CVE-2024-20432

Cisco Nexus Dashboard Fabric Controller (NDFC) is affected by CVE-2024-20432 via a REST API and web UI command-injection flaw caused by improper user authorization and insufficient validation of command arguments. A low-privilege, authenticated attacker could submit crafted commands to affected R...

CVE-2024-20442

Cisco Nexus Dashboard exposes a REST API vulnerability due to insufficient authorization controls on certain endpoints. An authenticated, low-privileged, remote attacker could perform limited Administrator actions such as viewing portions of the web UI, generating config backups, or deleting tech...

CVE-2024-20348

CVE-2024-20348 affects Cisco Nexus Dashboard Fabric Controller (NDFC) and its Out-of-Band Plug and Play (PnP) feature. The issue arises from an unauthenticated provisioning web server, enabling an unauthenticated, remote attacker to read arbitrary files in the PnP container. Impact is read access...

CVE-2024-20536

Cisco Nexus Dashboard Fabric Controller (NDFC) SQL Injection vulnerability affects REST API endpoint and web-based management interface. Root cause: insufficient validation of user input enables authenticated, read-only attackers to cause arbitrary SQL commands, potentially reading, modifying, or...

CVE-2024-20438

Cisco Nexus Dashboard Fabric Controller (NDFC) REST API vulnerability allows an authenticated, low-privileged, remote attacker to read or write files on an affected device due to missing authorization controls on certain REST endpoints. The issue affects the NDFC/Nexus Dashboard REST APIs (subset...

CVE-2024-20441

CVE-2024-20441 affects Cisco Nexus Dashboard Fabric Controller (NDFC) REST API endpoint. The issue arises from insufficient authorization controls on the endpoint, enabling an authenticated, low-privilege, remote attacker to access sensitive configuration data. A successful exploit could allow do...

CVE-2024-20477

Cisco CVE-2024-20477 concerns an unauthorized REST API endpoint in Cisco Nexus Dashboard Fabric Controller (NDFC). An authenticated, low-privilege, remote attacker could bypass authorization on this endpoint and upload files into a specific container or delete files from a folder within that cont...

CVE-2024-20281

CVE-2024-20281 affects Cisco Nexus Dashboard and Nexus Dashboard Hosted Services web-based management interface. The vulnerability is a CSRF flaw due to insufficient protections, enabling an unauthenticated, remote attacker to persuade a user to click a malicious link and perform actions with the...

CVE-2024-20444

CVE-2024-20444 affects Cisco Nexus Dashboard Fabric Controller (NDFC). Root cause: insufficient validation of command arguments in a REST API endpoint, enabling an authenticated, network-admin-user to perform a command-injection attack. Potential impact per sources: ability to overwrite sensitive...

CVE-2024-20490

The CVE-2024-20490 issue affects Cisco Nexus Dashboard Fabric Controller (NDFC) and Nexus Dashboard Orchestrator (NDO). Root cause: HTTP proxy credentials can be recorded in internal logs stored in tech support files, exposing admin credentials in clear text when those files are accessed. Impact:...

CVE-2024-20448

The CVE-2024-20448 involves Cisco Nexus Dashboard Fabric Controller (NDFC) (formerly DCNM). It stems from improper storage of sensitive data in config-only and full backup files, enabling an attacker with access to a backup generated by an affected device to view sensitive information, including ...

CVE-2024-20449

CVE-2024-20449 affects Cisco Nexus Dashboard Fabric Controller (NDFC). The issue is due to improper path validation, enabling an authenticated, low-privilege remote attacker to upload malicious code via SCP using path traversal, potentially executing arbitrary code inside a container with root pr...

CVE-2024-20491

Cisco Nexus Dashboard Insights is affected by a vulnerability in its logging function that can disclose remote controller credentials. The issue arises because credentials are recorded in internal logs stored in tech support files, which an attacker can access to view admin credentials in clear t...