PT-2016-4697

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller Enterprise Module APIC-EM version 1.1 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via vectors involving HTML entities...

CVE-2016-1302: Improper Access Control

Cisco Application Policy Infrastructure Controller APIC devices with software before 1.03h and 1.1 before 1.11j and Nexus 9000 ACI Mode switches with software before 11.03h and 11.1 before 11.11j allow remote authenticated users to bypass intended RBAC restrictions via crafted REST requests, aka...

PT-2016-1475

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller APIC versions prior to 1.03h and prior to 1.11j Nexus 9000 ACI Mode switches versions prior to 11.03h and prior to 11.11j Description The issue is related to inadequate access control in the...

Cisco Application Policy Infrastructure Controller Access Control Vulnerability

A vulnerability in the role-based access control RBAC of the Cisco Application Policy Infrastructure Controller APIC could allow an authenticated remote user to make configuration changes outside of their configured access privileges. The vulnerability is due to eligibility logic in the RBAC...

CVE-2015-6337: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Cisco Application Policy Infrastructure Controller Enterprise Module APIC-EM 1.0.10 allows remote attackers to inject arbitrary web script or HTML via a crafted hostname in an SNMP response, aka Bug ID CSCuw47238...

Cisco Application Policy Infrastructure Controller Local Privileging Vulnerability

The Cisco Application Policy Infrastructure Controller is a controller that automates the management of application-centric infrastructure ACI. A security vulnerability exists in the Cisco Application Policy Infrastructure Controller that allows a local attacker to gain root privileges...

CVE-2015-6424: Undefined Security Weakness

The boot manager in Cisco Application Policy Infrastructure Controller APIC 1.10.920a allows local users to bypass intended access restrictions and obtain single-user-mode root access via unspecified vectors, aka Bug ID CSCuu83985...

PT-2015-7245

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller APIC version 1.10.920a Description The issue allows local users to bypass intended access restrictions and obtain single-user-mode root access. Recommendations For Cisco Application Policy...

CVE-2015-6333: Undefined Security Weakness

Cisco Application Policy Infrastructure Controller APIC 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076...

PT-2015-7187

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller APIC version 1.1j Description The issue allows local users to gain privileges through certain vectors involving the addition of an SSH key. Recommendations For Cisco Application Policy...

Cisco Application Policy Infrastructure Controller privilege escalation

It's possible to obtain root access...

CVE-2015-4235: Undefined Security Weakness

Cisco Application Policy Infrastructure Controller APIC devices with software before 1.03o and 1.1 before 1.11j and Nexus 9000 ACI devices with software before 11.04o and 11.1 before 11.11j do not properly restrict access to the APIC filesystem, which allows remote authenticated users to obtain...

PT-2015-2239

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller APIC versions prior to 1.03o and 1.1 prior to 1.11j Nexus 9000 ACI devices versions prior to 11.04o and 11.1 prior to 11.11j Description The issue is related to insufficient access restriction...

CVE-2015-4225: Undefined Security Weakness

Cisco Application Policy Infrastructure Controller APIC 1.01.110a and 1.01e on Nexus 9000 devices does not properly implement RBAC health scoring, which allows remote authenticated users to obtain sensitive information via unspecified vectors, aka Bug ID CSCuq77485...

PT-2015-2234

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller APIC versions 1.01.110a through 1.01e Description The issue is related to improper implementation of Role-Based Access Control RBAC health scoring, allowing remote authenticated users to obtai...

Cisco Application Policy Infrastructure Controller Unauthorized Access Vulnerability

A vulnerability in the role-based access control RBAC of the Cisco Application Policy Infrastructure Controller Cisco APIC could allow an authenticated, remote attacker to have read access to certain information stored in the affected system. The vulnerability is due to improper handling of RBAC...