CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-1906 – Cisco Prime Infrastructure Virtual Domain Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2019-1906
A vulnerability in the Virtual Domain system of Cisco Prime Infrastructure (PI) could allow an authenticated, remote attacker to change the virtual domain configuration, which could lead to privilege escalation. The vulnerability is due to improper validation of API requests. An attacker could exploit this vulnerability by manipulating requests sent to an affected PI server. A successful exploit could allow the attacker to change the virtual domain configuration and possibly elevate privileges. Una vulnerabilidad en el sistema Virtual Domain de Prime Infrastructure (PI) de Cisco, podría permitir a un atacante remoto autenticado cambiar la configuración de virtual domain, lo que podría conllevar a una escalada de privilegios. • http://www.securityfocus.com/bid/108855 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-prime-privescal • CWE-20: Improper Input Validation CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-1818 – Cisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2019-1818
A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. A successful exploit could allow the attacker to view application files that may contain sensitive information. Una vulnerabilidad en la interfaz de administración web-based del programa Cisco Prime Infrastructure y Cisco Evolved Programmable Network (EPN) podría permitir que un atacante remoto autentificado descargue y vea archivos dentro de la aplicación que deberían estar restringidos. • http://www.securityfocus.com/bid/108352 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-pathtrav-1818 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-1819 – Cisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2019-1819
A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. A successful exploit could allow the attacker to view application files that may contain sensitive information. Una vulnerabilidad en web-based management interface del programa Cisco Prime Infrastructure y Cisco Evolved Programmable Network (EPN) podría permitir que un atacante remoto autenticado descargue y vea archivos dentro de la aplicación que deberían estar restringidos. • http://www.securityfocus.com/bid/108351 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-pathtrav-1819 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-1820 – Cisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2019-1820
A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. A successful exploit could allow the attacker to view application files that may contain sensitive information. Una vulnerabilidad en la web-based management interface del programa Prime Infrastructure y Evolved Programmable Network (EPN) de Cisco podría permitir que un atacante remoto autenticado descargue y vea archivos dentro de la aplicación que debería estar restringida. • http://www.securityfocus.com/bid/108345 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-pathtrav-1820 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 96%CPEs: 3EXPL: 3CVE-2019-1821 – Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerabilities
https://notcve.org/view.php?id=CVE-2019-1821
A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker to execute code with root-level privileges on the underlying operating system. Una vulnerabilidad enweb-based management interface de Cisco Prime Infrastructure (PI) y Cisco Evolved Programmable Network (EPN) Manager podría permitir que un atacante remoto autenticado ejecute código con privilegios de nivel raíz en el sistema operativo subyacente. • https://www.exploit-db.com/exploits/47016 https://www.exploit-db.com/exploits/47686 http://packetstormsecurity.com/files/153350/Cisco-Prime-Infrastructure-Health-Monitor-TarArchive-Directory-Traversal.html http://www.securityfocus.com/bid/108339 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-rce https://srcincite.io/blog/2019/05/17/panic-at-the-cisco-unauthenticated-rce-in-prime-infrastructure.html https://srcincite.io/advisories/src-2019-0034 https://srcincite&# • CWE-20: Improper Input Validation •