CVSS: 6.4EPSS: 78%CPEs: 1EXPL: 0CVE-2017-12285 – Cisco Prime Network Analysis Module graph sfile Parameter Directory Traversal Arbitrary File Deletion Vulnerability
https://notcve.org/view.php?id=CVE-2017-12285
19 Oct 2017 — A vulnerability in the web interface of Cisco Network Analysis Module Software could allow an unauthenticated, remote attacker to delete arbitrary files from an affected system, aka Directory Traversal. The vulnerability exists because the affected software does not perform proper input validation of HTTP requests that it receives and the software does not apply role-based access controls (RBACs) to requested HTTP URLs. An attacker could exploit this vulnerability by sending a crafted HTTP request to the af... • http://www.securityfocus.com/bid/101527 • CWE-20: Improper Input Validation CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.8EPSS: 0%CPEs: 12EXPL: 0CVE-2016-1390
https://notcve.org/view.php?id=CVE-2016-1390
04 Jun 2016 — Cisco Prime Network Analysis Module (NAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(1) and Prime Virtual Network Analysis Module (vNAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(1) allow local users to obtain root access via crafted CLI input, aka Bug ID CSCuy21892. Cisco Prime Network Analysis Module (NAM) en versiones anteriores a 6.1(1) patch.6.1-2-final y 6.2.x en versiones anteriores a 6.2(1) y Prime Virtual Network Analysis Module (vNAM) en versiones anteriores a 6.1(1) patch.6.1... • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160601-prime1 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 13EXPL: 0CVE-2016-1391
https://notcve.org/view.php?id=CVE-2016-1391
04 Jun 2016 — Cisco Prime Network Analysis Module (NAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(2) and Prime Virtual Network Analysis Module (vNAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(2) allow remote authenticated users to execute arbitrary OS commands via a crafted HTTP request, aka Bug ID CSCuy21889. Cisco Prime Network Analysis Module (NAM) en versiones anteriores a 6.1(1) patch.6.1-2-final y 6.2.x en versiones anteriores a 6.2(2) y Prime Virtual Network Analysis Module (vNAM) en versione... • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160601-prime2 • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2016-1370
https://notcve.org/view.php?id=CVE-2016-1370
03 Jun 2016 — Cisco Prime Network Analysis Module (NAM) before 6.2(1-b) miscalculates IPv6 payload lengths, which allows remote attackers to cause a denial of service (mond process crash and monitoring outage) via crafted IPv6 packets, aka Bug ID CSCuy37324. Cisco Prime Network Analysis Module (NAM) en versiones anteriores a 6.2(1-b) calcula mal las longitudes de payload IPv6, lo que permite a atacantes remotos provocar una denegación de servicio (caída de proceso mond e interrupción de monitorización) a través de paquet... • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160601-prime3 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 13EXPL: 0CVE-2016-1388
https://notcve.org/view.php?id=CVE-2016-1388
03 Jun 2016 — Cisco Prime Network Analysis Module (NAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(1) and Prime Virtual Network Analysis Module (vNAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(1) allow remote attackers to execute arbitrary OS commands via a crafted HTTP request, aka Bug ID CSCuy21882. Cisco Prime Network Analysis Module (NAM) en versiones anteriores a 6.1(1) patch.6.1-2-final y 6.2.x en versiones anteriores a 6.2(1) y Prime Virtual Network Analysis Module (vNAM) en versiones anterior... • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160601-prime • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2015-0656
https://notcve.org/view.php?id=CVE-2015-0656
04 Mar 2015 — Cross-site scripting (XSS) vulnerability in the login page in Cisco Network Analysis Module (NAM) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCum81269. Vulnerabilidad de XSS en la página de inicio de sesión en Cisco Network Analysis Module (NAM) permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través de vectores no especificados, también conocido como Bug ID CSCum81269. • http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0656 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 40EXPL: 0CVE-2007-1467
https://notcve.org/view.php?id=CVE-2007-1467
16 Mar 2007 — Multiple cross-site scripting (XSS) vulnerabilities in (1) PreSearch.html and (2) PreSearch.class in Cisco Secure Access Control Server (ACS), VPN Client, Unified Personal Communicator, MeetingPlace, Unified MeetingPlace, Unified MeetingPlace Express, CallManager, IP Communicator, Unified Video Advantage, Unified Videoconferencing 35xx products, Unified Videoconferencing Manager, WAN Manager, Security Device Manager, Network Analysis Module (NAM), CiscoWorks and related products, Wireless LAN Solution Engin... • http://secunia.com/advisories/24499 •
CVSS: 10.0EPSS: 3%CPEs: 10EXPL: 0CVE-2007-1257
https://notcve.org/view.php?id=CVE-2007-1257
03 Mar 2007 — The Network Analysis Module (NAM) in Cisco Catalyst Series 6000, 6500, and 7600 allows remote attackers to execute arbitrary commands via certain SNMP packets that are spoofed from the NAM's own IP address. El Módulo Network Analysis (NAM) del Cisco Catalyst Series 6000, 6500 y 7600 permite a atacantes remotos ejecutar comandos de su elección mediante ciertos paquetes SNMP que son simulados desde la propia dirección IP del NAM. • http://osvdb.org/33066 • CWE-20: Improper Input Validation •