CVE-2021-44228

CVE-2021-44228 (Log4Shell) affects Apache Log4j2 2.0-beta9 through 2.15.0 (excluding some security releases) and is specific to log4j-core. The vulnerability arises from JNDI features used in configuration, log messages, and parameters, which can be exploited when an attacker can control log mess...

CVE-2024-20442

Cisco Nexus Dashboard exposes a REST API vulnerability due to insufficient authorization controls on certain endpoints. An authenticated, low-privileged, remote attacker could perform limited Administrator actions such as viewing portions of the web UI, generating config backups, or deleting tech...

CVE-2023-20014

Cisco Nexus Dashboard Software is affected by CVE-2023-20014, a denial-of-service vulnerability in the DNS functionality caused by improper processing of DNS requests. An unauthenticated, remote attacker can repeatedly send DNS queries to trigger the coredns service to stop or the device to reloa...

CVE-2023-20053

Cisco Nexus Dashboard’s web-based management interface is affected by a cross-site scripting (XSS) vulnerability due to insufficient input validation. An unauthenticated, remote attacker could lure a user into clicking a crafted link, allowing execution of arbitrary script code in the affected in...

CVE-2024-20438

Cisco Nexus Dashboard Fabric Controller (NDFC) REST API vulnerability allows an authenticated, low-privileged, remote attacker to read or write files on an affected device due to missing authorization controls on certain REST endpoints. The issue affects the NDFC/Nexus Dashboard REST APIs (subset...

CVE-2024-20283

Cisco Nexus Dashboard contains an information-disclosure vulnerability (CVE-2024-20283) due to improper access controls on a specific API endpoint. An authenticated remote attacker could query the API to access metrics and deployment information for devices within the Nexus Dashboard cluster. The...

CVE-2024-20441

CVE-2024-20441 affects Cisco Nexus Dashboard Fabric Controller (NDFC) REST API endpoint. The issue arises from insufficient authorization controls on the endpoint, enabling an authenticated, low-privilege, remote attacker to access sensitive configuration data. A successful exploit could allow do...

CVE-2024-20477

Cisco CVE-2024-20477 concerns an unauthorized REST API endpoint in Cisco Nexus Dashboard Fabric Controller (NDFC). An authenticated, low-privilege, remote attacker could bypass authorization on this endpoint and upload files into a specific container or delete files from a folder within that cont...

CVE-2025-20163

Cisco Nexus Dashboard Fabric Controller (NDFC) is affected by an SSH host key validation issue that enables unauthenticated, remote MITM-style impersonation of NDFC-managed devices, potentially allowing credential interception. Root cause: insufficient SSH host key validation in NDFC’s SSH implem...

CVE-2024-20281

CVE-2024-20281 affects Cisco Nexus Dashboard and Nexus Dashboard Hosted Services web-based management interface. The vulnerability is a CSRF flaw due to insufficient protections, enabling an unauthenticated, remote attacker to persuade a user to click a malicious link and perform actions with the...

CVE-2026-20042

The CVE-2026-20042 issue affects Cisco Nexus Dashboard’s configuration backup feature. The root cause is that authentication details are stored in encrypted backup files, and an attacker with a valid backup file and the encryption password can decrypt the backup to retrieve sensitive information....

CVE-2025-20150

CVE-2025-20150 affects Cisco Nexus Dashboard. The issue is caused by improper handling of LDAP authentication requests, enabling an unauthenticated remote attacker to enumerate valid LDAP usernames. The vulnerability is exploitable over the network with low attack complexity and no privileges req...

CVE-2024-20282

CVE-2024-20282 — Cisco Nexus Dashboard Privilege Elevation : A vulnerability in Cisco Nexus Dashboard allows an authenticated, local attacker with valid rescue-user credentials to escalate to root. The issue stems from insufficient protections for a sensitive access token, enabling access to reso...

CVE-2025-20347

Cisco Nexus Dashboard and Nexus Dashboard Fabric Controller (NDFC) have missing authorization controls on certain REST API endpoints. An authenticated, low-privileged attacker could view sensitive information or upload/modify files via crafted API requests, potentially executing limited Administr...

CVE-2025-20348

Summary: CVE-2025-20348 affects Cisco Nexus Dashboard and Nexus Dashboard Fabric Controller (NDFC). The issue arises from missing authorization controls on REST API endpoints, allowing an authenticated, low-privileged attacker to view sensitive information or upload/modify files. The impact inclu...

CVE-2025-20344

CVE-2025-20344 — Cisco Nexus Dashboard Path Traversal Affected product: Cisco Nexus Dashboard. Summary: An authenticated administrator can exploit the backup restore functionality due to insufficient validation of the contents of a crafted backup file. Successful exploitation could grant root pri...