Cisco APIC-EM 1.x < 1.5 Unauthorized Access (credentialed check)

According to its self-reported version number, the Cisco Application Policy Infrastructure Controller Enterprise Module APIC-EM application running on the remote host is 1.x prior to 1.5. It is, therefore, affected by a vulnerability within the firewall configuration of the Cisco Application Poli...

CVE-2017-12262: Improper Access Control

A vulnerability within the firewall configuration of the Cisco Application Policy Infrastructure Controller Enterprise Module APIC-EM could allow an unauthenticated, adjacent attacker to gain privileged access to services only available on the internal network of the device. The vulnerability is...

CVE-2016-1365: Improper Input Validation

The Grapevine update process in Cisco Application Policy Infrastructure Controller Enterprise Module APIC-EM 1.0 allows remote authenticated users to execute arbitrary commands as root via a crafted upgrade parameter, aka Bug ID CSCux15507...

CVE-2016-1386: Undefined Security Weakness

The API in Cisco Application Policy Infrastructure Controller Enterprise Module APIC-EM 1.01 allows remote attackers to spoof administrative notifications via crafted attribute-value pairs, aka Bug ID CSCux15521...

CVE-2016-1318: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Cisco Application Policy Infrastructure Controller Enterprise Module APIC-EM 1.1 allows remote attackers to inject arbitrary web script or HTML via crafted markup data, aka Bug ID CSCux15489...

CVE-2016-1305: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Cisco Application Policy Infrastructure Controller Enterprise Module APIC-EM 1.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving HTML entities, aka Bug ID CSCux15511...

CVE-2015-6337: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Cisco Application Policy Infrastructure Controller Enterprise Module APIC-EM 1.0.10 allows remote attackers to inject arbitrary web script or HTML via a crafted hostname in an SNMP response, aka Bug ID CSCuw47238...