Cisco Nexus

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

Cisco Nexus Dashboard Unauthorized Access Vulnerabilities

Cisco Nexus Dashboard Unauthorized Access Vulnerabilities

Cisco Nexus Dashboard Unauthorized Access Vulnerabilities

A vulnerability in the web-based management interface of Cisco Nexus Dashboard and Cisco Nexus Dashboard hosted services could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. This vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected system. An attacker could exploit this vulnerability by persuading a user to click a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. If the affected user has administrative privileges, these actions could include modifying the system configuration and creating new privileged accounts. Note: There are internal security mechanisms in place that limit the scope of this exploit, reducing the Security Impact Rating of this vulnerability.

Cisco Nexus Dashboard Fabric Controller SSH Host Key Vulnerability

A vulnerability in the DNS functionality of Cisco Nexus Dashboard Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to the improper processing of DNS requests. An attacker could exploit this vulnerability by sending a continuous stream of DNS requests to an affected device. A successful exploit could allow the attacker to cause the coredns service to stop working or cause the device to reload, resulting in a DoS condition.

Cisco Nexus Dashboard SSL Certificate Validation Vulnerability

Cisco Nexus Dashboard Path Traversal Vulnerability

Cisco Nexus Dashboard Privilege Escalation Vulnerabilities

Cisco Nexus Dashboard Privilege Escalation Vulnerabilities

Cisco Nexus Dashboard Privilege Escalation Vulnerabilities

Cisco Nexus Dashboard Privilege Escalation Vulnerabilities

Cisco Nexus Dashboard Arbitrary File Write Vulnerability

Cisco Nexus Dashboard Fabric Controller Unauthorized API Endpoint Vulnerability

Cisco Nexus Dashboard Configuration REST API Unauthorized Access Vulnerability

Cisco Nexus Dashboard Fabric Controller Unauthorized REST API Vulnerability

A vulnerability in the web-based management interface of Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. This vulnerability is due to insufficient user input validation. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

A vulnerability in Cisco Nexus Dashboard could allow an authenticated, local attacker with valid rescue-user credentials to elevate privileges to root on an affected device. This vulnerability is due to insufficient protections for a sensitive access token. An attacker could exploit this vulnerability by using this token to access resources within the device infrastructure. A successful exploit could allow an attacker to gain root access to the filesystem or hosted containers on an affected device.

Cisco Nexus Dashboard Fabric Controller Unauthorized REST API Endpoint Vulnerability

Cisco Nexus Dashboard Unauthorized API Endpoints Vulnerability

Cisco Nexus Dashboard Fabric Controller Unauthorized REST API Vulnerability

Cisco Nexus Dashboard Username Enumeration Vulnerability

Cisco Nexus Dashboard Unauthorized REST API Vulnerability

Cisco Nexus Dashboard Insights Arbitrary File Write Vulnerability

A vulnerability in Cisco Nexus Dashboard could allow an authenticated, remote attacker to learn cluster deployment information on an affected device. This vulnerability is due to improper access controls on a specific API endpoint. An attacker could exploit this vulnerability by sending queries to the API endpoint. A successful exploit could allow an attacker to access metrics and information about devices in the Nexus Dashboard cluster.