Cisco IoT Field Network Director 注入漏洞

Cisco IoT Field Network Director FND is a network management system for large-scale FAN deployments. A cross-site scripting vulnerability exists in the web UI of Cisco IoT Field Network Director versions prior to 4.6.1. The vulnerability stems from insufficient validation of user-supplied input...

PT-2020-4951

Name of the Vulnerable Software and Affected Versions: Cisco IoT Field Network Director affected versions not specified Description: The issue is related to insufficient protection of user credentials in the web UI of the software. This could allow a remote attacker to obtain hashes of user...

CVE-2020-26080: Improper Access Control

A vulnerability in the user management functionality of Cisco IoT Field Network Director FND could allow an authenticated, remote attacker to manage user information for users in different domains on an affected system. The vulnerability is due to improper domain access control. An attacker could...

PT-2020-4910

Name of the Vulnerable Software and Affected Versions: Cisco IoT Field Network Director affected versions not specified Description: A vulnerability in the REST API of Cisco IoT Field Network Director could allow an unauthenticated, remote attacker to access the back-end database of an affected...

CVE-2020-26077: Improper Access Control

A vulnerability in the access control functionality of Cisco IoT Field Network Director FND could allow an authenticated, remote attacker to view lists of users from different domains that are configured on an affected system. The vulnerability is due to improper access control. An attacker could...

PT-2020-4894

Name of the Vulnerable Software and Affected Versions: Cisco IoT Field Network Director affected versions not specified Description: A vulnerability in the API of Cisco IoT Field Network Director could allow an unauthenticated, remote attacker to view sensitive information on an affected system...

Cisco IoT Field Network Director 访问控制错误漏洞

Cisco IoT Field Network Director FND is a network management system for large-scale FAN deployments. An elevation of privilege vulnerability exists in the REST API of Cisco IoT Field Network Director versions prior to 4.6.1. The vulnerability stems from the software failing to properly authentica...

CVE-2020-26081: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Multiple vulnerabilities in the web UI of Cisco IoT Field Network Director FND could allow an unauthenticated, remote attacker to conduct cross-site scripting XSS attacks against users on an affected system. The vulnerabilities are due to insufficient validation of user-supplied input that is...

CVE-2020-26072: Improper Access Control

A vulnerability in the SOAP API of Cisco IoT Field Network Director FND could allow an authenticated, remote attacker to access and modify information on devices that belong to a different domain. The vulnerability is due to insufficient authorization in the SOAP API. An attacker could exploit th...

PT-2020-4911

Name of the Vulnerable Software and Affected Versions: Cisco IoT Field Network Director affected versions not specified Description: The issue is related to insufficient authorization in the SOAP API of Cisco IoT Field Network Director, allowing an authenticated, remote attacker to access and...

CVE-2020-3392: Missing Authentication for Critical Function

A vulnerability in the API of Cisco IoT Field Network Director FND could allow an unauthenticated, remote attacker to view sensitive information on an affected system. The vulnerability exists because the affected software does not properly authenticate API calls. An attacker could exploit this...

CVE-2020-26078: External Control of File Name or Path

A vulnerability in the file system of Cisco IoT Field Network Director FND could allow an authenticated, remote attacker to overwrite files on an affected system. The vulnerability is due to insufficient file system protections. An attacker could exploit this vulnerability by crafting API request...

PT-2020-4953

Name of the Vulnerable Software and Affected Versions: Cisco IoT Field Network Director affected versions not specified Description: The issue is related to insufficient authentication procedures for sensitive information in the REST API interface of Cisco IoT Field Network Director. This could...

PT-2020-4952

Name of the Vulnerable Software and Affected Versions: Cisco IoT Field Network Director FND affected versions not specified Description: A vulnerability in the REST API of Cisco IoT Field Network Director could allow an authenticated, remote attacker to gain access to the back-end database of an...

PT-2020-4958

Name of the Vulnerable Software and Affected Versions Cisco IoT Field Network Director FND affected versions not specified Description The issue is related to multiple vulnerabilities in the web UI of Cisco IoT Field Network Director FND that could allow an unauthenticated, remote attacker to...

PT-2020-4954

Name of the Vulnerable Software and Affected Versions: Cisco IoT Field Network Director FND affected versions not specified Description: A vulnerability in the user management functionality could allow an authenticated, remote attacker to manage user information for users in different domains on ...

CVE-2020-26076: Exposure of Sensitive System Information to an Unauthorized Control Sphere

A vulnerability in Cisco IoT Field Network Director FND could allow an unauthenticated, remote attacker to view sensitive database information on an affected device. The vulnerability is due to the absence of authentication for sensitive information. An attacker could exploit this vulnerability b...

CVE-2020-26075: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the REST API of Cisco IoT Field Network Director FND could allow an authenticated, remote attacker to gain access to the back-end database of an affected device. The vulnerability is due to insufficient input validation of REST API requests that are made to an affected device. ...

CVE-2020-3531: Missing Authentication for Critical Function

A vulnerability in the REST API of Cisco IoT Field Network Director FND could allow an unauthenticated, remote attacker to access the back-end database of an affected system. The vulnerability exists because the affected software does not properly authenticate REST API calls. An attacker could...

CVE-2020-26079: Plaintext Storage of a Password

A vulnerability in the web UI of Cisco IoT Field Network Director FND could allow an authenticated, remote attacker to obtain hashes of user passwords on an affected device. The vulnerability is due to insufficient protection of user credentials. An attacker could exploit this vulnerability by...