CVE-2016-1420

The installation component on Cisco Application Policy Infrastructure Controller APIC devices with software before 1.32f mishandles binary files, which allows local users to obtain root access via unspecified vectors, aka Bug ID CSCuz72347...

CVE-2016-1420: Undefined Security Weakness

The installation component on Cisco Application Policy Infrastructure Controller APIC devices with software before 1.32f mishandles binary files, which allows local users to obtain root access via unspecified vectors, aka Bug ID CSCuz72347...

Cisco Application Policy Infrastructure Controller Binary Files Privilege Escalation Vulnerability

A vulnerability in the installation procedure for Cisco Application Policy Infrastructure Controller APIC devices could allow an authenticated, local attacker to gain root-level privileges. The vulnerability is due to the use of incorrect installation and permissions settings for binary files...

CVE-2016-1386: Undefined Security Weakness

The API in Cisco Application Policy Infrastructure Controller Enterprise Module APIC-EM 1.01 allows remote attackers to spoof administrative notifications via crafted attribute-value pairs, aka Bug ID CSCux15521...

The vulnerability of the NX-OS network operating system and the Application Policy Infrastructure Controller software allows a perpetrator to circumvent existing access restrictions based on RBAC.

The vulnerability of the NX-OS network operating system and the Application Policy Infrastructure Controller software is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to circumvent existing access restrictions using a...

Cisco Application Policy Infrastructure Controller Enterprise Module Detection (HTTP)

HTTP based detection of Cisco Application Policy Infrastructure Controller Enterprise Module. Note: When HTTP credentials are given, the script is able to extract version and patch information from the application. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpte...

Cisco Application Policy Infrastructure Controller Cross Site Scripting Vulnerability (cisco-sa-20160208-apic)

Cisco Application Policy Infrastructure Controller is prone to a cross-site scripting vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Cisco Application Policy Infrastructure Controller Detection (HTTP)

HTTP based detection of Cisco Application Policy Infrastructure Controller. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

CVE-2016-1318: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Cisco Application Policy Infrastructure Controller Enterprise Module APIC-EM 1.1 allows remote attackers to inject arbitrary web script or HTML via crafted markup data, aka Bug ID CSCux15489...

Cisco Application Policy Infrastructure Controller Cross-Site Scripting Vulnerability

The Cisco Application Policy Infrastructure Controller APIC is the U.S. A controller that automates the management of application-centric infrastructure ACI. A cross-site scripting vulnerability exists in the Cisco Application Policy Infrastructure Controller, which can be exploited by remote...

CVE-2016-1302: Improper Access Control

Cisco Application Policy Infrastructure Controller APIC devices with software before 1.03h and 1.1 before 1.11j and Nexus 9000 ACI Mode switches with software before 11.03h and 11.1 before 11.11j allow remote authenticated users to bypass intended RBAC restrictions via crafted REST requests, aka...

CVE-2016-1305: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Cisco Application Policy Infrastructure Controller Enterprise Module APIC-EM 1.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving HTML entities, aka Bug ID CSCux15511...

Cisco Application Policy Infrastructure Controller Access Control Vulnerability

A vulnerability in the role-based access control RBAC of the Cisco Application Policy Infrastructure Controller APIC could allow an authenticated remote user to make configuration changes outside of their configured access privileges. The vulnerability is due to eligibility logic in the RBAC...

CVE-2015-6337: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Cisco Application Policy Infrastructure Controller Enterprise Module APIC-EM 1.0.10 allows remote attackers to inject arbitrary web script or HTML via a crafted hostname in an SNMP response, aka Bug ID CSCuw47238...

Cisco Application Policy Infrastructure Controller Local Privileging Vulnerability

The Cisco Application Policy Infrastructure Controller is a controller that automates the management of application-centric infrastructure ACI. A security vulnerability exists in the Cisco Application Policy Infrastructure Controller that allows a local attacker to gain root privileges...

CVE-2015-6424: Undefined Security Weakness

The boot manager in Cisco Application Policy Infrastructure Controller APIC 1.10.920a allows local users to bypass intended access restrictions and obtain single-user-mode root access via unspecified vectors, aka Bug ID CSCuu83985...

Cisco Application Policy Infrastructure Controller Elevation of Privilege Vulnerability

Cisco Application Policy Infrastructure Controller devices are an application-centric infrastructure ACI controller product. Cisco Application Policy Infrastructure Controller devices do not properly validate SSH keys added to accounts by local users, allowing a local attacker to exploit the...

PT-2015-7187

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller APIC version 1.1j Description The issue allows local users to gain privileges through certain vectors involving the addition of an SSH key. Recommendations For Cisco Application Policy...

CVE-2015-6333: Undefined Security Weakness

Cisco Application Policy Infrastructure Controller APIC 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076...

CVE-2015-6259

CVE-2015-6259 affects Cisco Integrated Management Controller (IMC) Supervisor prior to 1.0.0.1 and Cisco UCS Director prior to 5.2.0.1. The JSP component enables remote attackers to overwrite arbitrary files via crafted HTTP requests, a vulnerability tracked as CSCus36435/CSCus62625. The issue is...