PT-2015-7143

Name of the Vulnerable Software and Affected Versions Cisco Prime Infrastructure versions 1.20.103 through 2.00.0 Description A cross-site request forgery issue allows remote attackers to hijack the authentication of arbitrary users. Recommendations For Cisco Prime Infrastructure versions 1.20.10...

Cisco Prime Infrastructure Web Interface Cross-Site Request Forgery Vulnerability

A vulnerability in the web interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against the user of the web interface. The vulnerability is due to insufficient CSRF protections. An attacker could exploit this...

Authentication flaw

Cisco Prime Infrastructure PI 1.40.45 and earlier, when AAA authentication is used, allows remote authenticated users to bypass intended access restrictions via a username with a modified composition of lowercase and uppercase characters, aka Bug ID CSum59958...

CVE-2015-4331

Cisco Prime Infrastructure PI 1.40.45 and earlier, when AAA authentication is used, allows remote authenticated users to bypass intended access restrictions via a username with a modified composition of lowercase and uppercase characters, aka Bug ID CSum59958...

CVE-2015-4331

Cisco Prime Infrastructure (PI) 1.4(0.45) and earlier stores case-sensitive usernames and performs case-sensitive string comparisons. When AAA authentication is configured, remote authenticated users can bypass access restrictions by using a username with mixed-case characters, potentially leadin...

CVE-2015-4331

Cisco Prime Infrastructure PI 1.40.45 and earlier, when AAA authentication is used, allows remote authenticated users to bypass intended access restrictions via a username with a modified composition of lowercase and uppercase characters, aka Bug ID CSum59958...

Cisco Prime Infrastructure Elevation of Privilege Vulnerability

Cisco Prime Infrastructure is a wireless management solution through Cisco Prime LAN Management Solution and Cisco Prime Network Control System technologies. A security vulnerability exists in Cisco Prime Infrastructure, as the program stores case-sensitive usernames and performs case-sensitive...

PT-2015-6520

Name of the Vulnerable Software and Affected Versions Cisco Prime Infrastructure PI versions 1.40.45 and earlier Description The issue allows remote authenticated users to bypass intended access restrictions by using a username with a modified composition of lowercase and uppercase characters...

CVE-2015-4331: Undefined Security Weakness

Cisco Prime Infrastructure PI 1.40.45 and earlier, when AAA authentication is used, allows remote authenticated users to bypass intended access restrictions via a username with a modified composition of lowercase and uppercase characters, aka Bug ID CSum59958...

Cisco Prime Infrastructure Privilege Escalation Vulnerability

A vulnerability in the Cisco Prime Infrastructure PI username storage and authentication process could allow an authenticated, remote attacker to gain elevated privileges on a targeted system. The vulnerability occurs because the affected software saves case-sensitive usernames and performs...

Cisco Prime Infrastructure contains SUID root binaries

Overview The Cisco Prime Infrastructure version 2.2 contains two binaries with SUID root world-executable privileges, allowing any local user to execute arbitrary commands as root. Description CWE-276: Incorrect Default Permissions Two binaries are included in Cisco Prime version 2.2 that run as...

Cisco Prime Central for Hosted Collaboration Solution Cross-Site Scripting Vulnerability

Cisco Prime Central for Hosted Collaboration Solution PC4HCS is a carrier-grade, scalable service assurance management platform from Cisco. The platform provides secure access to authentication, real-time fault analysis and other functions. A cross-site scripting vulnerability exists in the...

Cisco Unified Communications Manager Information Disclosure Vulnerability (CNVD-2015-05103)

Cisco Unified Communications Manager is an enterprise-class IP telephony call processing system. Cisco Unified Communications Manager 10.5 3.10000.9 has a security vulnerability in the implementation of the Prime Collaboration Deployment component, which can be exploited by an authenticated remot...

CVE-2015-4292

Cross-site scripting XSS vulnerability in the management interface in Cisco Prime Central for Hosted Collaboration Solution PC4HCS 10.62 allows remote attackers to inject arbitrary web script or HTML via an unspecified value, aka Bug ID CSCuv45818...

Cross site scripting

Cross-site scripting XSS vulnerability in the management interface in Cisco Prime Central for Hosted Collaboration Solution PC4HCS 10.62 allows remote attackers to inject arbitrary web script or HTML via an unspecified value, aka Bug ID CSCuv45818...

CVE-2015-4292

Cisco Prime Central for Hosted Collaboration Solution (PC4HCS) 10.6(2) contains a cross-site scripting (XSS) vulnerability in its management interface caused by insufficient input filtering of user-submitted values. Exploitation would allow a remote attacker to inject arbitrary web script or HTML...

CVE-2015-4295: Exposure of Sensitive Information to an Unauthorized Actor

The Prime Collaboration Deployment component in Cisco Unified Communications Manager 10.53.10000.9 allows remote authenticated users to discover root credentials via a direct request to an unspecified URL, aka Bug ID CSCuv21819...

CVE-2015-4292: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the management interface in Cisco Prime Central for Hosted Collaboration Solution PC4HCS 10.62 allows remote attackers to inject arbitrary web script or HTML via an unspecified value, aka Bug ID CSCuv45818...

Cisco Unified Communications Manager Prime Collaboration Deployment Information Disclosure Vulnerability

A vulnerability in the Prime Collaboration Deployment of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view sensitive data. The vulnerability is due to insufficient protections of data at rest. An attacker could exploit this vulnerability by browsing to a...

Cisco Prime Central Hosted Collaboration Solution Cross-Site Scripting Vulnerability

A vulnerability in the HTTP web-based management interface of the Cisco Prime Central for Hosted Collaboration Solution PC4HCS could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of the affected system. The vulnerability...