PT-2022-2559 · Cisco · Cisco Enterprise Nfv Infrastructure

Name of the Vulnerable Software and Affected Versions: Cisco Enterprise NFV Infrastructure Software NFVIS affected versions not specified Description: The issue is related to multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software NFVIS that could allow an attacker to escape from...

CVE-2022-20780: Improper Access Control

Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software NFVIS could allow an attacker to escape from the guest virtual machine VM to the host machine, inject commands that execute at the root level, or leak system data from the host to the VM. For more information about these...

PT-2021-7025

Name of the Vulnerable Software and Affected Versions Cisco Enterprise NFV Infrastructure Software NFVIS affected versions not specified Description The issue concerns multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software NFVIS that could allow an attacker to escape from the...

PT-2021-7018

Name of the Vulnerable Software and Affected Versions Cisco Enterprise NFV Infrastructure Software NFVIS affected versions not specified Description The issue is related to insufficient access control in the image registration process of Cisco Enterprise NFV Infrastructure Software NFVIS, which...

Cisco Enterprise NFV Infrastructure Software Privilege Escalation

The vulnerability of the TACACS authentication system in Cisco Enterprise NFV Infrastructure Software NFVIS relates to bypassing authentication using an alternative username. Exploiting this vulnerability allows a malicious actor to elevate their privileges to the level of an administrator...

CVE-2021-34746 Cisco Enterprise NFV Infrastructure Software Authentication Bypass Vulnerability

A vulnerability in the TACACS+ authentication, authorization and accounting AAA feature of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an unauthenticated, remote attacker to bypass authentication and log in to an affected device as an administrator. This vulnerability is due to...

CVE-2021-34746: Authentication Bypass by Alternate Name

A vulnerability in the TACACS+ authentication, authorization and accounting AAA feature of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an unauthenticated, remote attacker to bypass authentication and log in to an affected device as an administrator. This vulnerability is due to...

CVE-2021-1421

A vulnerability in Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, local attacker to perform a command injection attack on an affected device. The vulnerability is due to insufficient validation of user-supplied input to a configuration command. An attacker could...

CVE-2021-1421: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, local attacker to perform a command injection attack on an affected device. The vulnerability is due to insufficient validation of user-supplied input to a configuration command. An attacker could...

PT-2021-2981

Name of the Vulnerable Software and Affected Versions Cisco Enterprise NFV Infrastructure Software NFVIS affected versions not specified Description A vulnerability in Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, local attacker to perform a command injection...

CVE-2021-1127

Cisco Enterprise NFV Infrastructure Software (NFVIS) web-based management interface is affected by a cross-site scripting (XSS) vulnerability caused by improper input validation of log file contents. An authenticated attacker could modify a log file to include malicious code and persuade a user t...

CVE-2021-1127

A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface. The vulnerability is due to improper input...

CVE-2021-1127: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface. The vulnerability is due to improper input...

PT-2021-1633

Name of the Vulnerable Software and Affected Versions: Cisco Enterprise NFV Infrastructure Software NFVIS affected versions not specified Description: A vulnerability in the web-based management interface could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack...

CVE-2020-3365

A vulnerability in the directory permissions of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to perform a directory traversal attack on a limited set of restricted directories. The vulnerability is due to a flaw in the logic that governs directo...

CVE-2020-3478: Improper Input Validation

A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to overwrite certain files that should be restricted on an affected device. The vulnerability is due to insufficient authorization enforcement on an affected system...

CVE-2020-3365: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in the directory permissions of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to perform a directory traversal attack on a limited set of restricted directories. The vulnerability is due to a flaw in the logic that governs directo...

Cisco Releases Security Updates

Cisco has released security updates to address vulnerabilities in Cisco products. An attacker could exploit some of these vulnerabilities to take control of an affected system. For updates addressing lower severity vulnerabilities see the Cisco Security Advisories page. The Cybersecurity and...

PT-2020-3844

Name of the Vulnerable Software and Affected Versions: Cisco Enterprise NFV Infrastructure Software NFVIS affected versions not specified Description: The issue is related to insufficient authorization enforcement in the REST API of the software, allowing an authenticated, remote attacker to...

PT-2020-3853

Name of the Vulnerable Software and Affected Versions: Cisco Enterprise NFV Infrastructure Software NFVIS affected versions not specified Description: A flaw in the directory permissions logic of the software could allow an authenticated, remote attacker to perform a directory traversal attack on...