Cisco » Unified Computing System : Security Vulnerabilities, CVEs, CVSS score >= 5
Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Integrated Management Controller in Cisco Unified Computing System allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuq45477.
Max CVSS
6.8
EPSS Score
0.20%
Published
2014-11-18
Updated
2017-09-08
The C-Series Rack Server component 1.4 in Cisco Unified Computing System (UCS) does not properly restrict inbound access to ports, which allows remote attackers to cause a denial of service (Integrated Management Controller reboot or hang) via crafted packets, as demonstrated by nmap, aka Bug ID CSCtx19850.
Max CVSS
5.0
EPSS Score
0.12%
Published
2013-08-02
Updated
2013-10-07
The high-availability service in the Fabric Interconnect component in Cisco Unified Computing System (UCS) does not properly bind the cluster service to the management interface, which allows remote attackers to obtain sensitive information or cause a denial of service (peer-syncing outage) via a TELNET connection, aka Bug ID CSCtz72910.
Max CVSS
6.8
EPSS Score
0.38%
Published
2013-10-03
Updated
2016-09-22
The fabric-interconnect component in Cisco Unified Computing System (UCS) does not properly verify X.509 certificates, which allows man-in-the-middle attackers to watch SSL KVM video-channel traffic or modify this traffic via a crafted certificate, aka Bug ID CSCtr73033.
Max CVSS
5.8
EPSS Score
0.08%
Published
2013-10-19
Updated
2013-10-21
The fabric-interconnect component in Cisco Unified Computing System (UCS) does not encrypt KVM virtual-media data, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or modify this traffic by inserting packets into the client-server data stream, aka Bug ID CSCtr72964.
Max CVSS
5.8
EPSS Score
0.10%
Published
2013-10-21
Updated
2013-10-21
The fabric-interconnect KVM module in Cisco Unified Computing System (UCS) does not encrypt video data, which allows man-in-the-middle attackers to watch KVM display content by sniffing the network or modify this traffic by inserting packets into the client-server data stream, aka Bug ID CSCtr72949.
Max CVSS
5.8
EPSS Score
0.10%
Published
2013-10-19
Updated
2013-10-21
The Baseboard Management Controller (BMC) in Cisco Unified Computing System (UCS) allows local users to gain privileges and execute arbitrary commands via crafted command parameters within the command-line interface, aka Bug ID CSCtr43330.
Max CVSS
6.8
EPSS Score
0.04%
Published
2013-10-19
Updated
2013-10-21
The create certreq command in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges by embedding commands in an unspecified parameter, aka Bug ID CSCtq86563.
Max CVSS
6.8
EPSS Score
0.04%
Published
2013-10-02
Updated
2013-10-03
run-script in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges by embedding commands in an unspecified parameter, aka Bug ID CSCtq86560.
Max CVSS
6.8
EPSS Score
0.04%
Published
2013-10-02
Updated
2013-10-03
The clear sshkey command in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges by embedding commands in an unspecified parameter, aka Bug ID CSCtq86559.
Max CVSS
6.8
EPSS Score
0.04%
Published
2013-10-02
Updated
2013-10-03
The fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges and execute arbitrary operating-system commands via crafted parameters to a file-related command, aka Bug ID CSCtq86554.
Max CVSS
6.8
EPSS Score
0.04%
Published
2013-10-13
Updated
2013-10-15
The fabric-interconnect component in Cisco Unified Computing System (UCS) uses the same privilege level for execution of every script, which allows local users to gain privileges and execute arbitrary commands via an unspecified script-execution approach, aka Bug ID CSCtq86477.
Max CVSS
6.8
EPSS Score
0.04%
Published
2013-10-13
Updated
2016-09-22
Absolute path traversal vulnerability in the image-download process in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to overwrite or delete arbitrary files via a full pathname in an image header, aka Bug ID CSCtq02706.
Max CVSS
6.6
EPSS Score
0.04%
Published
2013-10-02
Updated
2013-10-03
ethanalyzer in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges by embedding commands in an unspecified parameter, aka Bug ID CSCtq02686.
Max CVSS
6.8
EPSS Score
0.07%
Published
2013-10-02
Updated
2017-02-19
The activate firmware command in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges by embedding commands in an unspecified parameter, aka Bug ID CSCtq02600.
Max CVSS
6.8
EPSS Score
0.04%
Published
2013-10-02
Updated
2013-10-03
The local file editor in the Baseboard Management Controller (BMC) in Cisco Unified Computing System (UCS) allows local users to gain privileges and modify arbitrary fabric-interconnect files, in the context of a vi process, via unspecified commands, aka Bug ID CSCtn06574.
Max CVSS
6.2
EPSS Score
0.04%
Published
2013-10-01
Updated
2013-10-01
The local file editor in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges, and read or modify arbitrary files, via unspecified key bindings, aka Bug ID CSCtn04521.
Max CVSS
5.5
EPSS Score
0.06%
Published
2013-10-02
Updated
2016-09-22
Buffer overflow in the Smart Call Home feature in the fabric interconnect in Cisco Unified Computing System (UCS) allows remote attackers to cause a denial of service by reading and forging control messages associated with Smart Call Home reports, aka Bug ID CSCtl00198.
Max CVSS
5.4
EPSS Score
0.36%
Published
2013-09-24
Updated
2017-08-29
The management interface in the Central Software component in Cisco Unified Computing System (UCS) does not properly validate the identity of vCenter consoles, which allows man-in-the-middle attackers to read or modify an inter-device data stream by spoofing an identity, aka Bug ID CSCtk00683.
Max CVSS
5.8
EPSS Score
0.14%
Published
2013-09-26
Updated
2016-09-22
MCTOOLS in the fabric interconnect in Cisco Unified Computing System (UCS) allows local users to execute arbitrary Baseboard Management Controller (BMC) commands by leveraging (1) local, (2) shell-level, or (3) debug-level privileges at the operating-system layer, aka Bug ID CSCtg76239.
Max CVSS
6.6
EPSS Score
0.04%
Published
2013-09-24
Updated
2017-08-29
A cluster setup script for fabric interconnect devices in Cisco Unified Computing System (UCS) allows remote attackers to execute arbitrary commands via invalid parameters, aka Bug ID CSCtg20793.
Max CVSS
5.1
EPSS Score
0.44%
Published
2013-09-24
Updated
2017-08-29
A setup script for fabric interconnect devices in Cisco Unified Computing System (UCS) allows remote attackers to execute arbitrary commands via invalid parameters, aka Bug ID CSCtg20790.
Max CVSS
5.1
EPSS Score
0.44%
Published
2013-09-25
Updated
2017-08-29
The Intelligent Platform Management Interface (IPMI) implementation in the Blade Management Controller in Cisco Unified Computing System (UCS) allows remote attackers to enumerate valid usernames by observing IPMI interface responses, aka Bug ID CSCtg20761.
Max CVSS
5.0
EPSS Score
0.16%
Published
2013-09-24
Updated
2017-08-29
Cross-site request forgery (CSRF) vulnerability in the web-management interface in the fabric interconnect (FI) component in Cisco Unified Computing System (UCS) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCtg20755.
Max CVSS
6.8
EPSS Score
0.17%
Published
2013-10-05
Updated
2017-08-29
MCTools in the Cisco Management Controller in Cisco Unified Computing System (UCS) allows local users to gain privileges by entering crafted command-line parameters on a Fabric Interconnect device, aka Bug ID CSCtg20749.
Max CVSS
6.8
EPSS Score
0.04%
Published
2013-09-20
Updated
2017-08-29