Cisco Data Center Network Manager 11.2.1 - 'getVmHostData' SQL Injection

!/usr/bin/python """ Cisco Data Center Network Manager HostEnclHandler getVmHostData SQL Injection Remote Code Execution Vulnerability Tested on: Cisco DCNM 11.2.1 Installer for Windows 64-bit - Release: 11.21 - Release Date: 18-Jun-2019 - FileName: dcnm-installer-x64-windows.11.2.1.exe.zip - Siz...

OS Command Injection

network-manager is vulnerable to OS command injection. The vulnerability exists as the unsanitized value of index.process.env.NMCLI in linux/manager.js, used by getDevices in linux/manager.js, reaches childprocess.execSync through runCommand...

CVE-2019-10786

network-manager through 1.0.2 allows remote attackers to execute arbitrary commands via the "execSync" argument...

CVE-2019-10786

network-manager through 1.0.2 allows remote attackers to execute arbitrary commands via the "execSync" argument...

Design/Logic Flaw

network-manager through 1.0.2 allows remote attackers to execute arbitrary commands via the "execSync" argument...

CVE-2019-10786

CVE-2019-10786 concerns the network-manager module (through 1.0.2). The vulnerability arises from improper validation of user-supplied input in execSync usage, enabling remote attackers to run arbitrary commands via the execSync argument (examples and PoC show NM_CLI-driven command execution). Af...

CVE-2019-10786

network-manager through 1.0.2 allows remote attackers to execute arbitrary commands via the "execSync" argument...

Command Injection

Overview network-manager is a working with ethernet and wifi interfaces. Affected versions of this package are vulnerable to Command Injection. The runCommand function within common.js file is called by getDevices function in file linux/manager.js, which is required by the index.process.env.NMCLI...

The vulnerability of the SOAP API interface of the Cisco Data Center Network Manager system allows a attacker to disclose sensitive information.

The vulnerability of the SOAP API interface of the Cisco Data Center Network Manager DCNM system is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

The vulnerability of the Application Framework component of the Cisco Data Center Network Manager system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Application Framework component of the Cisco Data Center Network Manager system exists due to an incorrect restriction on the path name to the restricted access directory. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality,...

The vulnerability of the REST API interface of the Cisco Data Center Network Manager system allows a perpetrator to execute arbitrary commands.

It exists due to the failure to take measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary commands on the host’s operating system by sending a specially created maliciou...

The vulnerability of the REST API interface of the Cisco Data Center Network Manager system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the REST API interface of the Cisco Data Center Network Manager DCNM system exists due to an incorrect restriction on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and...

The vulnerability of the REST API interface of the Cisco Data Center Network Manager system allows a perpetrator to gain unauthorized access to protected information, affect data integrity, or execute arbitrary commands on the underlying operating system.

The vulnerability of the REST API interface of the Cisco Data Center Network Manager DCNM system is related to input validation errors. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information, compromise data integrity, or...

DEBIAN-CVE-2006-7246

NetworkManager 0.9.x does not pin a certificate's subject to an ESSID when 802.11X authentication is used...

CVE-2006-7246

NetworkManager 0.9.x does not pin a certificate's subject to an ESSID when 802.11X authentication is used...

Cisco Releases Security Updates

Cisco has released security updates to address multiple vulnerabilities in Data Center Network Manager DCNM. A remote attacker could exploit these vulnerabilities to take control of an affected system. For updates addressing lower severity vulnerabilities see the Cisco Security Advisories webpage...

CVE-2019-15983

A vulnerability in the SOAP API of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. To exploit this vulnerability, an attacker would need administrative privileges on the DCNM application...

CVE-2019-15999

A vulnerability in the application environment of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker to gain unauthorized access to the JBoss Enterprise Application Platform JBoss EAP on an affected device. The vulnerability is due to an incorrect configuration o...

CVE-2019-15982

Multiple vulnerabilities in the REST and SOAP API endpoints and the Application Framework feature of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. To exploit these vulnerabilities, an attacker wou...

CVE-2019-15999

A vulnerability in the application environment of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker to gain unauthorized access to the JBoss Enterprise Application Platform JBoss EAP on an affected device. The vulnerability is due to an incorrect configuration o...