PT-2016-4697

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller Enterprise Module APIC-EM version 1.1 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via vectors involving HTML entities...

PT-2016-1475

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller APIC versions prior to 1.03h and prior to 1.11j Nexus 9000 ACI Mode switches versions prior to 11.03h and prior to 11.11j Description The issue is related to inadequate access control in the...

Cisco Application Policy Infrastructure Controller Access Control Vulnerability

A vulnerability in the role-based access control RBAC of the Cisco Application Policy Infrastructure Controller APIC could allow an authenticated remote user to make configuration changes outside of their configured access privileges. The vulnerability is due to eligibility logic in the RBAC...

CVE-2015-6337: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Cisco Application Policy Infrastructure Controller Enterprise Module APIC-EM 1.0.10 allows remote attackers to inject arbitrary web script or HTML via a crafted hostname in an SNMP response, aka Bug ID CSCuw47238...

Cisco Application Policy Infrastructure Controller Local Privileging Vulnerability

The Cisco Application Policy Infrastructure Controller is a controller that automates the management of application-centric infrastructure ACI. A security vulnerability exists in the Cisco Application Policy Infrastructure Controller that allows a local attacker to gain root privileges...

PT-2015-7245

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller APIC version 1.10.920a Description The issue allows local users to bypass intended access restrictions and obtain single-user-mode root access. Recommendations For Cisco Application Policy...

CVE-2015-6424: Undefined Security Weakness

The boot manager in Cisco Application Policy Infrastructure Controller APIC 1.10.920a allows local users to bypass intended access restrictions and obtain single-user-mode root access via unspecified vectors, aka Bug ID CSCuu83985...

Cisco Application Policy Infrastructure Controller Elevation of Privilege Vulnerability

Cisco Application Policy Infrastructure Controller devices are an application-centric infrastructure ACI controller product. Cisco Application Policy Infrastructure Controller devices do not properly validate SSH keys added to accounts by local users, allowing a local attacker to exploit the...

CVE-2015-6333: Undefined Security Weakness

Cisco Application Policy Infrastructure Controller APIC 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076...

PT-2015-7187

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller APIC version 1.1j Description The issue allows local users to gain privileges through certain vectors involving the addition of an SSH key. Recommendations For Cisco Application Policy...

CVE-2015-6259

CVE-2015-6259 affects Cisco Integrated Management Controller (IMC) Supervisor prior to 1.0.0.1 and Cisco UCS Director prior to 5.2.0.1. The JSP component enables remote attackers to overwrite arbitrary files via crafted HTTP requests, a vulnerability tracked as CSCus36435/CSCus62625. The issue is...

Cisco Application Policy Infrastructure Controller privilege escalation

It's possible to obtain root access...

PT-2015-2239

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller APIC versions prior to 1.03o and 1.1 prior to 1.11j Nexus 9000 ACI devices versions prior to 11.04o and 11.1 prior to 11.11j Description The issue is related to insufficient access restriction...

CVE-2015-4235: Undefined Security Weakness

Cisco Application Policy Infrastructure Controller APIC devices with software before 1.03o and 1.1 before 1.11j and Nexus 9000 ACI devices with software before 11.04o and 11.1 before 11.11j do not properly restrict access to the APIC filesystem, which allows remote authenticated users to obtain...

Cisco Nexus 9000 Application Policy Infrastructure Controller Unauthorized Access Vulnerability

The Cisco Application Policy Infrastructure Controller APIC on Nexus 9000 devices is a Cisco controller that runs on 9000 series switch devices to automate the management of application-centric infrastructure ACI. It supports access to all ACI information, optimizing the application lifecycle,...

CVE-2015-4225: Undefined Security Weakness

Cisco Application Policy Infrastructure Controller APIC 1.01.110a and 1.01e on Nexus 9000 devices does not properly implement RBAC health scoring, which allows remote authenticated users to obtain sensitive information via unspecified vectors, aka Bug ID CSCuq77485...

PT-2015-2234

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller APIC versions 1.01.110a through 1.01e Description The issue is related to improper implementation of Role-Based Access Control RBAC health scoring, allowing remote authenticated users to obtai...

Cisco Application Policy Infrastructure Controller Unauthorized Access Vulnerability

A vulnerability in the role-based access control RBAC of the Cisco Application Policy Infrastructure Controller Cisco APIC could allow an authenticated, remote attacker to have read access to certain information stored in the affected system. The vulnerability is due to improper handling of RBAC...