CVE-2017-6705

The CVE-2017-6705 issue affects the Cisco Prime Collaboration Provisioning Tool. Affected component: the filesystem; root cause is insecure file permissions. Impact: an authenticated, local attacker can disclose sensitive information. Known affected release: 12.1. The Cisco advisory states there ...

CVE-2017-6725

A vulnerability in the web framework code of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of an affected system. More Information: CSCuw65833 CSCuw65837. Known Affected Releases: 2.22...

CVE-2017-6704: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in the web application in the Cisco Prime Collaboration Provisioning tool could allow an authenticated, remote attacker to perform arbitrary file downloads that could allow the attacker to read files from the underlying filesystem. More Information: CSCvc90335. Known Affected...

CVE-2017-6725: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web framework code of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of an affected system. More Information: CSCuw65833 CSCuw65837. Known Affected Releases: 2.22...

CVE-2017-6705: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability in the filesystem of the Cisco Prime Collaboration Provisioning tool could allow an authenticated, local attacker to acquire sensitive information. More Information: CSCvc82973. Known Affected Releases: 12.1...

CVE-2017-6698

CVE-2017-6698 describes a SQL injection due to inadequate input validation in Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) SQL database interface. An authenticated, remote attacker can send crafted URLs to execute arbitrary SQL queries, compromising confidential...

CVE-2017-6699

CVE-2017-6699 affects Cisco Prime Infrastructure (PI) and EPNM web-based management interfaces. Affected component: JSP-based web UI; root cause: insufficient validation of user-supplied input, enabling a remote, unauthenticated attacker to trigger a reflected cross-site scripting (XSS) attack by...

CVE-2017-6706

A vulnerability in the logging subsystem of the Cisco Prime Collaboration Provisioning tool could allow an unauthenticated, local attacker to acquire sensitive information. More Information: CSCvd07260. Known Affected Releases: 12.1...

Cisco Prime Infrastructure and EPNM DashboardRenderer XML External Entity Injection (CVE-2017-6662)

A directory traversal vulnerability exists in Oracle Fusion Middleware MapViewer. The vulnerability is due to a lack of proper input sanitization on multipart form-data requests in FileUploaderServlet. A remote attacker can exploit this vulnerability by sending a maliciously crafted HTTP request...

Cisco Prime Infrastructure Cross-Site Scripting Vulnerability (CNVD-2017-13826)

Cisco Prime Infrastructure PI is a set of Cisco Prime LAN Management Solution LMS and Cisco Prime Network Control System NCS technologies for wireless management. solution. A cross-site scripting vulnerability exists in the Web framework code in Cisco PI, which arises from the program failing to...

Cisco Prime Infrastructure Cross-Site Scripting Vulnerability (CNVD-2017-13825)

Cisco Prime Infrastructure PI is a Cisco Prime LAN Management Solution LMS and Cisco Prime Network Control System NCS technology for wireless management. solution. A cross-site scripting vulnerability exists in the Web framework code in Cisco PI, which arises from the program failing to adequatel...

CVE-2017-6662

A vulnerability in the web-based user interface of Cisco Prime Infrastructure PI and Evolved Programmable Network Manager EPNM could allow an authenticated, remote attacker read and write access to information stored in the affected system as well as perform remote code execution. The attacker mu...

Xxe

A vulnerability in the web-based user interface of Cisco Prime Infrastructure PI and Evolved Programmable Network Manager EPNM could allow an authenticated, remote attacker read and write access to information stored in the affected system as well as perform remote code execution. The attacker mu...

CVE-2017-6662

A vulnerability in the web-based user interface of Cisco Prime Infrastructure PI and Evolved Programmable Network Manager EPNM could allow an authenticated, remote attacker read and write access to information stored in the affected system as well as perform remote code execution. The attacker mu...

CVE-2017-6662

CVE-2017-6662 : A XXE-based vulnerability in the web-based UI of Cisco Prime Infrastructure (PI) and Cisco EPNM allows an authenticated, remote attacker to read/write information and execute code in the affected application. Root cause: improper handling of XML External Entity entries when parsin...

CVE-2017-6662

A vulnerability in the web-based user interface of Cisco Prime Infrastructure PI and Evolved Programmable Network Manager EPNM could allow an authenticated, remote attacker read and write access to information stored in the affected system as well as perform remote code execution. The attacker mu...

Cisco Prime Collaboration Provisioning licensestatus Directory Traversal Arbitrary File Deletion Vulnerability

This vulnerability allows remote attackers to delete arbitrary files on vulnerable installations of Cisco Prime Collaboration Provisioning. Authentication is not required to exploit this vulnerability. The specific flaw exists within the licensestatus.jsp page, which listens on TCP port 443 by...

Cisco Prime Infrastructure 3.1.6 XXE Injection / XSS / LFD / SQL Injection Vulnerabilities

Cisco Prime Infrastructure versions 1.1 through 3.1.6 suffer from cross site scripting, XML external entity injection, file disclosure, and remote SQL injection vulnerabilities. title: XML External Entity Injection XXE, SQL Injection, Cross Site Scripting, Local File Disclosure product: Cisco Pri...

Cisco Prime Collaboration Provisioning Tool Local Information Disclosure Vulnerability

Cisco Prime Collaboration is a comprehensive video and voice service assurance and management system. A security vulnerability exists in the file system in the Cisco Prime Collaboration Provisioning tool where an authenticated local attacker obtains sensitive information...

Cisco Prime Collaboration Provisioning Tool Session Hijacking Vulnerability

Cisco Prime Collaboration Provisioning tool is a set of Web-based, next-generation communications services tools from Cisco. The tool provides IP communication services capabilities for IP telephony, voice mail and unified communications environments. A session hijacking vulnerability exists in t...