CVSS: 5.3EPSS: 0%CPEs: 42EXPL: 0CVE-2020-26062 – Cisco Integrated Management Controller Username Enumeration Vulnerability
https://notcve.org/view.php?id=CVE-2020-26062
18 Nov 2024 — A vulnerability in Cisco Integrated Management Controller could allow an unauthenticated, remote attacker to enumerate valid usernames within the vulnerable application. The vulnerability is due to differences in authentication responses sent back from the application as part of an authentication attempt. An attacker could exploit this vulnerability by sending authentication requests to the affected application. A successful exploit could allow the attacker to confirm the names of administrative user a... • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-auth-zWkppJxL • CWE-203: Observable Discrepancy •
CVSS: 5.5EPSS: 0%CPEs: 43EXPL: 0CVE-2020-26063 – Cisco Integrated Management Controller Software Authorization Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2020-26063
18 Nov 2024 — A vulnerability in the API endpoints of Cisco Integrated Management Controller could allow an authenticated, remote attacker to bypass authorization and take actions on a vulnerable system without authorization. The vulnerability is due to improper authorization checks on API endpoints. An attacker could exploit this vulnerability by sending malicious requests to an API endpoint. An exploit could allow the attacker to download files from or modify limited configuration options on the affected system.Th... • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-auth-zWkppJxL • CWE-269: Improper Privilege Management •
CVSS: 6.6EPSS: 0%CPEs: 481EXPL: 0CVE-2024-20294
https://notcve.org/view.php?id=CVE-2024-20294
28 Feb 2024 — A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of specific fields in an LLDP frame. An attacker could exploit this vulnerability by sending a crafted LLDP packet to an interface of an affected device and having an authenticated user retrieve LLDP statistics from the affected de... • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-lldp-dos-z7PncTgt • CWE-805: Buffer Access with Incorrect Length Value •