CVSS: 5.4EPSS: 0%CPEs: 6EXPL: 0CVE-2021-1582 – Cisco Application Policy Infrastructure Controller Stored Cross-Site Scripting Vulnerability
https://notcve.org/view.php?id=CVE-2021-1582
A vulnerability in the web UI of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow an authenticated, remote attacker to perform a stored cross-site scripting attack on an affected system. This vulnerability is due to improper input validation in the web UI. An authenticated attacker could exploit this vulnerability by sending malicious input to the web UI. A successful exploit could allow the attacker to execute arbitrary script code in the context of the web-based interface or access sensitive, browser-based information. Una vulnerabilidad en la interfaz de usuario web de Cisco Application Policy Infrastructure Controller (APIC) o Cisco Cloud APIC podría permitir a un atacante remoto autenticado llevar a cabo un ataque de tipo cross-site scripting almacenado en un sistema afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-capic-scss-bFT75YrM • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 0%CPEs: 6EXPL: 0CVE-2021-1581 – Cisco Application Policy Infrastructure Controller Command Injection and File Upload Vulnerabilities
https://notcve.org/view.php?id=CVE-2021-1581
Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow a remote attacker to perform a command injection or file upload attack on an affected system. For more information about these vulnerabilities, see the Details section of this advisory. Múltiples vulnerabilidades en la interfaz de usuario web y los endpoints de la API de Cisco Application Policy Infrastructure Controller (APIC) o Cisco Cloud APIC podrían permitir a un atacante remoto llevar a cabo un ataque de inyección de comandos o de carga de archivos en un sistema afectado. Para obtener más información sobre estas vulnerabilidades, consulte la sección Details de este aviso. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-capic-mdvul-HBsJBuvW • CWE-284: Improper Access Control •
CVSS: 9.0EPSS: 0%CPEs: 6EXPL: 0CVE-2021-1580 – Cisco Application Policy Infrastructure Controller Command Injection and File Upload Vulnerabilities
https://notcve.org/view.php?id=CVE-2021-1580
Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow a remote attacker to perform a command injection or file upload attack on an affected system. For more information about these vulnerabilities, see the Details section of this advisory. Múltiples vulnerabilidades en la interfaz de usuario web y los endpoints de la API de Cisco Application Policy Infrastructure Controller (APIC) o Cisco Cloud APIC podrían permitir a un atacante remoto llevar a cabo un ataque de inyección de comandos o de carga de archivos en un sistema afectado. Para obtener más información sobre estas vulnerabilidades, consulte la sección Details de este aviso. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-capic-mdvul-HBsJBuvW • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-284: Improper Access Control •
CVSS: 9.0EPSS: 0%CPEs: 6EXPL: 0CVE-2021-1579 – Cisco Application Policy Infrastructure Controller App Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2021-1579
A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an authenticated, remote attacker with Administrator read-only credentials to elevate privileges on an affected system. This vulnerability is due to an insufficient role-based access control (RBAC). An attacker with Administrator read-only credentials could exploit this vulnerability by sending a specific API request using an app with admin write credentials. A successful exploit could allow the attacker to elevate privileges to Administrator with write privileges on the affected device. Una vulnerabilidad en un endpoint de la API de Cisco Application Policy Infrastructure Controller (APIC) y Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) podría permitir a un atacante remoto autenticado con credenciales de sólo lectura de Administrador elevar los privilegios en un sistema afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-capic-chvul-CKfGYBh8 • CWE-250: Execution with Unnecessary Privileges CWE-269: Improper Privilege Management •
CVSS: 9.1EPSS: 0%CPEs: 6EXPL: 0CVE-2021-1577 – Cisco Application Policy Infrastructure Controller Arbitrary File Read and Write Vulnerability
https://notcve.org/view.php?id=CVE-2021-1577
A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an unauthenticated, remote attacker to read or write arbitrary files on an affected system. This vulnerability is due to improper access control. An attacker could exploit this vulnerability by using a specific API endpoint to upload a file to an affected device. A successful exploit could allow the attacker to read or write arbitrary files on an affected device. Una vulnerabilidad en un endpoint de la API de Cisco Application Policy Infrastructure Controller (APIC) y Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) podría permitir a un atacante remoto no autenticado leer o escribir archivos arbitrarios en un sistema afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-capic-frw-Nt3RYxR2 • CWE-284: Improper Access Control •