CVE-2021-1272

CVE-2021-1272 describes a SSRF in Cisco Data Center Network Manager (DCNM) where insufficient validation of parameters in a specific HTTP request allows an unauthenticated, remote attacker to bypass access controls and gain unauthorized access to the Device Manager application. The issue affects ...

CVE-2021-1276

Cisco Data Center Network Manager (DCNM) contains certificate-validation vulnerabilities that arise when establishing HTTPS connections, due to insufficient certificate validation. These flaws could allow an attacker to spoof a trusted host or mount a man-in-the-middle to extract sensitive inform...

CVE-2021-1277

CVE-2021-1277 relates to Cisco Data Center Network Manager (DCNM) certificate validation vulnerabilities. The root cause is insufficient certificate validation when DCNM establishes HTTPS connections, enabling an attacker to spoof a trusted host or perform a MITM to intercept/alter sensitive API ...

CVE-2021-1283

Cisco Data Center Network Manager (DCNM) is affected by an information-disclosure vulnerability in its logging subsystem. The issue arises because sensitive data is not properly masked before being written to system log files, allowing an authenticated, local attacker with valid credentials to vi...

CVE-2021-1286

CVE-2021-1286 affects Cisco Data Center Network Manager (DCNM) – the web-based management interface is vulnerable to cross-site scripting (XSS) and a reflected file download (RFD) when accessed by an authenticated network-operator. The root cause is insufficient input validation in the DCNM web i...

CVE-2021-1133

Cisco DCNM REST API vulnerabilities allow an authenticated, remote attacker to view, modify, and delete data due to insufficient API input validation, including a path traversal issue described in CNVD-2021-09309. The CVE entry covers multiple REST API weaknesses in DCNM, affecting version prior ...

Cisco Data Center Network Manager Certificate Validation Vulnerabilities

Multiple vulnerabilities in Cisco Data Center Network Manager DCNM could allow an attacker to spoof a trusted host or construct a man-in-the-middle attack to extract sensitive information or alter certain API requests. These vulnerabilities are due to insufficient certificate validation when...

Cisco Data Center Network Manager Authorization Bypass Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker to view, modify, and delete data without proper authorization. For more information about these vulnerabilities, see the Details "details" section...

CVE-2021-1286: Improper Input Validation

Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager DCNM could allow a remote attacker with network-operator privileges to conduct a cross-site scripting XSS attack or a reflected file download RFD attack against a user of the interface. For more...

CVE-2021-1270: Incorrect Authorization

Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker to view, modify, and delete data without proper authorization. For more information about these vulnerabilities, see the Details section of this...

CVE-2021-1272: Server-Side Request Forgery (SSRF)

A vulnerability in the session validation feature of Cisco Data Center Network Manager DCNM could allow an unauthenticated, remote attacker to bypass access controls and conduct a server-side request forgery SSRF attack on a targeted system. This vulnerability is due to insufficient validation of...

CVE-2021-1277: Improper Certificate Validation

Multiple vulnerabilities in Cisco Data Center Network Manager DCNM could allow an attacker to spoof a trusted host or construct a man-in-the-middle attack to extract sensitive information or alter certain API requests. These vulnerabilities are due to insufficient certificate validation when...

CVE-2020-3522

A vulnerability in the web-based management interface of Cisco Data Center Network Manager DCNM Software could allow an authenticated, remote attacker to bypass authorization on an affected device and access sensitive information that is related to the device. The vulnerability exists because the...

CVE-2020-3519

A vulnerability in a specific REST API method of Cisco Data Center Network Manager DCNM Software could allow an authenticated, remote attacker to conduct a path traversal attack on an affected device. The vulnerability is due to insufficient validation of user-supplied input to the API. An attack...

CVE-2020-3520

A vulnerability in Cisco Data Center Network Manager DCNM Software could allow an authenticated, local attacker to obtain confidential information from an affected device. The vulnerability is due to insufficient protection of confidential information on an affected device. An attacker at any...

Directory traversal

A vulnerability in a specific REST API of Cisco Data Center Network Manager DCNM Software could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. The vulnerability is due to insufficient validation of user-supplied input to the API. An attacker...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Data Center Network Manager DCNM Software could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. The vulnerability exists because the web-based management interface...

Path traversal

A vulnerability in a specific REST API method of Cisco Data Center Network Manager DCNM Software could allow an authenticated, remote attacker to conduct a path traversal attack on an affected device. The vulnerability is due to insufficient validation of user-supplied input to the API. An attack...

CVE-2020-3439

CVE-2020-3439 affects Cisco Data Center Network Manager (DCNM) web-based management interface. A stored XSS vulnerability arises from insufficient input validation in a data field, enabling an authenticated, remote attacker to inject script and potentially access browser-based information. Impact...

CVE-2020-3518 Cisco Data Center Network Manager Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Data Center Network Manager DCNM Software could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface of the affected software. The vulnerability exists because the...