CVE-2015-6397

The CVE targets Cisco RV110W, RV130W, and RV215W routers, where an incorrect RBAC configuration for the default account allows an authenticated remote user to gain root access during login. Affected devices expose root privileges at authentication time due to default-account misconfiguration. Cis...

CVE-2015-6397

Cisco RV110W, RV130W, and RV215W devices have an incorrect RBAC configuration for the default account, which allows remote authenticated users to obtain root access via a login session with that account, aka Bug IDs CSCuv90139, CSCux58175, and CSCux73557...

Vulnerabilities of the Cisco Evolved Programmable Network Manager, a software tool for managing network services, and the Cisco Prime Infrastructure, a software tool for managing network lifecycle. These vulnerabilities allow attackers to obtain confidential information, enhance their privileges, or circumvent existing RBAC restrictions.

The vulnerability of the application programming interface of the Cisco Evolved Programmable Network Manager and the Cisco Prime Infrastructure network lifecycle management tool relates to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to circumvent...

CVE-2016-1406

The API web interface in Cisco Prime Infrastructure before 3.1 and Cisco Evolved Programmable Network Manager before 1.2.4 allows remote authenticated users to bypass intended RBAC restrictions and obtain sensitive information, and consequently gain privileges, via crafted JSON data, aka Bug ID...

CVE-2016-1406

The API web interface in Cisco Prime Infrastructure before 3.1 and Cisco Evolved Programmable Network Manager before 1.2.4 allows remote authenticated users to bypass intended RBAC restrictions and obtain sensitive information, and consequently gain privileges, via crafted JSON data, aka Bug ID...

Design/Logic Flaw

The API web interface in Cisco Prime Infrastructure before 3.1 and Cisco Evolved Programmable Network Manager before 1.2.4 allows remote authenticated users to bypass intended RBAC restrictions and obtain sensitive information, and consequently gain privileges, via crafted JSON data, aka Bug ID...

CVE-2016-1406

The API web interface in Cisco Prime Infrastructure before 3.1 and Cisco Evolved Programmable Network Manager before 1.2.4 allows remote authenticated users to bypass intended RBAC restrictions and obtain sensitive information, and consequently gain privileges, via crafted JSON data, aka Bug ID...

CVE-2016-1406

CVE-2016-1406 affects Cisco Prime Infrastructure before 3.1 and Cisco EPNM before 1.2.4. The vulnerability stems from incorrect RBAC evaluation in the API web interface, allowing remote authenticated users to bypass restrictions via crafted JSON data and obtain sensitive information, potentially ...

Cisco Prime Infrastructure Privilege Escalation API Vulnerability (cisco-sa-20160406-privauth)

A vulnerability in the web application programming interface API of Cisco Prime Infrastructure could allow an authenticated, remote attacker to gain elevated privileges. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyrigh...

The vulnerability of the Cisco Evolved Programmable Network Manager and the Cisco Prime Infrastructure network lifecycle management software allows attackers to circumvent existing RBAC restrictions and increase their privileges.

The vulnerability of the Cisco Evolved Programmable Network Manager and the Cisco Prime Infrastructure network lifecycle management software is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass existing RBAC restrictions and increase their...

CVE-2016-1290

The web API in Cisco Prime Infrastructure 1.2.0 through 2.22 and Cisco Evolved Programmable Network Manager EPNM 1.2 allows remote authenticated users to bypass intended RBAC restrictions and gain privileges via an HTTP request that is inconsistent with a pattern filter, aka Bug ID CSCuy10227...

Design/Logic Flaw

The web API in Cisco Prime Infrastructure 1.2.0 through 2.22 and Cisco Evolved Programmable Network Manager EPNM 1.2 allows remote authenticated users to bypass intended RBAC restrictions and gain privileges via an HTTP request that is inconsistent with a pattern filter, aka Bug ID CSCuy10227...

CVE-2016-1290

The web API in Cisco Prime Infrastructure 1.2.0 through 2.22 and Cisco Evolved Programmable Network Manager EPNM 1.2 allows remote authenticated users to bypass intended RBAC restrictions and gain privileges via an HTTP request that is inconsistent with a pattern filter, aka Bug ID CSCuy10227...

CVE-2016-1290

The CVE-2016-1290 issue affects Cisco Prime Infrastructure 1.2.0–2.2(2) and Cisco EPNM 1.2. The vulnerability stems from the web API allowing an authenticated remote user to bypass RBAC via an HTTP request that does not conform to a pattern filter, enabling elevated privileges (Bug CSCuy10227). P...

Cisco Prime Infrastructure and Evolved Programmable Network Manager Privilege Escalation API Vulnerability

A vulnerability in the web application programming interface API of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager EPNM could allow an authenticated, remote attacker to gain elevated privileges. The vulnerability is due to improper role-based access control RBAC when an...

Design/Logic Flaw

The password-management administration component in Cisco Policy Suite CPS 7.0.1.3, 7.0.2, 7.0.2-att, 7.0.3-att, 7.0.4-att, and 7.5.0 allows remote attackers to bypass intended RBAC restrictions and read unspecified data via unknown vectors, aka Bug ID CSCut85211...

CVE-2016-1357

CVE-2016-1357 affects Cisco Policy Suite (CPS) password-management administration component. The vulnerability allows remote attackers to bypass RBAC and read unspecified data via unknown vectors (Bug ID CSCut85211). Affected CPS versions include 7.0.1.3, 7.0.2, 7.0.2-att, 7.0.3-att, 7.0.4-att, a...

CVE-2016-1357

The password-management administration component in Cisco Policy Suite CPS 7.0.1.3, 7.0.2, 7.0.2-att, 7.0.3-att, 7.0.4-att, and 7.5.0 allows remote attackers to bypass intended RBAC restrictions and read unspecified data via unknown vectors, aka Bug ID CSCut85211...

CVE-2016-1297

The Device Manager GUI in Cisco Application Control Engine ACE 4710 A5 before A53.1 allows remote authenticated users to bypass intended RBAC restrictions and execute arbitrary CLI commands with admin privileges via an unspecified parameter in a POST request, aka Bug ID CSCul84801...

Design/Logic Flaw

The Device Manager GUI in Cisco Application Control Engine ACE 4710 A5 before A53.1 allows remote authenticated users to bypass intended RBAC restrictions and execute arbitrary CLI commands with admin privileges via an unspecified parameter in a POST request, aka Bug ID CSCul84801...