Cisco Elastic Services Controller Information Disclosure Vulnerability (CNVD-2017-220950)

Cisco Elastic Services Controller ESC is an open source modular system from Cisco USA. An information disclosure vulnerability exists in Cisco ESC, which stems from the program failing to properly protect sensitive log files. A local attacker can exploit this vulnerability to access sensitive...

Cisco Ultra Services Platform Elastic Services Controller Web Interface Information Disclosure Vulnerability

Cisco Ultra Services Platform is an intelligent online service delivery platform from Cisco, Inc. Elastic Services Controller ESC is an open source modular system. An information disclosure vulnerability exists in the ESC web interface in Cisco Ultra Services Platform version 21.0.v0.65839. A...

CVE-2017-6778

A vulnerability in the Elastic Services Controller ESC web interface of the Cisco Ultra Services Platform could allow an authenticated, remote attacker to acquire sensitive information. The vulnerability is due to the transmission of sensitive information as part of a GET request. An attacker cou...

CVE-2017-6776

A vulnerability in the web framework of Cisco Elastic Services Controller ESC could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface. The vulnerability is due to insufficient validation of user-supplied input by the affecte...

CVE-2017-6777

A vulnerability in the ConfD server of the Cisco Elastic Services Controller ESC could allow an authenticated, remote attacker to acquire sensitive system information. The vulnerability is due to insufficient protection of sensitive files on the system. An attacker could exploit this vulnerabilit...

CVE-2017-6786

A vulnerability in Cisco Elastic Services Controller could allow an authenticated, local, unprivileged attacker to access sensitive information, including credentials for system accounts, on an affected system. The vulnerability is due to improper protection of sensitive log files. An attacker...

CVE-2017-6777

A vulnerability in the ConfD server of the Cisco Elastic Services Controller ESC could allow an authenticated, remote attacker to acquire sensitive system information. The vulnerability is due to insufficient protection of sensitive files on the system. An attacker could exploit this vulnerabilit...

CVE-2017-6786

A vulnerability in Cisco Elastic Services Controller could allow an authenticated, local, unprivileged attacker to access sensitive information, including credentials for system accounts, on an affected system. The vulnerability is due to improper protection of sensitive log files. An attacker...

Information disclosure

A vulnerability in Cisco Elastic Services Controller ESC could allow an authenticated, remote attacker to view sensitive information. The vulnerability is due to insufficient protection of sensitive data. An attacker could exploit this vulnerability by authenticating to the application and...

Cross site scripting

A vulnerability in the web framework of Cisco Elastic Services Controller ESC could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface. The vulnerability is due to insufficient validation of user-supplied input by the affecte...

Information disclosure

A vulnerability in the Elastic Services Controller ESC web interface of the Cisco Ultra Services Platform could allow an authenticated, remote attacker to acquire sensitive information. The vulnerability is due to the transmission of sensitive information as part of a GET request. An attacker cou...

Design/Logic Flaw

A vulnerability in Cisco Elastic Services Controller could allow an authenticated, local, unprivileged attacker to access sensitive information, including credentials for system accounts, on an affected system. The vulnerability is due to improper protection of sensitive log files. An attacker...

CVE-2017-6772

A vulnerability in Cisco Elastic Services Controller ESC could allow an authenticated, remote attacker to view sensitive information. The vulnerability is due to insufficient protection of sensitive data. An attacker could exploit this vulnerability by authenticating to the application and...

Information disclosure

A vulnerability in the ConfD server of the Cisco Elastic Services Controller ESC could allow an authenticated, remote attacker to acquire sensitive system information. The vulnerability is due to insufficient protection of sensitive files on the system. An attacker could exploit this vulnerabilit...

CVE-2017-6776

A vulnerability in the web framework of Cisco Elastic Services Controller ESC could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface. The vulnerability is due to insufficient validation of user-supplied input by the affecte...

CVE-2017-6786

A vulnerability in Cisco Elastic Services Controller (ESC) allows an authenticated, local, unprivileged attacker to access sensitive information, including credentials for system accounts, due to improper protection of sensitive log files. An attacker can log in to an affected ESC and access unpr...

CVE-2017-6778

A vulnerability in the Elastic Services Controller ESC web interface of the Cisco Ultra Services Platform could allow an authenticated, remote attacker to acquire sensitive information. The vulnerability is due to the transmission of sensitive information as part of a GET request. An attacker cou...

CVE-2017-6772

A vulnerability in Cisco Elastic Services Controller ESC could allow an authenticated, remote attacker to view sensitive information. The vulnerability is due to insufficient protection of sensitive data. An attacker could exploit this vulnerability by authenticating to the application and...

CVE-2017-6776

CVE-2017-6776 affects Cisco Elastic Services Controller (ESC) web framework. It allows an unauthenticated, remote attacker to perform cross-site scripting (XSS) by abusing insufficient validation of user-supplied input. Exploitation could execute arbitrary script code or access browser-based info...

CVE-2017-6778

Cisco Ultra Services Platform's Elastic Services Controller Web Interface (ESC) is affected. An authenticated, remote attacker can disclose sensitive deployment information via a GET request. Affected release: 21.0.v0.65839. Root cause: transmitting sensitive information as part of a GET request....