CVE-2015-6259

CVE-2015-6259 affects Cisco Integrated Management Controller (IMC) Supervisor prior to 1.0.0.1 and Cisco UCS Director prior to 5.2.0.1. The JSP component enables remote attackers to overwrite arbitrary files via crafted HTTP requests, a vulnerability tracked as CSCus36435/CSCus62625. The issue is...

CVE-2017-3817

CVE-2017-3817 affects Cisco UCS Director. The issue is an information-disclosure vulnerability due to improper role-based access checks in the RBAC for VM information; an authenticated remote attacker could view unauthorized VM data in a UCS domain. Affected releases include 5.5(0.1) and 6.0(0.0)...

CVE-2017-3801

Cisco UCS Director privilege escalation (CVE-2017-3801) affects the web-based GUI in Cisco UCS Director 6.0.0.0 and 6.0.0.1. The root cause is improper RBAC after enabling the Developer Menu, enabling an authenticated, local user with an end-user profile to add catalogs containing arbitrary workf...

CVE-2018-0219

The CVE-2018-0219 issue affects Cisco Unified Computing System (UCS) Director in its web-based management interface. The root cause is insufficient validation of user-supplied input, enabling an unauthenticated, remote attacker to cause a cross-site scripting (XSS) condition by tricking a user in...

CVE-2018-15404

The CVE-2018-15404 issue affects Cisco Integrated Management Controller (IMC) Supervisor and Cisco UCS Director web interfaces. A vulnerability due to insufficient restrictions on resource size/total amount allows an authenticated, remote attacker with valid credentials to send crafted HTTP reque...

CVE-2018-0238

CVE-2018-0238 affects Cisco UCS Director; an attacker can log in with a modified username and valid password to gain visibility into and perform actions on any VM in the end-user portal. Root cause: improper user authentication checks in role-based resource checking; impact includes information d...

CVE-2017-3868

Cisco UCS Director (web-based management interface) is affected by CVE-2017-3868 due to insufficient validation of user-supplied input, enabling unauthenticated, remote attackers to perform cross-site scripting (XSS) against users. The vulnerability stems from the interface not properly validatin...