Cisco UCS Director Path Traversal Vulnerability (CNVD-2020-34295)

Cisco UCS Director is a heterogeneous platform for private cloud Infrastructure as a Service IaaS from Cisco. A path traversal vulnerability exists in the orchestration task in Cisco UCS Director Releases prior to 6.7.4.0, where the program fails to adequately validate user-submitted input. A...

CVE-2020-3242: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability in the REST API of Cisco UCS Director could allow an authenticated, remote attacker with administrative privileges to obtain confidential information from an affected device. The vulnerability exists because confidential information is returned as part of an API response. An...

CVE-2020-3241: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in the orchestration tasks of Cisco UCS Director could allow an authenticated, remote attacker to perform a path traversal attack on an affected device. The vulnerability is due to insufficient validation of user-supplied input on the web-based management interface. An attacker...

Cisco UCS Director Information Disclosure Vulnerability

A vulnerability in the REST API of Cisco UCS Director could allow an authenticated, remote attacker with administrative privileges to obtain confidential information from an affected device. The vulnerability exists because confidential information is returned as part of an API response. An...

Cisco UCS Director Path Traversal Vulnerability

A vulnerability in the orchestration tasks of Cisco UCS Director could allow an authenticated, remote attacker to perform a path traversal attack on an affected device. The vulnerability is due to insufficient validation of user-supplied input on the web-based management interface. An attacker...

PT-2020-2963

Name of the Vulnerable Software and Affected Versions Cisco UCS Director affected versions not specified Description The issue is related to a lack of protection for service data in Cisco UCS Director, which could allow a remote attacker to disclose sensitive information by sending a specially...

PT-2020-2962

Name of the Vulnerable Software and Affected Versions Cisco UCS Director affected versions not specified Description The issue is related to insufficient validation of user-supplied input on the web-based management interface, allowing a path traversal attack. This could enable an authenticated,...

Cisco UCS Director Authentication Bypass (cisco-sa-20190821-imcs-ucs-authbypass)

According to its self-reported version, the remote host is running a version of Cisco UCS Director that is affected by an authentication bypass vulnerability. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary actions with administrative privileges...

Cisco UCS Director Cloupia Script Remote Code Execution Exploit

This Metasploit module exploits an authentication bypass and directory traversals in Cisco UCS Director versions prior to 6.7.4.0 to leak the administrator's REST API key and execute a Cloupia script containing an arbitrary root command. Note that the primary functionality of this module is to...

Cisco UCS Director Cloupia Script - Remote Code Execution

This Metasploit module exploits an authentication bypass and directory traversals in Cisco UCS Director This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cisco UCS Director Cloupia Script RCE',...

Cisco UCS Director Cloupia Script Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cisco UCS Director Cloupia Script RCE', 'Description' = %q This module exploits an authentication bypass and directory traversals in Cisco UCS...

Cisco UCS Director for Role-Based Access Control (cisco-sa-ucsd-Ar6BAguz)

According to its self-reported version, the remote host is running a version of Cisco UCS Director that is affected by role-Based Access Control vulnerability. A remote authenticated attacker could exploit this vulnerability by updating the roles of other users to disable them. A successful explo...

Cisco UCS Director Directory Traversal (CVE-2020-3251)

A directory traversal vulnerability exists in Cisco UCS Directory. The vulnerability is due to insufficient validation of user input within MyCallable class...

The vulnerability of the REST API interface for controlling physical infrastructure and virtual environments in Cisco UCS Director and Cisco UCS Director Express for Big Data allows attackers to enhance their privileges.

The vulnerability of the REST API interface for controlling physical infrastructure and virtual environments of Cisco UCS Director and Cisco UCS Director Express for Big Data is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to enhance...

The vulnerability of the REST API interface for controlling physical infrastructure and virtual environments in Cisco UCS Director and Cisco UCS Director Express for Big Data allows a attacker to execute arbitrary code.

The vulnerability of the REST API interface for controlling physical infrastructure and virtual environments of Cisco UCS Director and Cisco UCS Director Express for Big Data is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute...

The vulnerability of the REST API interface for managing physical infrastructure and virtual environments in Cisco UCS Director and Cisco UCS Director Express for Big Data allows a attacker to trigger a service failure.

The vulnerability of the REST API interface for managing physical infrastructure and virtual environments in Cisco UCS Director and Cisco UCS Director Express for Big Data is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to trigger...

The vulnerability of the REST API interface for controlling physical infrastructure and virtual environments in Cisco UCS Director and Cisco UCS Director Express for Big Data allows a attacker to execute arbitrary code.

The vulnerability of the REST API interface used for controlling physical infrastructure and virtual environments in Cisco UCS Director and Cisco UCS Director Express for Big Data is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execut...

The vulnerability of the REST API interface of the Cisco UCS Director management tool allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the REST API interface of the Cisco UCS Director management tool for physical infrastructure and virtual environments is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to...

The vulnerability of the REST API interface for controlling physical infrastructure and virtual environments in Cisco UCS Director and Cisco UCS Director Express for Big Data allows attackers to enhance their privileges.

The vulnerability of the REST API interface for controlling physical infrastructure and virtual environments of Cisco UCS Director and Cisco UCS Director Express for Big Data is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to enhance...

Cisco UCS Director Directory Traversal (CVE-2020-3250)

A directory traversal vulnerability exists in Cisco UCS Director. The vulnerability is due to insufficient validation of user input within the processing of the userAPIDownloadFile API...