CVE-2017-6778

Cisco Ultra Services Platform's Elastic Services Controller Web Interface (ESC) is affected. An authenticated, remote attacker can disclose sensitive deployment information via a GET request. Affected release: 21.0.v0.65839. Root cause: transmitting sensitive information as part of a GET request....

CVE-2017-6776

CVE-2017-6776 affects Cisco Elastic Services Controller (ESC) web framework. It allows an unauthenticated, remote attacker to perform cross-site scripting (XSS) by abusing insufficient validation of user-supplied input. Exploitation could execute arbitrary script code or access browser-based info...

CVE-2017-6786

A vulnerability in Cisco Elastic Services Controller could allow an authenticated, local, unprivileged attacker to access sensitive information, including credentials for system accounts, on an affected system. The vulnerability is due to improper protection of sensitive log files. An attacker...

CVE-2017-6772

CVE-2017-6772 affects Cisco Elastic Services Controller (ESC) v2.3(2). A vulnerability causes information disclosure due to insufficient protection of sensitive data. An authenticated, remote attacker can view sensitive system configuration files by logging in and navigating to certain configurat...

CVE-2017-6777

A vulnerability in the ConfD server of the Cisco Elastic Services Controller ESC could allow an authenticated, remote attacker to acquire sensitive system information. The vulnerability is due to insufficient protection of sensitive files on the system. An attacker could exploit this vulnerabilit...

Cisco Elastic Services Controller Cross-Site Scripting Vulnerability

A vulnerability in the web framework of Cisco Elastic Services Controller ESC could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface. The vulnerability is due to insufficient validation of user-supplied input by the affecte...

Cisco Elastic Services Controller Sensitive Log Information Disclosure Vulnerability

A vulnerability in Cisco Elastic Services Controller could allow an authenticated, local, unprivileged attacker to access sensitive information, including credentials for system accounts, on an affected system. The vulnerability is due to improper protection of sensitive log files. An attacker...

Cisco Elastic Services Controller Configuration Parameters Information Disclosure Vulnerability

A vulnerability in the ConfD server of the Cisco Elastic Services Controller ESC could allow an authenticated, remote attacker to acquire sensitive system information. The vulnerability is due to insufficient protection of sensitive files on the system. An attacker could exploit this vulnerabilit...

Cisco Elastic Services Controller Configuration Files Information Disclosure Vulnerability

A vulnerability in Cisco Elastic Services Controller ESC could allow an authenticated, remote attacker to view sensitive information. The vulnerability is due to insufficient protection of sensitive data. An attacker could exploit this vulnerability by authenticating to the application and...

Cisco Elastic Services Controller Unauthorized Access Vulnerability

Cisco Elastic Services Controller ESC is an open source modular system from Cisco USA. A security vulnerability exists in Play Framework in Cisco ESC versions prior to 2.3.1.434 and prior to 2.3.2, which stems from the use of static default certificates in the Cisco ESC UI. A remote attacker coul...

Cisco Elastic Services Controller Elevation of Privilege Vulnerability

Cisco Elastic Services Controller ESC is an open source modular system from Cisco USA. An arbitrary command execution vulnerability exists in Cisco ESC versions prior to 2.3.1.434 and prior to 2.3.2, which originates from a tomcat user on the system that can overwrite arbitrary files on the file...

Cisco Ultra Services Framework AutoVNF User Credential Information Disclosure Vulnerability

Cisco Ultra Services Framework is an intelligent online service delivery platform from Cisco.AutoVNF tool is one of the virtualized network tools. An information disclosure vulnerability exists in the AutoVNF tool in Cisco Ultra Services Framework versions prior to 5.0.3 and versions prior to 5.1...

CVE-2017-6712

A vulnerability in certain commands of Cisco Elastic Services Controller could allow an authenticated, remote attacker to elevate privileges to root and run dangerous commands on the server. The vulnerability occurs because a "tomcat" user on the system can run certain shell commands, allowing th...

CVE-2017-6713

A vulnerability in the Play Framework of Cisco Elastic Services Controller ESC could allow an unauthenticated, remote attacker to gain full access to the affected system. The vulnerability is due to static, default credentials for the Cisco ESC UI that are shared between installations. An attacke...

CVE-2017-6709

A vulnerability in the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to access administrative credentials for Cisco Elastic Services Controller ESC and Cisco OpenStack deployments in an affected system. The vulnerability exists because the...

CVE-2017-6712

A vulnerability in certain commands of Cisco Elastic Services Controller could allow an authenticated, remote attacker to elevate privileges to root and run dangerous commands on the server. The vulnerability occurs because a "tomcat" user on the system can run certain shell commands, allowing th...

Cross site scripting

A vulnerability in certain commands of Cisco Elastic Services Controller could allow an authenticated, remote attacker to elevate privileges to root and run dangerous commands on the server. The vulnerability occurs because a "tomcat" user on the system can run certain shell commands, allowing th...

CVE-2017-6713

A vulnerability in the Play Framework of Cisco Elastic Services Controller ESC could allow an unauthenticated, remote attacker to gain full access to the affected system. The vulnerability is due to static, default credentials for the Cisco ESC UI that are shared between installations. An attacke...

Default credentials

A vulnerability in the Play Framework of Cisco Elastic Services Controller ESC could allow an unauthenticated, remote attacker to gain full access to the affected system. The vulnerability is due to static, default credentials for the Cisco ESC UI that are shared between installations. An attacke...

CVE-2017-6712

CVE-2017-6712 affects Cisco Elastic Services Controller (ESC) prior to releases 2.3.1.434 and 2.3.2. The root cause is a misconfiguration allowing a "tomcat" user to execute shell commands, enabling arbitrary file overwrites and privilege escalation to root. Documents consistently describe an aut...