CVE-2019-1972: Undefined Security Weakness

A vulnerability the Cisco Enterprise NFV Infrastructure Software NFVIS restricted CLI could allow an authenticated, local attacker with valid administrator-level credentials to elevate privileges and execute arbitrary commands on the underlying operating system as root. The vulnerability is due t...

CVE-2019-1971: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an unauthenticated, remote attacker to perform a command injection attack and execute arbitrary commands with root privileges. The vulnerability is due to insufficient input validation by the web...

CVE-2019-1961: Insertion of Sensitive Information into Log File

A vulnerability in Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system OS of an affected device. The vulnerability is due to the improper input validation of tar packages uploaded through the W...

CVE-2019-1960: Improper Input Validation

Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, local attacker to read arbitrary files on the underlying operating system OS of an affected device. For more information about these vulnerabilities, see the Details section of this adviso...

CVE-2019-1952: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, local attacker to overwrite or read arbitrary files. The attacker would need valid administrator privilege-level credentials. This vulnerability is due to improper input validation of CL...

CVE-2019-1946: Improper Authentication

A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an unauthenticated, remote attacker to bypass authentication and get limited access to the web-based management interface. The vulnerability is due to an incorrect implementatio...

CVE-2019-1959: Improper Input Validation

Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, local attacker to read arbitrary files on the underlying operating system OS of an affected device. For more information about these vulnerabilities, see the Details section of this adviso...

Cisco Enterprise NFV Infrastructure Software VNC Authentication Bypass Vulnerability

Cisco Enterprise NFV Infrastructure Software is a lightweight virtualization platform that integrates complete VM lifecycle management, monitoring, device programmability, and service chaining in one installable package. A VNC authentication bypass vulnerability exists in the Virtual Network...

CVE-2019-1953: Insertion of Sensitive Information into Log File

A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to view a password in clear text. The vulnerability is due to incorrectly logging the admin password when a user is forced to modify the default password when...

CVE-2019-1895

CVE-2019-1895 affects Cisco Enterprise NFV Infrastructure Software (NFVIS) via an authentication bypass in the VNC console. The root cause is insufficient authentication for establishing a VNC session, enabling an unauthenticated, remote attacker to intercept an admin VNC session request before l...

PT-2019-3078

Name of the Vulnerable Software and Affected Versions Cisco Enterprise NFV Infrastructure Software NFVIS affected versions not specified Description A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, local attacker to overwrite or read...

CVE-2019-1895: Missing Authentication for Critical Function

A vulnerability in the Virtual Network Computing VNC console implementation of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an unauthenticated, remote attacker to access the VNC console session of an administrative user on an affected device. The vulnerability is due to an...

PT-2019-3077

Name of the Vulnerable Software and Affected Versions Cisco Enterprise NFV Infrastructure Software NFVIS affected versions not specified Description The issue is related to insufficient restrictions during the execution of an affected CLI command, allowing an authenticated, local attacker with...

PT-2019-2935 · Cisco · Cisco Enterprise Nfv Infrastructure

Name of the Vulnerable Software and Affected Versions: Cisco Enterprise NFV Infrastructure Software NFVIS affected versions not specified Description: A vulnerability in the Virtual Network Computing VNC console implementation could allow an unauthenticated, remote attacker to access the VNC...

PT-2019-2939

Name of the Vulnerable Software and Affected Versions Cisco Enterprise NFV Infrastructure Software NFVIS affected versions not specified Description A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an unauthenticated, remote attacker to perform a...

PT-2019-3133

Name of the Vulnerable Software and Affected Versions Cisco Enterprise NFV Infrastructure Software NFVIS affected versions not specified Description The issue is related to insufficient input validation in the software, which could allow an authenticated, local attacker to read arbitrary files on...

PT-2019-3132

Name of the Vulnerable Software and Affected Versions Cisco Enterprise NFV Infrastructure Software NFVIS affected versions not specified Description The issue is related to insufficient input validation in the software, which could allow an authenticated, local attacker to read arbitrary files on...

PT-2019-3144

Name of the Vulnerable Software and Affected Versions Cisco Enterprise NFV Infrastructure Software NFVIS affected versions not specified Description A vulnerability in the software could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an...

PT-2019-3084

Name of the Vulnerable Software and Affected Versions Cisco Enterprise NFV Infrastructure Software NFVIS affected versions not specified Description A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to view a...

Cisco Enterprise NFV Infrastructure Software File System Access

The vulnerability of Cisco Enterprise NFV Infrastructure Software’s software infrastructure is related to improper validation of input data in the file system’s command files. Exploiting this vulnerability allows a malicious actor to read or rewrite any arbitrary files remotely...