Cisco Nexus 9300-FX3 Series Fabric Extender for UCS Fabric Interconnects Authentication Bypass Vulnerability

A vulnerability in the CLI console login authentication of Cisco Nexus 9300-FX3 Series Fabric Extender FEX when used in UCS Fabric Interconnect deployments could allow an unauthenticated attacker with physical access to bypass authentication. This vulnerability is due to the improper implementati...

Cisco FXOS Software and UCS Manager Software Configuration Backup Static Key Vulnerability

A vulnerability in the backup configuration feature of Cisco UCS Manager Software and in the configuration export feature of Cisco FXOS Software could allow an unauthenticated attacker with access to a backup file to decrypt sensitive information stored in the full state and configuration backup...

Cisco Firepower 4100 Series, Firepower 9300 Security Appliances, and UCS Fabric Interconnects Command Injection Vulnerability

A vulnerability in the CLI of Cisco Firepower 4100 Series, Cisco Firepower 9300 Security Appliances, and Cisco UCS 6200, 6300, 6400, and 6500 Series Fabric Interconnects could allow an authenticated, local attacker to inject unauthorized commands. This vulnerability is due to insufficient input...

K25607522: BIG-IP vulnerability CVE-2019-6688

Security Advisory Description A user can obtain the secret used to encrypt a BIG-IP UCS backup file while sending an SNMP query to the BIG-IP or BIG-IQ system; however, the user cannot access the UCS files. CVE-2019-6688 Impact BIG-IP and BIG-IQ The SNMP user can obtain the secret used to encrypt...

K01413496: vCMP vulnerability CVE-2019-6632

Security Advisory Description Under certain circumstances, attackers can decrypt configuration items that are encrypted because the vCMP configuration unit key is generated with insufficient randomness. The attack prerequisite is direct access to encrypted configuration and/or UCS files...

SUSE CVE-2010-1666

Buffer overflow in Dan Pascu python-cjson 1.0.5, when UCS-4 encoding is enabled, allows context-dependent attackers to cause a denial of service application crash or possibly have unspecified other impact via vectors involving crafted Unicode input to the cjson.encode function...

SUSE CVE-2014-0104

In fence-agents before 4.0.17 does not verify remote SSL certificates in the fenceciscoucs.py script which can potentially allow for man-in-the-middle attackers to spoof SSL servers via arbitrary SSL certificates...

SUSE CVE-2018-12115

In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding recognized by Node.js under the names 'ucs2', 'ucs-2', 'utf16le' and 'utf-16le', Bufferwrite can be abused to write outside of the bounds of a single Buffer. Writes that start from the second-to-last...

SUSE CVE-2019-20433

libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\0' byte, if the encoding is set to ucs-2 or ucs-4 outside of the application, as demonstrated by the ASPELLCONF environment variable...

PT-2022-6378 · Cisco · Cisco Fxos +1

Name of the Vulnerable Software and Affected Versions: Cisco UCS Manager Software affected versions not specified Cisco FXOS Software affected versions not specified Description: A weakness in the encryption method used for the backup function could allow an unauthenticated attacker with access t...

Ubuntu: Security Advisory (USN-359-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MAL-2022-687 Malicious code in @ucs-private/kiosk-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware de1a0f664e77a677fdc4beaa36878c5bb5d4d5bcc90bd96af13153c0164c53af Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability in the web interface for managing physical infrastructure and Cisco UCS Director’s virtual environments allows a attacker to execute cross-site scripting attacks.

The vulnerability of the Web interface for managing physical infrastructure and Cisco UCS Director virtual environments is related to deficiencies in neutralizing special symbols. Exploiting this vulnerability can allow a malicious actor to perform cross-site scripting attacks remotely...

MAL-2022-6736 Malicious code in ucs-tooltip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6f236ea53a9dde841bb3918ae807ae76bf8ffe7fee07c742064e056f4e875afc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ucs-tooltip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6f236ea53a9dde841bb3918ae807ae76bf8ffe7fee07c742064e056f4e875afc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ucs-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0f11d729ede874f1d935011a0c5643d932b76f0951aac8a9277dc8ba20311839 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ucs-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d5592ffb464b4e507aff7a98cbf774a4200f3adbc52563909384a63ada6c58e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ucs-multi-series-line-chart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ae50640818d0dd907fe7a22c27ef0627f0c3f001c66d489e08a4a0c8702a9eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ucs-timepicker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 59bae874342b8cfdbb64a3beed2874d3cc10f9964fa338d1591713cbdd27e4e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6732 Malicious code in ucs-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0f11d729ede874f1d935011a0c5643d932b76f0951aac8a9277dc8ba20311839 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...