CVSS: 8.8EPSS: 0%CPEs: 18EXPL: 0CVE-2016-6443
https://notcve.org/view.php?id=CVE-2016-6443
A vulnerability in the Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL database interface could allow an authenticated, remote attacker to impact system confidentiality by executing a subset of arbitrary SQL queries that can cause product instability. More Information: CSCva27038, CSCva28335. Known Affected Releases: 3.1(0.128), 1.2(400), 2.0(1.0.34A). Una vulnerabilidad en Cisco Prime Infrastructure y en la interfaz de la base de datos SQL de Evolved Programmable Network Manager podría permitir a un atacante remoto autenticado impactar la confidencialidad del sistema ejecutando un subconjunto de consultas SQL arbitrarias que pueden provocar inestabilidad en el producto. Más información: CSCva27038, CSCva28335. • http://www.securityfocus.com/bid/93522 http://www.securitytracker.com/id/1037006 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161012-prime • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 21EXPL: 0CVE-2016-1408
https://notcve.org/view.php?id=CVE-2016-1408
Cisco Prime Infrastructure 1.2 through 3.1 and Evolved Programmable Network Manager (EPNM) 1.2 and 2.0 allow remote authenticated users to execute arbitrary commands or upload files via a crafted HTTP request, aka Bug ID CSCuz01488. Cisco Prime Infrastructure 1.2 hasta la versión 3.1 y Evolved Programmable Network Manager (EPNM) 1.2 y 2.0 permite a usuarios remotos autenticado ejecutar comandos arbitrarios o subir archivos a través de una petición HTTP manipulada, también conocida como Bug ID CSCuz01488. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160629-pi-epnm http://www.securityfocus.com/bid/91506 http://www.securitytracker.com/id/1036197 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 18EXPL: 0CVE-2016-1406
https://notcve.org/view.php?id=CVE-2016-1406
The API web interface in Cisco Prime Infrastructure before 3.1 and Cisco Evolved Programmable Network Manager before 1.2.4 allows remote authenticated users to bypass intended RBAC restrictions and obtain sensitive information, and consequently gain privileges, via crafted JSON data, aka Bug ID CSCuy12409. La interfaz web API en Cisco Prime Infrastructure en versiones anteriores a 3.1 y Cisco Evolved Programmable Network Manager en versiones anteriores a 1.2.4 permite a usuarios remotos autenticados eludir restricciones destinadas al RBAC y obtener información sensible, y consecuentemente obtener privilegios, a través de datos JSON manipulados, también conocida como Bug ID CSCuy12409. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160523-pi-epnm http://www.securitytracker.com/id/1035948 • CWE-284: Improper Access Control •