CVE-2014-2153

CVE-2014-2153 concerns Cisco Prime Infrastructure, where multiple XSS vulnerabilities exist in INSERT pages. The root cause is insufficient input validation on several parameters in INSERT-related HTML pages, allowing an unauthenticated, remote attacker to craft a link that injects arbitrary scri...

CVE-2014-2152

Cisco Prime Infrastructure (PI) contains a Cross-Site Request Forgery (CSRF) vulnerability on the INSERT page that could allow an unauthenticated/remote attacker to hijack the authentication of an authenticated PI user and perform actions on behalf of that user. Root cause is insufficient CSRF pr...

CVE-2014-2147

The CVE-2014-2147 issue affects Cisco Prime Infrastructure 2.1 and earlier, where the web interface does not properly restrict IFRAME use, due to insufficient HTML iframe protection. This enables cross-frame scripting (XFS) attacks, including clickjacking, via a crafted attacker-controlled page. ...

CVE-2014-2147

The web interface in Cisco Prime Infrastructure 2.1 and earlier does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting XFS" issue, aka B...

CVE-2014-2152

Cross-site request forgery CSRF vulnerability in the INSERT page in Cisco Prime Infrastructure PI allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCun21868...

CVE-2014-2153: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in INSERT pages in Cisco Prime Infrastructure allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCun21869...

CVE-2014-2152: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the INSERT page in Cisco Prime Infrastructure PI allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCun21868...

CVE-2014-2147: Improper Input Validation

The web interface in Cisco Prime Infrastructure 2.1 and earlier does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting XFS" issue, aka B...

Cisco Prime Infrastructure Cross-Frame Scripting Vulnerability

A vulnerability in the web interface of the Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to execute a cross-frame scripting XFS attack. This vulnerability is due to insufficient HTML iframe protection. An attacker could exploit this vulnerability by directing a user ...

Cisco Prime Infrastructure Cross-Site Request Forgery Vulnerability (CNVD-2015-01143)

Cisco Prime Infrastructure is an all-in-one package that provides complete infrastructure wired and wireless and mobile lifecycle management provisioning, monitoring, troubleshooting, fixing, and reporting. A cross-site request forgery vulnerability exists in Cisco Prime Infrastructure that could...

Cisco Prime Infrastructure Cross-Frame Scripting Vulnerability

Cisco Prime Infrastructure is an all-in-one package that provides complete infrastructure wired and wireless and mobile lifecycle management provisioning, monitoring, troubleshooting, fixing, and reporting. A cross-framework scripting vulnerability exists in Cisco Prime Infrastructure that could...

Multiple Cross-Site Scripting Vulnerabilities in Cisco Prime Infrastructure

Cisco Prime Infrastructure is an all-in-one package that provides complete infrastructure wired and wireless and mobile lifecycle management provisioning, monitoring, troubleshooting, fixing, and reporting. Multiple cross-site scripting vulnerabilities exist in Cisco Prime Infrastructure, as the...

Cisco Prime Infrastructure Cross-Site Request Forgery Vulnerability

A vulnerability in the INSERT page of Cisco Prime Infrastructure PI could allow an unauthenticated, remote attacker to perform a cross-site request forgery CSRF attack against the Cisco PI web interface. The vulnerability is due to insufficient CSRF protections on the Cisco PI web interface. An...

Cisco Prime Infrastructure Cross-Site Scripting Vulnerability

A vulnerability in the web framework of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface on the affected system. The vulnerability is due to insufficient input validation of several paramete...

Cisco Prime Infrastructure Device Discovery Password Disclosure Vulnerability

A vulnerability in the web interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to view the passwords stored for device discovery. The vulnerability occurs because the Quick Discovery options page contains the stored password in the HMTL page source. An attacker...

CVE-2014-8007

Cisco Prime Infrastructure allows remote authenticated users to read device-discovery passwords by examining the HTML source code of the Quick Discovery options page, aka Bug ID CSCum00019...

CVE-2014-8007: Exposure of Sensitive Information to an Unauthorized Actor

Cisco Prime Infrastructure allows remote authenticated users to read device-discovery passwords by examining the HTML source code of the Quick Discovery options page, aka Bug ID CSCum00019...

CVE-2014-8007

Cisco Prime Infrastructure allows remote authenticated users to read device-discovery passwords by examining the HTML source code of the Quick Discovery options page, aka Bug ID CSCum00019...

CVE-2014-8007

Cisco Prime Infrastructure is affected by a vulnerability where the Quick Discovery options page HTML source contains stored device-discovery passwords. Exploitation requires authenticated access, enabling an attacker to view passwords through normal page inspection. The issue is described in Cis...

PT-2014-8379

Name of the Vulnerable Software and Affected Versions Cisco Prime Infrastructure affected versions not specified Description The issue allows remote authenticated users to read device-discovery passwords by examining the HTML source code of the "Quick Discovery options" page. Recommendations At t...