CVE-2026-20093: Improper Input Validation

A vulnerability in the change password functionality of Cisco Integrated Management Controller IMC could allow an unauthenticated, remote attacker to bypass authentication and gain access to the system as Admin. This vulnerability is due to incorrect handling of password change requests. An...

CVE-2025-20317: URL Redirection to Untrusted Site

A vulnerability in the Virtual Keyboard Video Monitor vKVM connection handling of Cisco Integrated Management Controller IMC could allow an unauthenticated, remote attacker to redirect a user to a malicious website. This vulnerability is due to insufficient verification of vKVM endpoints. An...

CVE-2025-20342: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

A vulnerability in the Virtual Keyboard Video Monitor vKVM connection handling of Cisco Integrated Management Controller IMC could allow an authenticated, remote attacker with low privileges to conduct a stored cross-site scripting XSS attack against a user of the interface. This vulnerability is...

CVE-2025-20261: Improper Restriction of Communication Channel to Intended Endpoints

A vulnerability in the SSH connection handling of Cisco Integrated Management Controller IMC for Cisco UCS B-Series, UCS C-Series, UCS S-Series, and UCS X-Series Servers could allow an authenticated, remote attacker to access internal services with elevated privileges. This vulnerability is due t...

CVE-2024-20356: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC could allow an authenticated, remote attacker with Administrator-level privileges to perform command injection attacks on an affected system and elevate their privileges to root. This vulnerability...

CVE-2023-20228: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An...

CVE-2021-34736: Improper Input Validation

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC Software could allow an unauthenticated, remote attacker to cause the web-based management interface to unexpectedly restart. The vulnerability is due to insufficient input validation on the...

PT-2021-7444

Name of the Vulnerable Software and Affected Versions Cisco Integrated Management Controller IMC Software affected versions not specified Description The issue is related to insufficient input validation on the web-based management interface of Cisco Integrated Management Controller IMC Software...

CVE-2021-1397: URL Redirection to Untrusted Site

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC Software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of the parameters in an HTTP request. An...

PT-2021-3254

Name of the Vulnerable Software and Affected Versions Cisco Integrated Management Controller IMC Software affected versions not specified Description A vulnerability in the web-based management interface could allow an unauthenticated, remote attacker to redirect a user to a malicious web page du...

CVE-2020-3470: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple vulnerabilities in the API subsystem of Cisco Integrated Management Controller IMC could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges. The vulnerabilities are due to improper boundary checks for certain user-supplied input. An attacker could...

CVE-2020-3371: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the web UI of Cisco Integrated Management Controller IMC could allow an authenticated, remote attacker to inject arbitrary code and execute arbitrary commands at the underlying operating system level. The vulnerability is due to insufficient input validation. An attacker could...

CVE-2020-3329: Improper Access Control

A vulnerability in role-based access control of Cisco Integrated Management Controller IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow a read-only authenticated, remote attacker to disable user accounts on an affected system. The vulnerability is due to...

PT-2020-17245

Name of the Vulnerable Software and Affected Versions Cisco Integrated Management Controller IMC Supervisor versions affected versions not specified Cisco UCS Director versions affected versions not specified Cisco UCS Director Express for Big Data versions affected versions not specified...

PT-2020-2233

Name of the Vulnerable Software and Affected Versions Cisco Integrated Management Controller IMC Supervisor versions affected versions not specified Cisco UCS Director versions affected versions not specified Cisco UCS Director Express for Big Data versions affected versions not specified...

PT-2019-3072

Name of the Vulnerable Software and Affected Versions Cisco Integrated Management Controller IMC Software affected versions not specified Description A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC Software could allow an authenticated, remote...

PT-2019-3021

Name of the Vulnerable Software and Affected Versions Cisco Integrated Management Controller IMC Supervisor versions affected versions not specified Cisco UCS Director versions affected versions not specified Cisco UCS Director Express for Big Data versions affected versions not specified...

PT-2019-3081

Name of the Vulnerable Software and Affected Versions Cisco Integrated Management Controller IMC Software affected versions not specified Description A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC Software could allow an authenticated, remote...

PT-2019-3059

Name of the Vulnerable Software and Affected Versions Cisco Integrated Management Controller IMC Supervisor versions affected versions not specified Cisco UCS Director versions affected versions not specified Cisco UCS Director Express for Big Data versions affected versions not specified...

CVE-2019-1908: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability in the Intelligent Platform Management Interface IPMI implementation of Cisco Integrated Management Controller IMC could allow an unauthenticated, remote attacker to view sensitive system information. The vulnerability is due to insufficient security restrictions imposed by the...