CVE-2019-1960: Improper Input Validation

Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, local attacker to read arbitrary files on the underlying operating system OS of an affected device. For more information about these vulnerabilities, see the Details section of this adviso...

Cisco Enterprise NFV Infrastructure Software Arbitrary File Read Vulnerability

Cisco Enterprise NFV Infrastructure Software is a lightweight virtualization platform that integrates complete VM lifecycle management, monitoring, device programmability, and service chaining in one installable package. An arbitrary file read vulnerability exists in Cisco Enterprise NFV...

Cisco Enterprise NFV Infrastructure Software Path Traversal Vulnerability (CNVD-2019-38857)

Cisco Enterprise NFV Infrastructure Software is a lightweight virtualization platform that integrates complete VM lifecycle management, monitoring, device programmability, and service chaining in one installable package. A path traversal vulnerability exists in the CLI for Cisco Enterprise NFV...

CVE-2019-1961: Insertion of Sensitive Information into Log File

A vulnerability in Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system OS of an affected device. The vulnerability is due to the improper input validation of tar packages uploaded through the W...

CVE-2019-1971: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an unauthenticated, remote attacker to perform a command injection attack and execute arbitrary commands with root privileges. The vulnerability is due to insufficient input validation by the web...

CVE-2019-1895

CVE-2019-1895 affects Cisco Enterprise NFV Infrastructure Software (NFVIS) via an authentication bypass in the VNC console. The root cause is insufficient authentication for establishing a VNC session, enabling an unauthenticated, remote attacker to intercept an admin VNC session request before l...

Cisco Enterprise NFV Infrastructure Software Privilege Escalation Vulnerability

A vulnerability the Cisco Enterprise NFV Infrastructure Software NFVIS restricted CLI could allow an authenticated, local attacker with valid administrator-level credentials to elevate privileges and execute arbitrary commands on the underlying operating system as root. The vulnerability is due t...

Cisco Enterprise NFV Infrastructure Software Web-Based Management Interface Authentication Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an unauthenticated, remote attacker to bypass authentication and get limited access to the web-based management interface. The vulnerability is due to an incorrect implementatio...

Cisco Enterprise NFV Infrastructure Software Arbitrary File Read Vulnerabilities

Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, local attacker to read arbitrary files on the underlying operating system OS of an affected device. For more information about these vulnerabilities, see the Details "details" section of...

Cisco Enterprise NFV Infrastructure Software Password Recovery Vulnerability

A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to view a password in clear text. The vulnerability is due to incorrectly logging the admin password when a user is forced to modify the default password when...

Cisco Enterprise NFV Infrastructure Software VNC Authentication Bypass Vulnerability

A vulnerability in the Virtual Network Computing VNC console implementation of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an unauthenticated, remote attacker to access the VNC console session of an administrative user on an affected device. The vulnerability is due to an...

PT-2019-2939

Name of the Vulnerable Software and Affected Versions Cisco Enterprise NFV Infrastructure Software NFVIS affected versions not specified Description A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an unauthenticated, remote attacker to perform a...

CVE-2019-1895: Missing Authentication for Critical Function

A vulnerability in the Virtual Network Computing VNC console implementation of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an unauthenticated, remote attacker to access the VNC console session of an administrative user on an affected device. The vulnerability is due to an...

PT-2019-3078

Name of the Vulnerable Software and Affected Versions Cisco Enterprise NFV Infrastructure Software NFVIS affected versions not specified Description A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, local attacker to overwrite or read...

PT-2019-3084

Name of the Vulnerable Software and Affected Versions Cisco Enterprise NFV Infrastructure Software NFVIS affected versions not specified Description A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to view a...

PT-2019-3132

Name of the Vulnerable Software and Affected Versions Cisco Enterprise NFV Infrastructure Software NFVIS affected versions not specified Description The issue is related to insufficient input validation in the software, which could allow an authenticated, local attacker to read arbitrary files on...

PT-2019-3133

Name of the Vulnerable Software and Affected Versions Cisco Enterprise NFV Infrastructure Software NFVIS affected versions not specified Description The issue is related to insufficient input validation in the software, which could allow an authenticated, local attacker to read arbitrary files on...

PT-2019-3144

Name of the Vulnerable Software and Affected Versions Cisco Enterprise NFV Infrastructure Software NFVIS affected versions not specified Description A vulnerability in the software could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an...

PT-2019-3077

Name of the Vulnerable Software and Affected Versions Cisco Enterprise NFV Infrastructure Software NFVIS affected versions not specified Description The issue is related to insufficient restrictions during the execution of an affected CLI command, allowing an authenticated, local attacker with...

Cisco Enterprise NFV Infrastructure Software File System Access

The vulnerability of Cisco Enterprise NFV Infrastructure Software’s software infrastructure is related to improper validation of input data in the file system’s command files. Exploiting this vulnerability allows a malicious actor to read or rewrite any arbitrary files remotely...