CVE-2016-1297

The Device Manager GUI in Cisco Application Control Engine ACE 4710 A5 before A53.1 allows remote authenticated users to bypass intended RBAC restrictions and execute arbitrary CLI commands with admin privileges via an unspecified parameter in a POST request, aka Bug ID CSCul84801...

CVE-2016-1297

The Cisco ACE 4710 Application Control Engine Device Manager GUI is affected (A5 before A5(3.1/3.0)) by a remote command injection vulnerability via insufficient validation of HTTP POST input, allowing an authenticated attacker to bypass RBAC and execute arbitrary CLI commands with admin privileg...

Cisco ACE 4710 Application Control Engine Command Injection Vulnerability

A vulnerability in the Device Manager GUI of the Cisco ACE 4710 Application Control Engine could allow an authenticated, remote attacker to execute any command-line interface CLI command on the ACE with admin user privileges. The vulnerability is due to insufficient validation of user-supplied...

Cisco NX-OS Application Policy Infrastructure Controller Access Control Vulnerability (cisco-sa-20160203-apic)

A vulnerability in the role-based access control RBAC of the Cisco Application Policy Infrastructure Controller APIC could allow an authenticated remote user to make configuration changes outside of their configured access privileges. Copyright C 2016 Greenbone Networks GmbH Some text description...

Cisco Nexus 9000 Series APIC Access Control Vulnerability (CSCut12998)

The remote Cisco Nexus 9000 Series device is affected by an access control vulnerability in the Cisco Application Policy Infrastructure Controller APIC due to a flaw in the eligibility logic of the role-based access control RBAC code. An authenticated, remote attacker can exploit this, via...

CVE-2016-1302

Cisco Application Policy Infrastructure Controller APIC devices with software before 1.03h and 1.1 before 1.11j and Nexus 9000 ACI Mode switches with software before 11.03h and 11.1 before 11.11j allow remote authenticated users to bypass intended RBAC restrictions via crafted REST requests, aka...

Code injection

Cisco Application Policy Infrastructure Controller APIC devices with software before 1.03h and 1.1 before 1.11j and Nexus 9000 ACI Mode switches with software before 11.03h and 11.1 before 11.11j allow remote authenticated users to bypass intended RBAC restrictions via crafted REST requests, aka...

Design/Logic Flaw

The RBAC implementation in Cisco ASA-CX Content-Aware Security software before 9.3.1.1112 and Cisco Prime Security Manager PRSM software before 9.3.1.1112 allows remote authenticated users to change arbitrary passwords via a crafted HTTP request, aka Bug ID CSCuo94842...

CVE-2016-1301

The RBAC implementation in Cisco ASA-CX Content-Aware Security software before 9.3.1.1112 and Cisco Prime Security Manager PRSM software before 9.3.1.1112 allows remote authenticated users to change arbitrary passwords via a crafted HTTP request, aka Bug ID CSCuo94842...

CVE-2016-1302

CVE-2016-1302 affects Cisco APIC devices and Nexus 9000 ACI Mode switches. A flaw in the RBAC eligibility logic allows remote authenticated users to bypass intended privileges by sending crafted REST requests, enabling unauthorized configuration changes (Bug CSCut12998). Affected versions: APIC s...

CVE-2016-1302

Cisco Application Policy Infrastructure Controller APIC devices with software before 1.03h and 1.1 before 1.11j and Nexus 9000 ACI Mode switches with software before 11.03h and 11.1 before 11.11j allow remote authenticated users to bypass intended RBAC restrictions via crafted REST requests, aka...

Cisco Application Policy Infrastructure Controller Access Control Vulnerability

A vulnerability in the role-based access control RBAC of the Cisco Application Policy Infrastructure Controller APIC could allow an authenticated remote user to make configuration changes outside of their configured access privileges. The vulnerability is due to eligibility logic in the RBAC...

eWON XSS / CSRF / Session Management / RBAC Issues

eWON sa Industrial router - Multiple Vulnerabilities eWON connects the machine across the Internet Breaking the barrier between industrial applications and IT standards, the mission of eWON is to connect industrial machines securely to the Internet, enabling easy remote access and gathering all...

CVE-2015-7926

eWON devices with firmware before 10.1s0 omit RBAC for I/O server information and status requests, which allows remote attackers to obtain sensitive information via an unspecified URL...

Information disclosure

eWON devices with firmware before 10.1s0 omit RBAC for I/O server information and status requests, which allows remote attackers to obtain sensitive information via an unspecified URL...

CVE-2015-7926

eWON devices with firmware before 10.1s0 omit RBAC for I/O server information and status requests, which allows remote attackers to obtain sensitive information via an unspecified URL...

CVE-2015-6404

Cisco Hosted Collaboration Mediation Fulfillment 10.63 does not use RBAC, which allows remote authenticated users to obtain sensitive credential information by leveraging admin access and making SOAP API requests, aka Bug ID CSCuw84374...

Code injection

Cisco Hosted Collaboration Mediation Fulfillment 10.63 does not use RBAC, which allows remote authenticated users to obtain sensitive credential information by leveraging admin access and making SOAP API requests, aka Bug ID CSCuw84374...

CVE-2015-6404

The CVE-2015-6404 entry concerns Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) 10.6(3), where lack of RBAC in the SOAP API allows an authenticated admin user to retrieve sensitive credentials and other restricted data. Root cause: missing RBAC in the HCM-F SOAP interface. Impact: infor...

CVE-2015-6404

Cisco Hosted Collaboration Mediation Fulfillment 10.63 does not use RBAC, which allows remote authenticated users to obtain sensitive credential information by leveraging admin access and making SOAP API requests, aka Bug ID CSCuw84374...