PT-2020-3773

Name of the Vulnerable Software and Affected Versions: Cisco Virtual Wide Area Application Services vWAAS with Cisco Enterprise NFV Infrastructure Software NFVIS-bundled images for Cisco ENCS 5400-W Series and CSP 5000-W Series appliances affected versions not specified Description: A vulnerabili...

CVE-2020-3236

A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, local attacker to gain root shell access to the underlying operating system and overwrite or read arbitrary files. The attacker would need valid administrative credentials. This...

CVE-2020-3236: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, local attacker to gain root shell access to the underlying operating system and overwrite or read arbitrary files. The attacker would need valid administrative credentials. This...

Cisco Enterprise NFV Infrastructure Software Path Traversal Vulnerability (CNVD-2020-41804)

Cisco Enterprise NFV Infrastructure Software NFVIS is a suite of NVF infrastructure software platforms from Cisco. The platform can be achieved through the central coordinator and controller of the virtualization services of the full lifecycle management. A path traversal vulnerability exists in...

PT-2020-2967

Name of the Vulnerable Software and Affected Versions Cisco Enterprise NFV Infrastructure Software NFVIS affected versions not specified Description A vulnerability exists due to improper input validation of CLI command arguments, allowing an authenticated, local attacker with valid administrativ...

Cisco Enterprise NFV Infrastructure Software Remote Code Execution Vulnerability

Cisco Enterprise NFV Infrastructure Software is a lightweight virtualization platform that integrates complete VM lifecycle management, monitoring, device programmability, and service chaining in one installable package. A remote code execution vulnerability exists in the upgrade component of Cis...

CVE-2020-3138: Improper Verification of Cryptographic Signature

A vulnerability in the upgrade component of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, local attacker to install a malicious file when upgrading. The vulnerability is due to insufficient signature validation. An attacker could exploit this vulnerability by...

PT-2020-1760

Name of the Vulnerable Software and Affected Versions Cisco Enterprise NFV Infrastructure Software NFVIS affected versions not specified Description The issue is related to insufficient signature validation in the upgrade component, allowing an attacker to install a malicious file. This could...

Backup and Recovery Unauthorized Access

The vulnerability of the implementation of backup and data restoration operations for software that manages virtual infrastructure like VMware vCenter Server Appliance is related to deficiencies in verifying the authenticity of certificates. Exploiting this vulnerability can allow an attacker,...

Backup and Recovery Unauthorized Access

The vulnerability of the implementation of backup and recovery operations for software that manages virtual infrastructure like VMware vCenter Server Appliance is related to deficiencies in verifying the authenticity of certificates. Exploiting this vulnerability can allow an attacker, operating...

Cisco Enterprise NFV Infrastructure Software File System Command Re-record

The vulnerability of Cisco Enterprise NFV Infrastructure Software NFVIS is related to errors in checking input data within the file system commands of NFVIS. Exploiting this vulnerability could allow a malicious actor to re-write any files in the operating system of the vulnerable device...

Cisco Enterprise NFV Infrastructure Software CLI Command Execution

The vulnerability of the command-line interface CLI of Cisco Enterprise NFV Infrastructure Software NFVIS is related to insufficient testing of arguments passed to certain CLI commands. Exploiting this vulnerability could allow a attacker to execute arbitrary commands with root privileges...

Cisco Enterprise Network Functions Virtualization Infrastructure Software File Enumeration Vulnerability

Cisco Enterprise Network Functions Virtualization Infrastructure Software NFVIS is a set of Linux-based infrastructure software from Cisco. The software is mainly used for designing, deploying and managing network services and dynamically deploying virtualized network functions on supported Cisco...

PT-2019-3082

Name of the Vulnerable Software and Affected Versions Cisco Enterprise Network Functions Virtualization Infrastructure Software NFVIS affected versions not specified Description A vulnerability in the software could allow an authenticated, remote attacker with administrator privileges to overwrit...

CVE-2019-1984: Improper Input Validation

A vulnerability in Cisco Enterprise Network Functions Virtualization Infrastructure Software NFVIS could allow an authenticated, remote attacker with administrator privileges to overwrite files on the underlying operating system OS of an affected device. The vulnerability is due to improper input...

CVE-2019-12623: Insertion of Sensitive Information into Externally-Accessible File or Directory

A vulnerability in the web server functionality of Cisco Enterprise Network Functions Virtualization Infrastructure Software NFVIS could allow an authenticated, remote attacker to perform file enumeration on an affected system. The vulnerability is due to the web server responding with different...

Cisco Enterprise NFV Infrastructure Software Privilege Escalation

The vulnerability of the remote access system of Cisco Enterprise NFV Infrastructure Software NFVIS is related to the lack of authentication for a critical function. Exploiting this vulnerability can allow an attacker operating remotely to increase their privileges...

Cisco Enterprise NFV Infrastructure Software Privilege Escalation

The vulnerability of Cisco Enterprise NFV Infrastructure Software NFVIS related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands with root privileges...

CVE-2019-1946 Cisco Enterprise NFV Infrastructure Software Web-Based Management Interface Authentication Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an unauthenticated, remote attacker to bypass authentication and get limited access to the web-based management interface. The vulnerability is due to an incorrect implementatio...

CVE-2019-1973: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web portal framework of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based interface. The vulnerability is due to improper input validation of log file...