Page 8 of 41 results (0.007 seconds)

CVSS: 8.8EPSS: 0%CPEs: 18EXPL: 0

CVE-2016-1406

https://notcve.org/view.php?id=CVE-2016-1406

The API web interface in Cisco Prime Infrastructure before 3.1 and Cisco Evolved Programmable Network Manager before 1.2.4 allows remote authenticated users to bypass intended RBAC restrictions and obtain sensitive information, and consequently gain privileges, via crafted JSON data, aka Bug ID CSCuy12409. La interfaz web API en Cisco Prime Infrastructure en versiones anteriores a 3.1 y Cisco Evolved Programmable Network Manager en versiones anteriores a 1.2.4 permite a usuarios remotos autenticados eludir restricciones destinadas al RBAC y obtener información sensible, y consecuentemente obtener privilegios, a través de datos JSON manipulados, también conocida como Bug ID CSCuy12409. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160523-pi-epnm http://www.securitytracker.com/id/1035948 • CWE-284: Improper Access Control •

CVSS: 8.1EPSS: 0%CPEs: 14EXPL: 0

CVE-2016-1290

https://notcve.org/view.php?id=CVE-2016-1290

The web API in Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allows remote authenticated users to bypass intended RBAC restrictions and gain privileges via an HTTP request that is inconsistent with a pattern filter, aka Bug ID CSCuy10227. La API web en Cisco Prime Infrastructure 1.2.0 hasta la versión 2.2(2) y Cisco Evolved Programmable Network Manager (EPNM) 1.2 permite a usuarios remotos autenticados eludir restricciones RBAC previstas y obtener privilegios a través de una petición HTTP que es inconsistente con un patrón de filtro, también conocido como Bug ID CSCuy10227. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160406-privauth http://www.securitytracker.com/id/1035498 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 9.8EPSS: 4%CPEs: 14EXPL: 0

CVE-2016-1291

https://notcve.org/view.php?id=CVE-2016-1291

Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allow remote attackers to execute arbitrary code via crafted deserialized data in an HTTP POST request, aka Bug ID CSCuw03192. Cisco Prime Infrastructure 1.2.0 hasta la versión 2.2(2) y Cisco Evolved Programmable Network Manager (EPNM) 1.2 permiten a atacantes remotos ejecutar código arbitrario a través de datos deserializados manipulados en una petición HTTP POST, también conocido como Bug ID CSCuw03192. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160406-remcode http://www.securitytracker.com/id/1035497 https://blogs.securiteam.com/index.php/archives/2727 • CWE-20: Improper Input Validation •

CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0

CVE-2015-6262

https://notcve.org/view.php?id=CVE-2015-6262

Cross-site request forgery (CSRF) vulnerability in Cisco Prime Infrastructure 1.2(0.103) and 2.0(0.0) allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCum49054 and CSCum49059. Vulnerabilidad de CSRF en Cisco Prime Infrastructure 1.2(0.103) y 2.0(0.0), permite a atacantes remotos secuestrar la autenticación de usuarios arbitrarios, también conocida como Bug IDs CSCum49054 y CSCum49059. • http://tools.cisco.com/security/center/viewAlert.x?alertId=40652 http://www.securitytracker.com/id/1033364 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0

CVE-2014-2147

https://notcve.org/view.php?id=CVE-2014-2147

The web interface in Cisco Prime Infrastructure 2.1 and earlier does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCuj42444. La interfaz web en Cisco Prime Infrastructure 2.1 y anteriores no restringe correctamente el uso de elementos IFRAME, lo que facilita a atacantes remotos realizar ataques de clickjacking y otros ataques no especificados a través de un sitio web manipulado, relacionado con un problema de 'XFS', también conocido como Bug ID CSCuj42444. • http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2147 http://tools.cisco.com/security/center/viewAlert.x?alertId=37419 http://www.securityfocus.com/bid/72551 http://www.securitytracker.com/id/1031715 https://exchange.xforce.ibmcloud.com/vulnerabilities/100755 • CWE-20: Improper Input Validation •