CVE-2020-3461 Cisco Data Center Network Manager Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an unauthenticated, remote attacker to obtain confidential information from an affected device. The vulnerability is due to missing authentication on a specific part of the web-based...

CVE-2020-3376

CVE-2020-3376 affects Cisco Data Center Network Manager (DCNM) Device Manager. The flaw is an authentication failure that allows an unauthenticated, remote attacker to bypass authentication by visiting hosted URLs, potentially interacting with and using functions within DCNM and executing arbitra...

CVE-2020-3377

Cisco DCNM's Device Manager has a command-injection vulnerability due to insufficient input validation. An authenticated, remote attacker could trigger arbitrary commands with administrator privileges on the DCNM. The incident is documented across multiple sources (Cisco security advisory CISCO-S...

CVE-2020-3382

Cisco DCNM (Data Center Network Manager) suffers an authentication-bypass via the REST API caused by shared static encryption keys across installations. An unauthenticated, remote attacker could craft a valid session token and perform arbitrary actions with administrative privileges on affected d...

CVE-2020-3383

DCNM Path Traversal (CVE-2020-3383) affects Cisco Data Center Network Manager’s archive utility. An authenticated, remote attacker can exploit lack of input validation for paths embedded in archive files to perform directory traversal, potentially writing arbitrary files with the privileges of th...

CVE-2020-3384

CVE-2020-3384 affects Cisco Data Center Network Manager (DCNM) REST API endpoints. The root cause is inadequate validation of user-supplied input in the API, which could allow an authenticated, remote attacker to inject arbitrary commands on the underlying OS with the privileges of the logged-in ...

CVE-2020-3386

CVE-2020-3386 concerns Cisco Data Center Network Manager (DCNM) REST API: an authenticated, low-privileged user can bypass API authorization due to insufficient access controls and perform arbitrary actions with administrative privileges. Affected are DCNM deployments exposing the REST API; multi...

CVE-2020-3460

Cisco Data Center Network Manager (DCNM) web-based management interface is affected by an unauthenticated XSS vulnerability (CVE-2020-3460). The issue stems from improper validation of user-supplied input, allowing an attacker to inject malicious data into an HTTP header to execute script code in...

Critical, High-Severity Cisco Flaws Fixed in Data Center Network Manager

Cisco is warning of several critical and high-severity flaws in its Data Center Network Manager DCNM for managing network platforms and switches. DCNM is a platform for managing Cisco data centers that run Cisco’s NX-OS — the network operating system used by Cisco’s Nexus-series Ethernet switches...

Cisco Data Center Network Manager Command Injection Vulnerability

A vulnerability in the Device Manager application of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker to inject arbitrary commands on the affected device. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this...

Cisco Data Center Network Manager Path Traversal Vulnerability

A vulnerability in the archive utility of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. The vulnerability is due to a lack of proper input validation of paths that are embedded within archive file...

CVE-2020-3348

Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface on an affected device. These vulnerabilities are due to insufficient...

CVE-2020-3349

Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface on an affected device. These vulnerabilities are due to insufficient...

Cross site scripting

Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface on an affected device. These vulnerabilities are due to insufficient...

CVE-2020-3380

CVE-2020-3380 concerns Cisco Data Center Network Manager (DCNM). The issue is a privilege-escalation in the DCNM CLI: an authenticated, local attacker could exploit insufficient restrictions on an affected CLI command to elevate to root and execute arbitrary OS commands. The path described involv...

CVE-2020-3349 Cisco Data Center Network Manager Cross-Site Scripting Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface on an affected device. These vulnerabilities are due to insufficient...

CVE-2020-3349

Cisco Data Center Network Manager (DCNM) Web UI is affected by multiple XSS vulnerabilities caused by insufficient input validation. The issues allow an authenticated attacker to lure a user to click a crafted link, enabling arbitrary script execution in the interface context or access to browser...

CVE-2020-3349 Cisco Data Center Network Manager Cross-Site Scripting Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface on an affected device. These vulnerabilities are due to insufficient...

CVE-2020-3348 Cisco Data Center Network Manager Cross-Site Scripting Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface on an affected device. These vulnerabilities are due to insufficient...

CVE-2020-3348

CVE-2020-3348 affects Cisco Data Center Network Manager (DCNM) Web Management Interface. The underlying issue is insufficient validation of user-supplied input, enabling cross-site scripting (XSS) by persuading a user to click a crafted link. An authenticated, remote attacker could execute arbitr...