CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2024-20536 – Cisco Nexus Dashboard Fabric Controller SQL Injection Vulnerability
https://notcve.org/view.php?id=CVE-2024-20536
06 Nov 2024 — A vulnerability in a REST API endpoint and web-based management interface of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, remote attacker with read-only privileges to execute arbitrary SQL commands on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to a specific REST API endpoint or web-based management interface. A successful exploit could allow the atta... • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-sqli-CyPPAxrL • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.6EPSS: 0%CPEs: 31EXPL: 0CVE-2024-20490 – Cisco Nexus Dashboard Fabric Controller and Nexus Dashboard Orchestrator Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2024-20490
02 Oct 2024 — A vulnerability in a logging function of Cisco Nexus Dashboard Fabric Controller (NDFC) and Cisco Nexus Dashboard Orchestrator (NDO) could allow an attacker with access to a tech support file to view sensitive information. This vulnerability exists because HTTP proxy credentials could be recorded in an internal log that is stored in the tech support file. An attacker could exploit this vulnerability by accessing a tech support file that is generated from an affected system. A successful exploit could allow ... • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndhs-idv-Bk8VqEDc •
CVSS: 5.5EPSS: 0%CPEs: 11EXPL: 0CVE-2024-20477 – Cisco Nexus Dashboard Fabric Controller Unauthorized REST API Endpoint Vulnerability
https://notcve.org/view.php?id=CVE-2024-20477
02 Oct 2024 — A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to upload or delete files on an affected device. This vulnerability exists because of missing authorization controls on the affected REST API endpoint. An attacker could exploit this vulnerability by sending crafted API requests to the affected endpoint. A successful exploit could allow the attacker to upload files into a specific container or delete files from a specific folder within... • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndhs-uaapi-Jh4V6zpN •
CVSS: 9.0EPSS: 0%CPEs: 11EXPL: 0CVE-2024-20449 – Cisco Nexus Dashboard Fabric Controller Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-20449
02 Oct 2024 — A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, remote attacker with low privileges to execute arbitrary code on an affected device. This vulnerability is due to improper path validation. An attacker could exploit this vulnerability by using the Secure Copy Protocol (SCP) to upload malicious code to an affected device using path traversal techniques. A successful exploit could allow the attacker to execute arbitrary code in a specific container with the p... • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-ptrce-BUSHLbp •
CVSS: 8.6EPSS: 0%CPEs: 38EXPL: 0CVE-2024-20448 – Cisco Nexus Dashboard Fabric Controller Credential Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2024-20448
02 Oct 2024 — A vulnerability in the Cisco Nexus Dashboard Fabric Controller (NDFC) software, formerly Cisco Data Center Network Manager (DCNM), could allow an attacker with access to a backup file to view sensitive information. This vulnerability is due to the improper storage of sensitive information within config only and full backup files. An attacker could exploit this vulnerability by parsing the contents of a backup file that is generated from an affected device. A successful exploit could allow the attacker to ac... • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-cidv-XvyX2wLj •
CVSS: 6.8EPSS: 0%CPEs: 38EXPL: 0CVE-2024-20444 – Cisco Nexus Dashboard Fabric Controller REST API Command Injection Vulnerability
https://notcve.org/view.php?id=CVE-2024-20444
02 Oct 2024 — A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC), formerly Cisco Data Center Network Manager (DCNM), could allow an authenticated, remote attacker with network-admin privileges to perform a command injection attack against an affected device. This vulnerability is due to insufficient validation of command arguments. An attacker could exploit this vulnerability by submitting crafted command arguments to a specific REST API endpoint. A successful exploit could allow the attacker to ove... • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-raci-T46k3jnN •
CVSS: 6.8EPSS: 0%CPEs: 11EXPL: 0CVE-2024-20441 – Cisco Nexus Dashboard Fabric Controller Unauthorized API Endpoint Vulnerability
https://notcve.org/view.php?id=CVE-2024-20441
02 Oct 2024 — A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to learn sensitive information on an affected device. This vulnerability is due to insufficient authorization controls on the affected REST API endpoint. An attacker could exploit this vulnerability by sending crafted API requests to the affected endpoint. A successful exploit could allow the attacker to download config only or full backup files and learn sensitive configuration i... • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndhs-uaapi-Jh4V6zpN •
CVSS: 6.3EPSS: 0%CPEs: 11EXPL: 0CVE-2024-20438 – Cisco Nexus Dashboard Fabric Controller Unauthorized REST API Vulnerability
https://notcve.org/view.php?id=CVE-2024-20438
02 Oct 2024 — A vulnerability in the REST API endpoints of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to read or write files on an affected device. This vulnerability exists because of missing authorization controls on some REST API endpoints. An attacker could exploit this vulnerability by sending crafted API requests to an affected endpoint. A successful exploit could allow the attacker to perform limited network-admin functions such as reading device configuration information, uploading f... • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndhs-uaapi-Jh4V6zpN •
CVSS: 9.9EPSS: 1%CPEs: 11EXPL: 0CVE-2024-20432 – Cisco Nexus Dashboard Fabric Controller Web UI Command Injection Vulnerability
https://notcve.org/view.php?id=CVE-2024-20432
02 Oct 2024 — A vulnerability in the REST API and web UI of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attacker to perform a command injection attack against an affected device. This vulnerability is due to improper user authorization and insufficient validation of command arguments. An attacker could exploit this vulnerability by submitting crafted commands to an affected REST API endpoint or through the web UI. A successful exploit could allow the attacker... • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-cmdinj-UvYZrKfr •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-20348
https://notcve.org/view.php?id=CVE-2024-20348
03 Apr 2024 — A vulnerability in the Out-of-Band (OOB) Plug and Play (PnP) feature of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauthenticated, remote attacker to read arbitrary files. This vulnerability is due to an unauthenticated provisioning web server. An attacker could exploit this vulnerability through direct web requests to the provisioning server. A successful exploit could allow the attacker to read sensitive files in the PnP container that could facilitate further attacks on the PnP infras... • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-dir-trav-SSn3AYDw • CWE-27: Path Traversal: 'dir/../../filename' •