CVE-2021-1577

A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller APIC and Cisco Cloud Application Policy Infrastructure Controller Cloud APIC could allow an unauthenticated, remote attacker to read or write arbitrary files on an affected system. This vulnerability is due t...

PT-2021-5381

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller APIC or Cisco Cloud APIC affected versions not specified Description The issue is related to multiple vulnerabilities in the web UI and API endpoints of the affected system, which could allow ...

PT-2021-5013

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller APIC or Cisco Cloud APIC affected versions not specified Description A vulnerability in the web UI of Cisco Application Policy Infrastructure Controller APIC or Cisco Cloud APIC could allow an...

PT-2021-13524

Name of the Vulnerable Software and Affected Versions: Cisco Application Policy Infrastructure Controller APIC and Cisco Cloud Application Policy Infrastructure Controller Cloud APIC affected versions not specified Description: A vulnerability in an API endpoint could allow an authenticated, remo...

CVE-2021-1582: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web UI of Cisco Application Policy Infrastructure Controller APIC or Cisco Cloud APIC could allow an authenticated, remote attacker to perform a stored cross-site scripting attack on an affected system. This vulnerability is due to improper input validation in the web UI. A...

CVE-2021-1581: Improper Access Control

Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller APIC or Cisco Cloud APIC could allow a remote attacker to perform a command injection or file upload attack on an affected system. For more information about these vulnerabilities, see t...

CVE-2021-1580: Improper Access Control

Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller APIC or Cisco Cloud APIC could allow a remote attacker to perform a command injection or file upload attack on an affected system. For more information about these vulnerabilities, see t...

CVE-2021-1578: Not Failing Securely

A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller APIC and Cisco Cloud Application Policy Infrastructure Controller Cloud APIC could allow an authenticated, remote attacker to elevate privileges to Administrator on an affected device. This vulnerability is d...

CVE-2021-1577: Improper Access Control

A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller APIC and Cisco Cloud Application Policy Infrastructure Controller Cloud APIC could allow an unauthenticated, remote attacker to read or write arbitrary files on an affected system. This vulnerability is due t...

PT-2021-5382

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller APIC or Cisco Cloud APIC affected versions not specified Description The issue is related to multiple vulnerabilities in the web UI and API endpoints of the affected system. A remote attacker...

PT-2021-25444

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.46 Description: The issue concerns illegal APIC register access in the LAPIC component of the KVM. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...

PT-2021-25384

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.128 Description: The issue concerns the KVM LAPIC, where a guard was not properly restored, potentially allowing illegal APIC register access. The actual impact and attack plausibility have not yet been...

PT-2021-29438

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.46 Description The issue concerns the KVM LAPIC, where a guard was not properly restored, potentially allowing illegal APIC register access. The actual impact and attack plausibility have not yet been prove...

PT-2021-29378

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.128 Description The issue concerns the KVM LAPIC, where a guard was not properly restored, potentially allowing illegal APIC register access. The actual impact and attack plausibility have not yet been prove...

Security Bulletin: Certificates not removed from DataPower ValCred when updating corresponding APIc truststore (CVE-2020-4205)

Summary When a certificate is removed from an APIc TrustStore, the correspsonding DataPower ValCred may not be updated to match. Vulnerability Details CVEID: CVE-2020-4205 DESCRIPTION: IBM DataPower Gateway could allow an authenticated user to bypass security restrictions, and continue to access...

PT-2024-11262

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the Linux kernel, where an access to bytes 4 through 15 of an APIC register may cause undefined behavior. This access in kvm lapic reg read can result in a leak o...

Cisco Releases Security Patches for Critical Flaws Affecting its Products

Cisco has addressed a maximum severity vulnerability in its Application Centric Infrastructure ACI Multi-Site Orchestrator MSO that could allow an unauthenticated, remote attacker to bypass authentication on vulnerable devices. "An attacker could exploit this vulnerability by sending a crafted...

Authentication flaw

A vulnerability in an API endpoint of Cisco ACI Multi-Site Orchestrator MSO installed on the Application Services Engine could allow an unauthenticated, remote attacker to bypass authentication on an affected device. The vulnerability is due to improper token validation on a specific API endpoint...

CVE-2021-1388 Cisco ACI Multi-Site Orchestrator Application Services Engine Deployment Authentication Bypass Vulnerability

A vulnerability in an API endpoint of Cisco ACI Multi-Site Orchestrator MSO installed on the Application Services Engine could allow an unauthenticated, remote attacker to bypass authentication on an affected device. The vulnerability is due to improper token validation on a specific API endpoint...

CVE-2021-1228

CVE-2021-1228 affects Cisco Nexus 9000 Series Fabric Switches in ACI Mode . The issue arises in the LLDP setup phase of the infrastructure VLAN due to insufficient security requirements, enabling an unauthenticated, adjacent attacker to send a crafted LLDP packet and connect an unauthorised serve...