Cisco Prime Infrastructure任意命令执行漏洞(CVE-2014-0679)

BUGTRAQ ID: 65816 CVECAN ID: CVE-2014-0679 Cisco Prime Infrastructure是通过思科技术LMS和NCS进行无线管理的解决方案。 Cisco Prime Infrastructure没有正确验证URL请求，未经身份验证的远程攻击者可以root级别的权限执行任意命令。 0 Cisco Prime Infrastructure 2.0 Cisco Prime Infrastructure 1.4 Cisco Prime Infrastructure 1.3 Cisco Prime Infrastructure 1.2 厂商补丁：...

CVE-2014-0679

Cisco Prime Infrastructure 1.2 and 1.3 before 1.3.0.20-2, 1.4 before 1.4.0.45-2, and 2.0 before 2.0.0.0.294-2 allows remote authenticated users to execute arbitrary commands with root privileges via an unspecified URL, aka Bug ID CSCum71308...

Command injection

Cisco Prime Infrastructure 1.2 and 1.3 before 1.3.0.20-2, 1.4 before 1.4.0.45-2, and 2.0 before 2.0.0.0.294-2 allows remote authenticated users to execute arbitrary commands with root privileges via an unspecified URL, aka Bug ID CSCum71308...

CVE-2014-0679

Cisco Prime Infrastructure versions 1.2/1.3 before 1.3.0.20-2, 1.4 before 1.4.0.45-2, and 2.0 before 2.0.0.0.294-2 are affected by CVE-2014-0679 due to improper validation of URL requests. An authenticated, remote attacker could exploit an unspecified URL to execute arbitrary commands with root p...

CVE-2014-0679

Cisco Prime Infrastructure 1.2 and 1.3 before 1.3.0.20-2, 1.4 before 1.4.0.45-2, and 2.0 before 2.0.0.0.294-2 allows remote authenticated users to execute arbitrary commands with root privileges via an unspecified URL, aka Bug ID CSCum71308...

CVE-2014-0679: Improper Input Validation

Cisco Prime Infrastructure 1.2 and 1.3 before 1.3.0.20-2, 1.4 before 1.4.0.45-2, and 2.0 before 2.0.0.0.294-2 allows remote authenticated users to execute arbitrary commands with root privileges via an unspecified URL, aka Bug ID CSCum71308...

Cisco Prime Infrastructure Command Execution Vulnerability

A vulnerability in Cisco Prime Infrastructure could allow an authenticated, remote attacker to execute arbitrary commands with root-level privileges. The vulnerability is due to improper validation of URL requests. An attacker could exploit this vulnerability by requesting an unauthorized command...

Cisco Releases Security Advisory for Prime Infrastructure Command Execution Vulnerability

Cisco has released a security advisory to address a vulnerability in Cisco Prime Infrastructure software versions 1.2, 1.3, 1.4, and 2.0 which could allow an unauthenticated, remote attacker to execute arbitrary commands with root-level privileges. US-CERT encourages users and administrators to...

CVE-2013-1247

Cross-site scripting XSS vulnerability in the wireless configuration module in Cisco Prime Infrastructure allows remote attackers to inject arbitrary web script or HTML via an SSID that is not properly handled during display of the XML windowing table, aka Bug ID CSCuf04356...

Cross site scripting

Cross-site scripting XSS vulnerability in the wireless configuration module in Cisco Prime Infrastructure allows remote attackers to inject arbitrary web script or HTML via an SSID that is not properly handled during display of the XML windowing table, aka Bug ID CSCuf04356...

CVE-2013-1247

CVE-2013-1247 affects Cisco Prime Infrastructure; XSS in the wireless configuration module allows an unauthenticated remote attacker to inject scripts via a rogue SSID displayed in the XML windowing table (Bug CSCuf04356). Exploitation requires access to the rogue AP listing; Cisco notes software...

CVE-2013-1247

Cross-site scripting XSS vulnerability in the wireless configuration module in Cisco Prime Infrastructure allows remote attackers to inject arbitrary web script or HTML via an SSID that is not properly handled during display of the XML windowing table, aka Bug ID CSCuf04356...

Cisco Prime Infrastructure Rogue AP SSID Cross-Site Scripting Vulnerability

A vulnerability in the wireless configuration module of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to insert scripts into the listing of rogue access points. The vulnerability is due to a failure to properly sanitize SSIDs before inserting them into the XML windowi...

CVE-2013-1247: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the wireless configuration module in Cisco Prime Infrastructure allows remote attackers to inject arbitrary web script or HTML via an SSID that is not properly handled during display of the XML windowing table, aka Bug ID CSCuf04356...

CVE-2013-1153

Cross-site request forgery CSRF vulnerability in the web interface in Cisco Prime Infrastructure allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCue84676...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the web interface in Cisco Prime Infrastructure allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCue84676...

CVE-2013-1153

Cross-site request forgery CSRF vulnerability in the web interface in Cisco Prime Infrastructure allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCue84676...

CVE-2013-1153

Cisco Prime Infrastructure suffers a CSRF vulnerability in its web interface (CVE-2013-1153). An unauthenticated, remote attacker could trick a user into submitting arbitrary requests to the device with the user’s privileges. Cisco’s advisory notes that software updates are not available to remed...

CVE-2013-1153: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the web interface in Cisco Prime Infrastructure allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCue84676...

Cisco Prime Infrastructure Cross-Site Request Forgery Vulnerability

A vulnerability in the web interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against the user of the web interface. The vulnerability is due to insufficient CSRF protections. An attacker could exploit this...