The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

Computer vulnerabilities of Cisco Prime Infrastructure

computer threat note CVE-2019-1906

Cisco Prime Infrastructure: privilege escalation via EPN Manager Virtual Domain Configuration

Synthesis of the vulnerability

An attacker can bypass restrictions via EPN Manager Virtual Domain Configuration of Cisco Prime Infrastructure, in order to escalate his privileges.
Severity: 2/4.
Creation date: 04/07/2019.
Identifiers: CERTFR-2019-AVI-304, cisco-sa-20190619-prime-privescal, CSCvo46881, CSCvq37787, CVE-2019-1906, VIGILANCE-VUL-29684.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can bypass restrictions via EPN Manager Virtual Domain Configuration of Cisco Prime Infrastructure, in order to escalate his privileges.
Full Vigil@nce bulletin... (Free trial)

vulnerability alert CVE-2019-1906

Cisco Prime Infrastructure: privilege escalation via Virtual Domain Configuration

Synthesis of the vulnerability

An attacker can bypass restrictions via Virtual Domain Configuration of Cisco Prime Infrastructure, in order to escalate his privileges.
Severity: 2/4.
Creation date: 20/06/2019.
Identifiers: CERTFR-2019-AVI-284, cisco-sa-20190619-prime-privescal, CSCvo46881, CVE-2019-1906, VIGILANCE-VUL-29571.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can bypass restrictions via Virtual Domain Configuration of Cisco Prime Infrastructure, in order to escalate his privileges.
Full Vigil@nce bulletin... (Free trial)

weakness bulletin CVE-2019-1824 CVE-2019-1825

Cisco Prime Infrastructure: SQL injection via Web UI

Synthesis of the vulnerability

An attacker can use a SQL injection via the Web UI of Cisco Prime Infrastructure, in order to read or alter data.
Severity: 2/4.
Number of vulnerabilities in this bulletin: 2.
Creation date: 16/05/2019.
Identifiers: CERTFR-2019-AVI-228, cisco-sa-20190515-pi-sqlinject, CVE-2019-1824, CVE-2019-1825, VIGILANCE-VUL-29318.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can use a SQL injection via the Web UI of Cisco Prime Infrastructure, in order to read or alter data.
Full Vigil@nce bulletin... (Free trial)

vulnerability note CVE-2019-1659

Cisco Prime Infrastructure: Man-in-the-Middle via SSL Certificate Not Validated

Synthesis of the vulnerability

An attacker can act as a Man-in-the-Middle via SSL Certificate Not Validated on Cisco Prime Infrastructure, in order to read or write data in the session.
Severity: 2/4.
Creation date: 21/02/2019.
Identifiers: CERTFR-2019-AVI-073, cisco-sa-20190220-prime-validation, CSCvj87015, CVE-2019-1659, VIGILANCE-VUL-28576.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can act as a Man-in-the-Middle via SSL Certificate Not Validated on Cisco Prime Infrastructure, in order to read or write data in the session.
Full Vigil@nce bulletin... (Free trial)

vulnerability bulletin CVE-2019-1643

Cisco Prime Infrastructure: Cross Site Scripting

Synthesis of the vulnerability

An attacker can trigger a Cross Site Scripting of Cisco Prime Infrastructure, in order to run JavaScript code in the context of the web site.
Severity: 2/4.
Creation date: 24/01/2019.
Identifiers: CERTFR-2019-AVI-034, cisco-sa-20190123-cpi-xss, CSCvm81867, CVE-2019-1643, VIGILANCE-VUL-28343.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

The Cisco Prime Infrastructure product offers a web service.

However, it does not filter received data before inserting them in generated HTML documents.

An attacker can therefore trigger a Cross Site Scripting of Cisco Prime Infrastructure, in order to run JavaScript code in the context of the web site.
Full Vigil@nce bulletin... (Free trial)

computer threat alert CVE-2018-15457

Cisco Prime Infrastructure: Cross Site Scripting

Synthesis of the vulnerability

An attacker can trigger a Cross Site Scripting of Cisco Prime Infrastructure, in order to run JavaScript code in the context of the web site.
Severity: 2/4.
Creation date: 10/01/2019.
Identifiers: cisco-sa-20190109-cpi-xss, CSCvm74707, CVE-2018-15457, VIGILANCE-VUL-28201.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

The Cisco Prime Infrastructure product offers a web service.

However, it does not filter received data before inserting them in generated HTML documents.

An attacker can therefore trigger a Cross Site Scripting of Cisco Prime Infrastructure, in order to run JavaScript code in the context of the web site.
Full Vigil@nce bulletin... (Free trial)

security bulletin CVE-2018-15433

Cisco Prime Infrastructure: information disclosure via GET Request

Synthesis of the vulnerability

An attacker can bypass access restrictions to data via GET Request of Cisco Prime Infrastructure, in order to obtain sensitive information.
Severity: 2/4.
Creation date: 04/10/2018.
Identifiers: CERTFR-2018-AVI-468, cisco-sa-20181003-prime-id, CSCvg93152, CVE-2018-15433, VIGILANCE-VUL-27407.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can bypass access restrictions to data via GET Request of Cisco Prime Infrastructure, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability alert CVE-2018-15379

Cisco Prime Infrastructure: file upload via Unrestricted Directory Permissions

Synthesis of the vulnerability

An attacker can upload a malicious file via Unrestricted Directory Permissions on Cisco Prime Infrastructure, in order for example to upload a Trojan.
Severity: 3/4.
Creation date: 04/10/2018.
Identifiers: CERTFR-2018-AVI-468, cisco-sa-20181003-pi-tftp, CSCvk24890, CVE-2018-15379, VIGILANCE-VUL-27406.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can upload a malicious file via Unrestricted Directory Permissions on Cisco Prime Infrastructure, in order for example to upload a Trojan.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability announce CVE-2018-15432

Cisco Prime Infrastructure: information disclosure via Server Backup

Synthesis of the vulnerability

An attacker can bypass access restrictions to data via Server Backup of Cisco Prime Infrastructure, in order to obtain sensitive information.
Severity: 2/4.
Creation date: 04/10/2018.
Identifiers: CERTFR-2018-AVI-468, cisco-sa-20181003-pi-id, CSCvg93148, CVE-2018-15432, VIGILANCE-VUL-27405.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can bypass access restrictions to data via Server Backup of Cisco Prime Infrastructure, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability announce CVE-2018-5391

Linux kernel: denial of service via FragmentSmack

Synthesis of the vulnerability

An attacker can generate a fatal error via FragmentSmack of the Linux kernel, in order to trigger a denial of service.
Severity: 2/4.
Creation date: 16/08/2018.
Identifiers: ADV180022, CERTFR-2018-AVI-390, CERTFR-2018-AVI-392, CERTFR-2018-AVI-419, CERTFR-2018-AVI-457, CERTFR-2018-AVI-478, CERTFR-2018-AVI-533, CERTFR-2019-AVI-233, CERTFR-2019-AVI-242, cisco-sa-20180824-linux-ip-fragment, CVE-2018-5391, DLA-1466-1, DLA-1529-1, DSA-2019-062, DSA-4272-1, FragmentSmack, JSA10917, K74374841, openSUSE-SU-2018:2404-1, openSUSE-SU-2018:2407-1, openSUSE-SU-2019:0274-1, PAN-SA-2018-0012, RHSA-2018:2785-01, RHSA-2018:2791-01, RHSA-2018:2846-01, RHSA-2018:2924-01, RHSA-2018:2925-01, RHSA-2018:2933-01, RHSA-2018:2948-01, RHSA-2018:3083-01, RHSA-2018:3096-01, RHSA-2018:3459-01, RHSA-2018:3540-01, RHSA-2018:3586-01, RHSA-2018:3590-01, sk134253, SUSE-SU-2018:2344-1, SUSE-SU-2018:2374-1, SUSE-SU-2018:2380-1, SUSE-SU-2018:2381-1, SUSE-SU-2018:2596-1, SUSE-SU-2019:0541-1, SUSE-SU-2019:1289-1, SYMSA1467, Synology-SA-18:44, USN-3740-1, USN-3740-2, USN-3741-1, USN-3741-2, USN-3741-3, USN-3742-1, USN-3742-2, USN-3742-3, VIGILANCE-VUL-27009, VU#641765.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can generate a fatal error via FragmentSmack of the Linux kernel, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)
Our database contains other pages. You can request a free trial to read them.

Display information about Cisco Prime Infrastructure: