CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-3114 – Cisco Data Center Network Manager Cross-Site Request Forgery Vulnerability
https://notcve.org/view.php?id=CVE-2020-3114
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link while having an active session on an affected device. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the targeted user. Una vulnerabilidad en la interfaz de administración basada en web de Cisco Data Center Network Manager (DCNM), podría permitir a un atacante remoto no autenticado realizar un ataque de tipo cross-site request forgery (CSRF) en un sistema afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200219-dcnm-csrf • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 1CVE-2019-15999 – Cisco Data Center Network Manager JBoss EAP Unauthorized Access Vulnerability
https://notcve.org/view.php?id=CVE-2019-15999
A vulnerability in the application environment of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to gain unauthorized access to the JBoss Enterprise Application Platform (JBoss EAP) on an affected device. The vulnerability is due to an incorrect configuration of the authentication settings on the JBoss EAP. An attacker could exploit this vulnerability by authenticating with a specific low-privilege account. A successful exploit could allow the attacker to gain unauthorized access to the JBoss EAP, which should be limited to internal system accounts. Una vulnerabilidad en el entorno de aplicación de Cisco Data Center Network Manager (DCNM), podría permitir a un atacante remoto autenticado conseguir acceso no autorizado a JBoss Enterprise Application Platform (JBoss EAP) sobre un dispositivo afectado. • https://www.exploit-db.com/exploits/47885 http://packetstormsecurity.com/files/155870/Cisco-DCNM-JBoss-10.4-Credential-Leakage.html https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200102-dcnm-unauth-access • CWE-284: Improper Access Control •
CVSS: 10.0EPSS: 58%CPEs: 1EXPL: 2CVE-2019-15975 – Cisco Data Center Network Manager Authentication Bypass Vulnerabilities
https://notcve.org/view.php?id=CVE-2019-15975
Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. Múltiples vulnerabilidades en los mecanismos de autenticación de Cisco Data Center Network Manager (DCNM), podrían permitir a un atacante remoto no autenticado omitir la autenticación y ejecutar acciones arbitrarias con privilegios administrativos sobre un dispositivo afectado. Para más información sobre estas vulnerabilidades, véase la sección Detalles de este aviso. This vulnerability allows remote attackers to bypass authentication on affected installations of Cisco Data Center Network Manager. The specific flaw exists within the processing of the dbadmin/addUser functionality. • https://www.exploit-db.com/exploits/48018 http://packetstormsecurity.com/files/156238/Cisco-Data-Center-Network-Manager-11.2-Remote-Code-Execution.html https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200102-dcnm-auth-bypass • CWE-798: Use of Hard-coded Credentials •
CVSS: 10.0EPSS: 96%CPEs: 1EXPL: 2CVE-2019-15976 – Cisco Data Center Network Manager Authentication Bypass Vulnerabilities
https://notcve.org/view.php?id=CVE-2019-15976
Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. Múltiples vulnerabilidades en los mecanismos de autenticación de Cisco Data Center Network Manager (DCNM), podrían permitir a un atacante remoto no autenticado omitir la autenticación y ejecutar acciones arbitrarias con privilegios administrativos sobre un dispositivo afectado. Para más información sobre estas vulnerabilidades, véase la sección Detalles de este aviso. This vulnerability allows remote attackers to bypass authentication on affected installations of Cisco Data Center Network Manager. • https://www.exploit-db.com/exploits/48019 http://packetstormsecurity.com/files/156239/Cisco-Data-Center-Network-Manager-11.2.1-SQL-Injection.html https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200102-dcnm-auth-bypass • CWE-798: Use of Hard-coded Credentials •
CVSS: 9.8EPSS: 96%CPEs: 1EXPL: 2CVE-2019-15977 – Cisco Data Center Network Manager Authentication Bypass Vulnerabilities
https://notcve.org/view.php?id=CVE-2019-15977
Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. Múltiples vulnerabilidades en los mecanismos de autenticación de Cisco Data Center Network Manager (DCNM), podrían permitir a un atacante remoto no autenticado omitir la autenticación y ejecutar acciones arbitrarias con privilegios administrativos sobre un dispositivo afectado. Para más información sobre estas vulnerabilidades, véase la sección Detalles de este aviso. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco Data Center Network Manager. • https://www.exploit-db.com/exploits/48020 http://packetstormsecurity.com/files/156242/Cisco-Data-Center-Network-Manager-11.2.1-Command-Injection.html https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200102-dcnm-auth-bypass • CWE-798: Use of Hard-coded Credentials •