Path traversal

Absolute path traversal vulnerability in the image-download process in the fabric-interconnect component in Cisco Unified Computing System UCS allows local users to overwrite or delete arbitrary files via a full pathname in an image header, aka Bug ID CSCtq02706...

Design/Logic Flaw

run-script in the fabric-interconnect component in Cisco Unified Computing System UCS allows local users to gain privileges by embedding commands in an unspecified parameter, aka Bug ID CSCtq86560...

Command injection

The local file editor in the fabric-interconnect component in Cisco Unified Computing System UCS allows local users to gain privileges, and read or modify arbitrary files, via unspecified key bindings, aka Bug ID CSCtn04521...

Command injection

The create certreq command in the fabric-interconnect component in Cisco Unified Computing System UCS allows local users to gain privileges by embedding commands in an unspecified parameter, aka Bug ID CSCtq86563...

Command injection

The clear sshkey command in the fabric-interconnect component in Cisco Unified Computing System UCS allows local users to gain privileges by embedding commands in an unspecified parameter, aka Bug ID CSCtq86559...

CVE-2012-4102

The activate firmware command in the fabric-interconnect component in Cisco Unified Computing System UCS allows local users to gain privileges by embedding commands in an unspecified parameter, aka Bug ID CSCtq02600...

CVE-2012-4109

The clear sshkey command in the fabric-interconnect component in Cisco Unified Computing System UCS allows local users to gain privileges by embedding commands in an unspecified parameter, aka Bug ID CSCtq86559...

CVE-2012-4110

run-script in the fabric-interconnect component in Cisco Unified Computing System UCS allows local users to gain privileges by embedding commands in an unspecified parameter, aka Bug ID CSCtq86560...

CVE-2012-4111

The create certreq command in the fabric-interconnect component in Cisco Unified Computing System UCS allows local users to gain privileges by embedding commands in an unspecified parameter, aka Bug ID CSCtq86563...

CVE-2012-4095

The CVE-2012-4095 issue affects Cisco UCS Fabric Interconnect’s local file editor. The root cause is improper input filtering in the editor, allowing an authenticated, local attacker to use specific key bindings to read or modify arbitrary files with root privileges. Impact is local privilege esc...

CVE-2012-4102

The CVE-2012-4102 issue affects Cisco UCS Fabric Interconnect: the activate firmware command allows an authenticated, local attacker to inject commands by embedding them in an input parameter, due to improper input sanitization (Bug ID CSCtq02600). The vulnerability enables execution of Linux she...

CVE-2012-4104

CVE-2012-4104 affects Cisco UCS Fabric Interconnect’s image-download process, enabling absolute path traversal via a header-defined storage location. The underlying issue allows a local authenticated attacker to overwrite or delete arbitrary files on the filesystem by supplying a crafted image he...

CVE-2012-4110

CVE-2012-4110 affects Cisco UCS Fabric Interconnect run-script command injection. A local, authenticated attacker can inject shell commands via an unspecified parameter due to input sanitization failure, gaining a root shell on the underlying OS. A Cisco security advisory confirms exploitation wi...

CVE-2012-4111

The CVE-2012-4111 issue affects Cisco UCS Fabric Interconnect’s create certreq command. An authenticated, local attacker can exploit unsanitized input to execute commands, obtaining a root shell on the underlying OS (Bug CSCtq86563). Cisco’s advisory confirms this local privilege escalation and t...

Cisco Unified Computing System Fabric Interconnect clear sshkey Command Injection Vulnerability

A vulnerability in the clear sshkey command of the Cisco Unified Computing System fabric interconnect could allow an authenticated, local attacker to execute commands and obtain an interactive Linux shell as the root user. The vulnerability is due to a failure to properly sanitize user input. An...

Cisco Unified Computing System Fabric Interconnect run-script Command Injection Vulnerability

A vulnerability in the run-script command of the Cisco Unified Computing System fabric interconnect could allow an authenticated, local attacker to execute commands and obtain an interactive Linux shell as the root user. The vulnerability is due to a failure to properly sanitize user input. An...

Cisco Unified Computing System Fabric Interconnect activate firmware Command Injection Vulnerability

A vulnerability in the activate firmware command of the Cisco Unified Computing System fabric interconnect could allow an authenticated, local attacker to execute commands and obtain an interactive Linux shell as the root user. The vulnerability is due to a failure to properly sanitize user input...

PT-2013-1648

Name of the Vulnerable Software and Affected Versions Cisco Unified Computing System UCS affected versions not specified Description The issue allows local users to gain privileges by embedding commands in an unspecified parameter in the run-script of the fabric-interconnect component...

PT-2013-1635

Name of the Vulnerable Software and Affected Versions Cisco Unified Computing System UCS affected versions not specified Description The issue concerns the local file editor in the fabric-interconnect component, which allows local users to gain privileges and read or modify arbitrary files. This ...

PT-2013-1649

Name of the Vulnerable Software and Affected Versions Cisco Unified Computing System UCS affected versions not specified Description The issue allows local users to gain privileges by embedding commands in an unspecified parameter in the create certreq command of the fabric-interconnect component...