The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

Computer vulnerabilities of Cisco Data Center Network Manager

vulnerability announce CVE-2019-1622

Cisco Data Center Network Manager: information disclosure via Web Management Interface

Synthesis of the vulnerability

An attacker can bypass access restrictions to data via Web Management Interface of Cisco Data Center Network Manager, in order to obtain sensitive information.
Severity: 2/4.
Creation date: 27/06/2019.
Revision date: 20/09/2019.
Identifiers: CERTFR-2019-AVI-297, cisco-sa-20190626-dcnm-infodiscl, CSCvo64654, CVE-2019-1622, VIGILANCE-VUL-29634.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can bypass access restrictions to data via Web Management Interface of Cisco Data Center Network Manager, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

vulnerability CVE-2018-0450

Cisco Data Center Network Manager: Cross Site Scripting

Synthesis of the vulnerability

An attacker can trigger a Cross Site Scripting of Cisco Data Center Network Manager, in order to run JavaScript code in the context of the web site.
Severity: 2/4.
Creation date: 08/10/2018.
Identifiers: cisco-sa-20180905-dcnm-xss, CSCvh70379, CVE-2018-0450, VIGILANCE-VUL-27438.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can trigger a Cross Site Scripting of Cisco Data Center Network Manager, in order to run JavaScript code in the context of the web site.
Full Vigil@nce bulletin... (Free trial)

cybersecurity threat CVE-2018-0440

Cisco Data Center Network Manager: privilege escalation via HTTP Request Command Injection

Synthesis of the vulnerability

An attacker can bypass restrictions via HTTP Request Command Injection of Cisco Data Center Network Manager, in order to escalate his privileges.
Severity: 2/4.
Creation date: 08/10/2018.
Identifiers: cisco-sa-20180905-cdcnm-escalation, CSCvi47733, CVE-2018-0440, VIGILANCE-VUL-27437.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can bypass restrictions via HTTP Request Command Injection of Cisco Data Center Network Manager, in order to escalate his privileges.
Full Vigil@nce bulletin... (Free trial)

security bulletin CVE-2018-0464

Cisco Data Center Network Manager: directory traversal

Synthesis of the vulnerability

An attacker can traverse directories of Cisco Data Center Network Manager, in order to read a file outside the service root path.
Severity: 2/4.
Creation date: 29/08/2018.
Identifiers: CERTFR-2018-AVI-414, cisco-sa-20180828-dcnm-traversal, CSCvj86072, CVE-2018-0464, VIGILANCE-VUL-27099.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can traverse directories of Cisco Data Center Network Manager, in order to read a file outside the service root path.
Full Vigil@nce bulletin... (Free trial)

computer threat announce CVE-2018-0144

Cisco Prime Data Center Network Manager: Cross Site Scripting

Synthesis of the vulnerability

An attacker can trigger a Cross Site Scripting of Cisco Prime Data Center Network Manager, in order to run JavaScript code in the context of the web site.
Severity: 2/4.
Creation date: 08/03/2018.
Identifiers: cisco-sa-20180307-pdcnm, CSCvg81051, CVE-2018-0144, VIGILANCE-VUL-25484.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

The Cisco Prime Data Center Network Manager product offers a web service.

However, it does not filter received data before inserting them in generated HTML documents.

An attacker can therefore trigger a Cross Site Scripting of Cisco Prime Data Center Network Manager, in order to run JavaScript code in the context of the web site.
Full Vigil@nce bulletin... (Free trial)

threat announce CVE-2017-12343 CVE-2017-12344 CVE-2017-12345

Cisco Data Center Network Manager: multiple vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of Cisco Data Center Network Manager.
Severity: 2/4.
Number of vulnerabilities in this bulletin: 5.
Creation date: 01/12/2017.
Identifiers: cisco-sa-20171129-dcnm, CSCvf40477, CSCvf63150, CSCvf68218, CSCvf68235, CSCvf68247, CVE-2017-12343, CVE-2017-12344, CVE-2017-12345, CVE-2017-12346, CVE-2017-12347, VIGILANCE-VUL-24609.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can use several vulnerabilities of Cisco Data Center Network Manager.
Full Vigil@nce bulletin... (Free trial)

cybersecurity announce CVE-2017-6639

Cisco Prime Data Center Network Manager: privilege escalation via debug support functions

Synthesis of the vulnerability

An attacker can access to the debug support service included in Cisco Prime Data Center Network Manager, in order to get administrator privileges at the system level.
Severity: 4/4.
Creation date: 08/06/2017.
Identifiers: CERTFR-2017-AVI-171, cisco-sa-20170607-dcnm1, CVE-2017-6639, VIGILANCE-VUL-22922.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can access to the debug support service included in Cisco Prime Data Center Network Manager, in order to get administrator privileges at the system level.
Full Vigil@nce bulletin... (Free trial)

computer threat alert CVE-2017-6640

Cisco Prime Data Center Network Manager: static password for privileged account

Synthesis of the vulnerability

An attacker can use an account created by Cisco Prime Data Center Network Manager with a static password and administration privileges, in order to escalate his privileges.
Severity: 4/4.
Creation date: 08/06/2017.
Identifiers: CERTFR-2017-AVI-171, cisco-sa-20170607-dcnm2, CVE-2017-6640, VIGILANCE-VUL-22921.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can use an account created by Cisco Prime Data Center Network Manager with a static password and administration privileges, in order to escalate his privileges.
Full Vigil@nce bulletin... (Free trial)

vulnerability alert CVE-2017-3733

OpenSSL: denial of service via the "Encrypt-Then-Mac" option

Synthesis of the vulnerability

An attacker can change the state of the "Encrypt-Then-Mac" TLS option in a renegotiation with a server or client based on OpenSSL, in order to trigger a denial of service.
Severity: 2/4.
Creation date: 16/02/2017.
Identifiers: 2003480, 2003620, 2003673, 2004940, CERTFR-2017-AVI-035, cisco-sa-20170130-openssl, cpuapr2019, cpujan2018, cpuoct2017, CVE-2017-3733, HPESBGN03728, VIGILANCE-VUL-21871.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

OpenSSL implements the possibility of renegotiation of TLS option and parameters during a session.

However, for some combinations of algorithms, the negation of the state of the option "Encrypt-Then-Mac" generates a fatal error.

An attacker can therefore change the state of the "Encrypt-Then-Mac" TLS option in a renegotiation with a server or client based on OpenSSL, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

weakness announce CVE-2016-7055 CVE-2017-3730 CVE-2017-3731

OpenSSL: multiple vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of OpenSSL.
Severity: 2/4.
Number of vulnerabilities in this bulletin: 4.
Creation date: 26/01/2017.
Identifiers: 1117414, 2000544, 2000988, 2000990, 2002331, 2004036, 2004940, 2009389, 2010154, 2011567, 2012827, 2014202, 2014651, 2014669, 2015080, BSA-2016-204, BSA-2016-207, BSA-2016-211, BSA-2016-212, BSA-2016-213, BSA-2016-216, BSA-2016-234, bulletinapr2017, bulletinjan2018, bulletinoct2017, CERTFR-2017-AVI-035, CERTFR-2018-AVI-343, cisco-sa-20170130-openssl, cpuapr2017, cpuapr2019, cpujan2018, cpujul2017, cpujul2018, cpuoct2017, CVE-2016-7055, CVE-2017-3730, CVE-2017-3731, CVE-2017-3732, DLA-814-1, DSA-3773-1, FEDORA-2017-3451dbec48, FEDORA-2017-e853b4144f, FG-IR-17-019, FreeBSD-SA-17:02.openssl, ibm10732391, ibm10733905, ibm10738249, ibm10738401, JSA10775, K37526132, K43570545, K44512851, K-510805, NTAP-20170127-0001, NTAP-20170310-0002, NTAP-20180201-0001, openSUSE-SU-2017:0481-1, openSUSE-SU-2017:0487-1, openSUSE-SU-2017:0527-1, openSUSE-SU-2017:0941-1, openSUSE-SU-2017:2011-1, openSUSE-SU-2017:2868-1, openSUSE-SU-2018:0458-1, PAN-70674, PAN-73914, PAN-SA-2017-0012, PAN-SA-2017-0014, PAN-SA-2017-0016, RHSA-2017:0286-01, RHSA-2018:2568-01, RHSA-2018:2575-01, SA141, SA40423, SB10188, SSA:2017-041-02, SUSE-SU-2018:0112-1, SUSE-SU-2018:2839-1, SUSE-SU-2018:3082-1, TNS-2017-03, USN-3181-1, VIGILANCE-VUL-21692.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

Several vulnerabilities were announced in OpenSSL.

An attacker can force a read at an invalid address via Truncated Packet, in order to trigger a denial of service, or to obtain sensitive information. [severity:2/4; CVE-2017-3731]

An attacker can force a NULL pointer to be dereferenced via DHE/ECDHE Parameters, in order to trigger a denial of service. [severity:2/4; CVE-2017-3730]

An attacker can use a carry propagation error via BN_mod_exp(), in order to compute the private key. [severity:1/4; CVE-2017-3732]

An error occurs in the Broadwell-specific Montgomery Multiplication Procedure, but with no apparent impact. [severity:1/4; CVE-2016-7055]
Full Vigil@nce bulletin... (Free trial)
Our database contains other pages. You can request a free trial to read them.

Display information about Cisco Data Center Network Manager: