Critical, High-Severity Cisco Flaws Fixed in Data Center Network Manager

Cisco is warning of several critical and high-severity flaws in its Data Center Network Manager DCNM for managing network platforms and switches. DCNM is a platform for managing Cisco data centers that run Cisco’s NX-OS — the network operating system used by Cisco’s Nexus-series Ethernet switches...

Cisco Data Center Network Manager Command Injection Vulnerability

A vulnerability in specific REST API endpoints of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system with the privileges of the logged-in user. The vulnerability is due to insufficient validation of...

Cisco Data Center Network Manager Improper Authorization Vulnerability

A vulnerability in the REST API endpoint of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker with a low-privileged account to bypass authorization on the API of an affected device. The vulnerability is due to insufficient authorization of certain API functions...

Cisco Data Center Network Manager Authentication Bypass Vulnerability

A vulnerability in the REST API of Cisco Data Center Network Manager DCNM could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. The vulnerability exists because different installations share a...

CVE-2020-2077

SICK Package Analytics software up to and including version V04.0.0 are vulnerable due to incorrect default permissions settings. An unauthorized attacker could read sensitive data from the system by querying for known files using the REST API directly...

CVE-2020-2076

SICK Package Analytics software up to and including version V04.0.0 are vulnerable to an authentication bypass by directly interfacing with the REST API. An attacker can send unauthorized requests, bypass current authentication controls presented by the application and could potentially write fil...

Default configuration

SICK Package Analytics software up to and including version V04.0.0 are vulnerable due to incorrect default permissions settings. An unauthorized attacker could read sensitive data from the system by querying for known files using the REST API directly...

Authentication flaw

SICK Package Analytics software up to and including version V04.0.0 are vulnerable to an authentication bypass by directly interfacing with the REST API. An attacker can send unauthorized requests, bypass current authentication controls presented by the application and could potentially write fil...

CVE-2020-2077

CVE-2020-2077 concerns SICK Package Analytics. The vulnerability arises from incorrect default permissions in SICK Package Analytics software, affecting versions up to and including V04.0.0, allowing an unauthorized remote attacker to read sensitive data via REST API queries. Some sources indicat...

CVE-2020-2077

SICK Package Analytics software up to and including version V04.0.0 are vulnerable due to incorrect default permissions settings. An unauthorized attacker could read sensitive data from the system by querying for known files using the REST API directly...

CVE-2020-2076

SICK Package Analytics software up to and including version V04.0.0 are vulnerable to an authentication bypass by directly interfacing with the REST API. An attacker can send unauthorized requests, bypass current authentication controls presented by the application and could potentially write fil...

CVE-2020-2076

CVE-2020-2076 affects SICK Package Analytics software up to and including version V04.0.0. The issue is an authentication bypass caused by direct REST API access, enabling an attacker to issue unauthorized requests and potentially write files without authentication. Public sources in the connecte...

PT-2020-3469

Name of the Vulnerable Software and Affected Versions Cisco Data Center Network Manager DCNM versions prior to the fixed version Description The issue is related to the use of pre-installed credentials in the web interface of Cisco Data Center Network Manager DCNM and the REST API, which allows a...

CVE-2020-2076: Missing Authentication for Critical Function

SICK Package Analytics software up to and including version V04.0.0 are vulnerable to an authentication bypass by directly interfacing with the REST API. An attacker can send unauthorized requests, bypass current authentication controls presented by the application and could potentially write fil...

PT-2020-3467

Name of the Vulnerable Software and Affected Versions Cisco Data Center Network Manager DCNM affected versions not specified Description The issue is related to insufficient authorization of certain API functions in the REST API endpoint, allowing an authenticated, remote attacker with...

PT-2020-15281

Name of the Vulnerable Software and Affected Versions SICK Package Analytics software versions up to and including V04.0.0 Description The issue allows for an authentication bypass by directly interacting with the REST API, enabling an attacker to send unauthorized requests and bypass current...

PT-2020-4235

Name of the Vulnerable Software and Affected Versions: Cisco Data Center Network Manager DCNM affected versions not specified Description: The issue is related to insufficient validation of user-supplied input to specific REST API endpoints, allowing an authenticated, remote attacker to inject...

PT-2020-15282

Name of the Vulnerable Software and Affected Versions SICK Package Analytics software versions prior to V04.0.1 Description The issue arises from incorrect default permissions settings, allowing an unauthorized attacker to read sensitive data from the system. This can be achieved by querying for...

CVE-2020-2077: Incorrect Default Permissions

SICK Package Analytics software up to and including version V04.0.0 are vulnerable due to incorrect default permissions settings. An unauthorized attacker could read sensitive data from the system by querying for known files using the REST API directly...

GHSA-HX5G-8HQ2-8X4W SQL Injection in Kylin

Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the configuration can be overwritten by certain rest api, which makes SQL injection attack is possible. Users of all previous versions after 2.0...