerabilities/95782 • CWE-20: Improper Input Validation •
CVSS: 9.3EPSS: 0%CPEs: 41EXPL: 0CVE-2013-1185
https://notcve.org/view.php?id=CVE-2013-1185
The web interface in the Manager component in Cisco Unified Computing System (UCS) 1.x and 2.x before 2.0(2m) allows remote attackers to obtain sensitive information by reading a (1) technical-support bundle file or (2) on-device configuration backup, aka Bug ID CSCtq86543. La interfaz web en el componente Manager de Cisco Unified Computing System (UCS) v1.x y v2.x antes v2.0(2m) permite a atacantes remotos obtener información sensible mediante la lectura de un (1) archivo de paquete de soporte técnico o (2) el Respaldar la configuración del equipo, también conocido como Bug ID CSCtq86543. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-ucsmulti • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 0%CPEs: 12EXPL: 0CVE-2013-1184
https://notcve.org/view.php?id=CVE-2013-1184
The management API in the XML API management service in the Manager component in Cisco Unified Computing System (UCS) 1.x before 1.2(1b) allows remote attackers to cause a denial of service (service outage) via a malformed request, aka Bug ID CSCtg48206. El API de gestión en el servicio de gestión de API XML en el componente Manager de Cisco Unified Computing System (UCS) v1.x antes v1.2 (1b), permite a atacantes remotos provocar una denegación de servicio (interrupción del servicio) a través de una solicitud mal formada, también conocido como Bug ID CSCtg48206. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-ucsmulti • CWE-20: Improper Input Validation •