Cisco Unified Computing System multiple security vulnerabilities

Buffer overflow, information leakage, authentication bypass, DoS...

Cisco Unified Computing System Central Software DOM-Based Cross-Site Scripting Vulnerability

Cisco Unified Computing System Central Software contains a vulnerability that could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability exists because the affected software fails to perform sufficient validation and sanitation of user-supplied inpu...

PT-2013-2965

Name of the Vulnerable Software and Affected Versions Cisco Unified Computing System UCS Central affected versions not specified Description A cross-site scripting XSS issue exists in a Flash component, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-1198: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in a Flash component in Cisco Unified Computing System UCS Central allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCud15430...

CVE-2013-1178

Multiple buffer overflows in the Cisco Discovery Protocol CDP implementation in Cisco NX-OS on Nexus 7000 devices 4.x and 5.x before 5.24 and 6.x before 6.11, Nexus 5000 and 5500 devices 4.x and 5.x before 5.13N11, Nexus 4000 devices before 4.12E11h, Nexus 3000 devices 5.x before 5.03U31, Nexus...

Design/Logic Flaw

Cisco NX-OS on Nexus 5500 devices 4.x and 5.x before 5.03N22, Nexus 3000 devices 5.x before 5.03U32, and Unified Computing System UCS 6200 devices before 2.01w allows remote attackers to cause a denial of service device reload by sending a jumbo packet to the management interface, aka Bug IDs...

Buffer overflow

Multiple buffer overflows in the Cisco Discovery Protocol CDP implementation in Cisco NX-OS on Nexus 7000 devices 4.x and 5.x before 5.24 and 6.x before 6.11, Nexus 5000 and 5500 devices 4.x and 5.x before 5.13N11, Nexus 4000 devices before 4.12E11h, Nexus 3000 devices 5.x before 5.03U31, Nexus...

CVE-2013-1182

The CVE-2013-1182 issue affects Cisco UCS: the login page of the UCS Manager Web Console allows remote LDAP authentication bypass via a malformed request in versions prior to 1.0(2h), 1.1 prior to 1.1(1j), and 1.3(x). Root cause is an LDAP authentication bypass in the Web Console login flow. Impa...

CVE-2013-1181

Cisco NX-OS on Nexus 5500 devices 4.x and 5.x before 5.03N22, Nexus 3000 devices 5.x before 5.03U32, and Unified Computing System UCS 6200 devices before 2.01w allows remote attackers to cause a denial of service device reload by sending a jumbo packet to the management interface, aka Bug IDs...

CVE-2013-1181

Cisco NX-OS-based products (Nexus 5500, Nexus 3000, UCS 6200) are affected by CVE-2013-1181. The issue allows remote attackers to trigger a denial-of-service (device reload) by sending a jumbo packet to the management interface. Affected ranges noted as Nexus 5500 4.x/5.x before 5.0(3)N2(2), Nexu...

CVE-2013-1184

CVE-2013-1184 affects Cisco UCS Manager (XML API management service) in UCS 1.x before 1.2(1b). The Management API can be triggered by a malformed request to cause a denial-of-service (service outage). Affected component: XML API management service in the Manager. Root cause: malformed request ha...

CVE-2013-1186

CVE-2013-1186 concerns Cisco UCS: versions 1.x before 1.4(4) and 2.x before 2.0(2m) are affected by a KVM authentication bypass via a crafted IMC authentication request. The issue is part of a Cisco UCS multi-vulnerability set; other CVEs (1182–1185) accompany it. Affected component is the Cisco ...

PT-2013-2950

Name of the Vulnerable Software and Affected Versions Cisco Unified Computing System UCS versions prior to 1.02h Cisco Unified Computing System UCS versions 1.1 prior to 1.11j Cisco Unified Computing System UCS version 1.3x Description The issue allows remote attackers to bypass LDAP authenticati...

PT-2013-2952

Name of the Vulnerable Software and Affected Versions Cisco Unified Computing System UCS versions 1.x before 1.21b Description The issue affects the management API in the XML API management service of the Manager component, allowing remote attackers to cause a denial of service via a malformed...

PT-2013-2954

Name of the Vulnerable Software and Affected Versions Cisco Unified Computing System UCS versions 1.x before 1.44 Cisco Unified Computing System UCS versions 2.x before 2.02m Description The issue allows remote attackers to bypass KVM authentication via a crafted authentication request to a Cisco...

Cisco Releases Security Advisories

Cisco has released three security advisories to address vulnerabilities affecting Cisco NX-OS-based products, Cisco Device Manager, and Cisco Unified Computing System. These vulnerabilities may allow an attacker to bypass authentication controls, execute arbitrary code, obtain sensitive...

CVE-2013-1185: Exposure of Sensitive Information to an Unauthorized Actor

The web interface in the Manager component in Cisco Unified Computing System UCS 1.x and 2.x before 2.02m allows remote attackers to obtain sensitive information by reading a 1 technical-support bundle file or 2 on-device configuration backup, aka Bug ID CSCtq86543...

CVE-2013-1182: Undefined Security Weakness

The login page in the Web Console in the Manager component in Cisco Unified Computing System UCS before 1.02h, 1.1 before 1.11j, and 1.3x allows remote attackers to bypass LDAP authentication via a malformed request, aka Bug ID CSCtc91207...

CVE-2013-1183: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the Intelligent Platform Management Interface IPMI functionality in the Manager component in Cisco Unified Computing System UCS 1.0 and 1.1 before 1.11j and 1.2 before 1.21b allows remote attackers to execute arbitrary code via malformed data in a UDP packet, aka Bug ID...

CVE-2013-1186: Improper Authentication

Cisco Unified Computing System UCS 1.x before 1.44 and 2.x before 2.02m allows remote attackers to bypass KVM authentication via a crafted authentication request to a Cisco Integrated Management Controller IMC, aka Bug ID CSCts53746...