Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities

Multiple critical vulnerabilities in Cisco UCS Director, Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data Discovered by Pedro Ribeiro [email protected] from Agile Information Security...

CVE-2019-1900: NULL Pointer Dereference

A vulnerability in the web server of Cisco Integrated Management Controller IMC could allow an unauthenticated, remote attacker to cause the web server process to crash, causing a denial of service DoS condition on an affected system. The vulnerability is due to insufficient validation of...

CVE-2019-1896: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC could allow an authenticated, remote attacker to inject arbitrary commands and obtain root privileges. The vulnerability is due to insufficient validation of user-supplied input in the Certificate...

CVE-2019-1974: Improper Authentication

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to bypass user authentication and gain access as an administrative user...

CVE-2019-1935: Use of Hard-coded Credentials

A vulnerability in Cisco Integrated Management Controller IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to log in to the CLI of an affected system by using the SCP User account scpuser, which has default user...

CVE-2019-1936: Improper Input Validation

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an authenticated, remote attacker to execute arbitrary commands on the underlying Linux shell as the root use...

PT-2019-15700 · Cisco · Cisco Integrated Management Controller

Name of the Vulnerable Software and Affected Versions: Cisco Integrated Management Controller IMC affected versions not specified Description: A vulnerability in the Redfish protocol could allow an authenticated, remote attacker to inject and execute arbitrary commands with root privileges on an...

CVE-2019-1864: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges on an affected device. The vulnerability is due to insufficient validation...

CVE-2019-1871: Improper Restriction of Operations within the Bounds of a Memory Buffer

A vulnerability in the Import Cisco IMC configuration utility of Cisco Integrated Management Controller IMC could allow an authenticated, remote attacker to cause a denial of service DoS condition and implement arbitrary commands with root privileges on an affected device. The vulnerability is du...

Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities

Cisco UCS Director Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities Multiple critical vulnerabilities in Cisco UCS Director, Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data...

CVE-2019-1863: Improper Authorization

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC Software could allow an authenticated, remote attacker to make unauthorized changes to the system configuration. The vulnerability is due to insufficient authorization enforcement. An attacker coul...

The vulnerability of the web server of the Cisco Integrated Management Controller, a software-based remote management system for servers, allows a perpetrator to trigger a service failure.

The vulnerability of the Cisco Integrated Management Controller, a software-based remote server management system, is related to improper checking of boundaries. Exploiting this vulnerability can allow an attacker to trigger a service failure through a specially created HTTP request...

The vulnerability of the Cisco Integrated Management Controller, a software tool for remote server management, arises from buffer overflows, allowing an attacker to trigger a service failure.

The vulnerability of the Cisco Integrated Management Controller, a software tool for remote server management, arises due to buffer overflow. Exploiting this vulnerability can allow an attacker to cause a service failure using a specially created file...

The vulnerability of the command-line interface of the Cisco Integrated Management Controller, a remote administration tool, allows a malicious actor to execute arbitrary commands with root privileges.

The vulnerability of the command-line interface of the Cisco Integrated Management Controller remote management software exists because measures to neutralize the special elements used in the operating system’s command are not taken. Exploiting this vulnerability allows an attacker to execute...

The vulnerability of the Server Utilities component of the Cisco Integrated Management Controller software allows a hacker to disclose protected information.

The vulnerability of the Server Utilities component of the Cisco Integrated Management Controller remote administration software exists due to the lack of measures taken to neutralize specific elements used in the operating system command. Exploiting this vulnerability can allow a malicious actor...

The vulnerability in the web interface of the Cisco Integrated Management Controller, a software tool for remote administration of servers, allows a perpetrator to perform arbitrary actions on the vulnerable device.

The vulnerability of the web interface for controlling Cisco Integrated Management Controllers involves the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions on the vulnerable device using a specially crafted link...

Cisco Integrated Management Controller Access Control Error Vulnerability

Cisco Integrated Management Controller IMC is a set of software from the American company Cisco Cisco for the management of UCS Unified Computing System. The software supports HTTP, SSH access, etc., and can perform operations such as powering on, powering off and rebooting the server. An access...

Cisco Integrated Management Controller Buffer Overflow Vulnerability

Cisco Integrated Management Controller IMC is a set of software from the American company Cisco Cisco for the management of UCS Unified Computing System. The software supports HTTP, SSH access, etc., and can perform operations such as powering on, powering off and rebooting the server. A buffer...

Cisco Integrated Management Controller Numeric Error Vulnerability

Cisco Integrated Management Controller IMC is a set of software from the American company Cisco Cisco for the management of UCS Unified Computing System. The software supports HTTP, SSH access, etc., and can perform operations such as powering on, powering off and rebooting the server. A numeric...

Cisco Integrated Management Controller Operating System Command Injection Vulnerability (CNVD-2019-18899)

Cisco Integrated Management Controller IMC is a set of software from the American company Cisco Cisco for the management of UCS Unified Computing System. The software supports HTTP, SSH access, etc., and can perform operations such as powering on, powering off and rebooting the server. An operati...