CVSS: 10.0EPSS: 0%CPEs: 20EXPL: 0CVE-2020-24634
https://notcve.org/view.php?id=CVE-2020-24634
11 Dec 2020 — An attacker is able to remotely inject arbitrary commands by sending especially crafted packets destined to the PAPI (Aruba Networks AP Management protocol) UDP port (8211) of access-pointsor controllers in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers version(s): 2.1.0.1, 2.2.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below ; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below. Un atacante... • https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04072en_us • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 9.0EPSS: 1%CPEs: 3EXPL: 0CVE-2020-8273
https://notcve.org/view.php?id=CVE-2020-8273
16 Nov 2020 — Privilege escalation of an authenticated user to root in Citrix SD-WAN center versions before 11.2.2, 11.1.2b and 10.2.8. Una escalada de privilegios de un usuario autenticado a root en Citrix SD-WAN center, versiones anteriores a 11.2.2, 11.1.2b y 10.2.8 • https://support.citrix.com/article/CTX285061 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-8272
https://notcve.org/view.php?id=CVE-2020-8272
16 Nov 2020 — Authentication Bypass resulting in exposure of SD-WAN functionality in Citrix SD-WAN Center versions before 11.2.2, 11.1.2b and 10.2.8 Una Omisión de Autenticación resultando en una exposición de la funcionalidad SD-WAN en Citrix SD-WAN Center versiones anteriores a 11.2.2, 11.1.2b y 10.2.8 • https://support.citrix.com/article/CTX285061 • CWE-287: Improper Authentication •
CVSS: 10.0EPSS: 39%CPEs: 3EXPL: 0CVE-2020-8271
https://notcve.org/view.php?id=CVE-2020-8271
16 Nov 2020 — Unauthenticated remote code execution with root privileges in Citrix SD-WAN Center versions before 11.2.2, 11.1.2b and 10.2.8 Una ejecución de código remota no autenticada con privilegios root en Citrix SD-WAN Center versiones anteriores a 11.2.2, 11.1.2b y 10.2.8 • https://support.citrix.com/article/CTX285061 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-23: Relative Path Traversal •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-3600 – Cisco SD-WAN Software Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2020-3600
06 Nov 2020 — A vulnerability in Cisco SD-WAN Software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. The vulnerability is due to insufficient security controls on the CLI. An attacker could exploit this vulnerability by using an affected CLI utility that is running on an affected system. A successful exploit could allow the attacker to gain root privileges. Una vulnerabilidad en Cisco SD-WAN Software, podría permitir a un atacante local autenticado elevar p... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vepeshlg-tJghOQcA • CWE-269: Improper Privilege Management CWE-863: Incorrect Authorization •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-3595 – Cisco SD-WAN Software Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2020-3595
06 Nov 2020 — A vulnerability in Cisco SD-WAN Software could allow an authenticated, local attacker to elevate privileges to root group on the underlying operating system. The vulnerability is due to incorrect permissions being set when the affected command is executed. An attacker could exploit this vulnerability by executing the affected command on an affected system. A successful exploit could allow the attacker to gain root privileges. Una vulnerabilidad en Cisco SD-WAN Software podría permitir a un atacante local au... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vepegr-4xynYLUj • CWE-269: Improper Privilege Management CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-3594 – Cisco SD-WAN Software Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2020-3594
06 Nov 2020 — A vulnerability in Cisco SD-WAN Software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by providing crafted options to a specific command. A successful exploit could allow the attacker to gain root privileges. Una vulnerabilidad en Cisco SD-WAN Software podría permitir a un atacante local autenticado elevar privilegios a root en el sistema o... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vepestd-8C3J9Vc • CWE-269: Improper Privilege Management •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-3593 – Cisco SD-WAN Software Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2020-3593
06 Nov 2020 — A vulnerability in Cisco SD-WAN Software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted request to a utility that is running on an affected system. A successful exploit could allow the attacker to gain root privileges. Una vulnerabilidad en Cisco SD-WAN Software podría permitir a un atacante local autenticado elevar privi... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vepescm-BjgQm4vJ • CWE-269: Improper Privilege Management •
CVSS: 6.5EPSS: 2%CPEs: 1EXPL: 0CVE-2020-27128 – Cisco SD-WAN vManage Software Arbitrary File Creation Vulnerability
https://notcve.org/view.php?id=CVE-2020-27128
06 Nov 2020 — A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to write arbitrary files to an affected system. The vulnerability is due to improper validation of requests to APIs. An attacker could exploit this vulnerability by sending malicious requests to an API within the affected application. A successful exploit could allow the attacker to conduct directory traversal attacks and write files to an arbitrary location on the targeted system... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-file-Y2JSRNRb • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.4EPSS: 0%CPEs: 2EXPL: 0CVE-2020-3536 – Cisco SD-WAN vManage Cross-Site Scripting Vulnerability
https://notcve.org/view.php?id=CVE-2020-3536
08 Oct 2020 — A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by inserting malicious data into a specific data field in an affected interface. A successful exploit could allow the attacker to execute ... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-xss-xXeLFpC3 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •