Command injection

MCTOOLS in the fabric interconnect in Cisco Unified Computing System UCS allows local users to execute arbitrary Baseboard Management Controller BMC commands by leveraging 1 local, 2 shell-level, or 3 debug-level privileges at the operating-system layer, aka Bug ID CSCtg76239...

Buffer overflow

Buffer overflow in the Smart Call Home feature in the fabric interconnect in Cisco Unified Computing System UCS allows remote attackers to cause a denial of service by reading and forging control messages associated with Smart Call Home reports, aka Bug ID CSCtl00198...

CVE-2012-4089

MCTOOLS in the fabric interconnect in Cisco Unified Computing System UCS allows local users to execute arbitrary Baseboard Management Controller BMC commands by leveraging 1 local, 2 shell-level, or 3 debug-level privileges at the operating-system layer, aka Bug ID CSCtg76239...

CVE-2012-4089

The CVE-2012-4089 issue affects Cisco Unified Computing System fabric interconnects (FI) via its MCTOOLS command. The root cause is improper input validation in MCTOOLS, enabling an authenticated, local attacker with local/shell-level/debug-level OS access to inject commands and execute arbitrary...

CVE-2012-4085

Cisco UCS Blade Management Controller IPMI exposes an information-disclosure vulnerability (CVE-2012-4085) that lets unauthenticated remote attackers enumerate valid usernames by observing IPMI responses. Root cause is a behavior difference in IPMI interface responses to invalid/valid usernames. ...

CVE-2013-5490

Cisco Prime Data Center Network Manager DCNM before 6.21 allows remote attackers to read arbitrary text files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue, aka Bug ID CSCud80148...

Design/Logic Flaw

DCNM-SAN Server in Cisco Prime Data Center Network Manager DCNM before 6.21 allows remote attackers to read arbitrary files via unspecified vectors, aka Bug ID CSCue77029...

Xxe

Cisco Prime Data Center Network Manager DCNM before 6.21 allows remote attackers to read arbitrary text files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue, aka Bug ID CSCud80148...

CVE-2013-5487

DCNM-SAN Server in Cisco Prime Data Center Network Manager DCNM before 6.21 allows remote attackers to read arbitrary files via unspecified vectors, aka Bug ID CSCue77029...

CVE-2013-5490

Cisco Prime Data Center Network Manager DCNM before 6.21 allows remote attackers to read arbitrary text files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue, aka Bug ID CSCud80148...

Code injection

MCServer in the Cisco Management Controller in Cisco Unified Computing System UCS allows local users to cause a denial of service application crash via invalid MCTools parameters, aka Bug ID CSCtg20734...

Design/Logic Flaw

The web framework in Cisco Prime Central for Hosted Collaboration Solution HCS Assurance before 9.1.1 does not properly determine the existence of an authenticated session, which allows remote attackers to discover usernames and passwords via an HTTP request, aka Bug ID CSCud32600...

Command injection

MCTools in the Cisco Management Controller in Cisco Unified Computing System UCS allows local users to gain privileges by entering crafted command-line parameters on a Fabric Interconnect device, aka Bug ID CSCtg20749...

CVE-2012-4082

CVE-2012-4082 affects Cisco UCS where MCTools in the Cisco Management Controller on Fabric Interconnect allows an authenticated, local attacker to gain elevated privileges due to improper parameter input validation. The vulnerability could let an attacker inject arbitrary commands into the underl...

CVE-2013-3473

CVE-2013-3473 affects Cisco Prime Central for Hosted Collaboration Solution (HCS) Assurance prior to 9.1.1. The issue is improper session handling: the web framework does not reliably determine an authenticated session, enabling unauthenticated remote attackers to enumerate usernames and password...

CVE-2012-4073

The KVM subsystem in the client in Cisco Unified Computing System UCS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers, and read or modify KVM data, via a crafted certificate, aka Bug ID CSCte90332...

CVE-2012-4083

Multiple buffer overflows in the administrative web interface in Cisco Unified Computing System UCS allow remote authenticated users to cause a denial of service memory corruption and session termination via long string values for unspecified parameters, aka Bug ID CSCtg20751...

CVE-2013-5501

Cross-site scripting XSS vulnerability in the oraservice page in Cisco MediaSense allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCuj23328...

CVE-2012-4072

The KVM subsystem in Cisco Unified Computing System UCS relies on a hardcoded X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers, and read keyboard and mouse events, by leveraging knowledge of this certificate's private key, aka Bug ID CSCte90327...

Cross site scripting

Cross-site scripting XSS vulnerability in the oraservice page in Cisco MediaSense allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCuj23328...