Overview 160 matches · 1 in Waratek scope · 1 protected · 1 exploited · 1 CISA KEV · 3 public PoC · 2 EPSS ≥ 0.5
160matches
1in Waratek scope0.6%
1protected0.6%
1exploited0.6%
1CISA KEV0.6%
3public PoC1.9%
2EPSS ≥ 0.51.2%
Protected by Waratek
1
0.6%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
118
73.8%
Not applicable
41
25.6%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
0.6%
partly blocked
0
0.0%
not blocked
159
99.4%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 48 / year
20111
Outside Waratek scope1
Medium1
not blocked1
No public exploit1
20123
Not applicable3
Medium3
not blocked3
No public exploit3
201348
Outside Waratek scope39
Not applicable9
High8
Medium40
not blocked48
No public exploit48
20146
Outside Waratek scope3
Not applicable3
High2
Medium4
not blocked6
No public exploit6
201512
Outside Waratek scope8
Not applicable4
High5
Medium7
not blocked12
No public exploit12
20168
Outside Waratek scope3
Not applicable5
Critical2
High5
Medium1
not blocked8
No public exploit8
201723
Outside Waratek scope17
Not applicable6
High6
Medium17
not blocked23
Working exploit published1
No public exploit22
201813
Outside Waratek scope4
Not applicable9
Critical5
High6
Medium2
not blocked13
No public exploit13
201922
Outside Waratek scope21
Not applicable1
High14
Medium8
not blocked22
No public exploit22
20202
Outside Waratek scope2
Medium2
not blocked2
Proof of concept only1
No public exploit1
20217
Protected by Waratek1
Outside Waratek scope5
Not applicable1
Critical1
High3
Medium3
blocked by ARMR today1
not blocked6
Exploited1
No public exploit6
20220
20230
20243
Outside Waratek scope3
High1
Medium2
not blocked3
No public exploit3
20250
202612
Outside Waratek scope12
High3
Medium9
not blocked12
No public exploit12
20122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2015-0633 | Medium | 2015-02-26 | Outside Waratek scope | No public exploit | The Integrated Management Controller (IMC) in Cisco Unified Computing System (UCS) 1.4(7h) and earlier on C-Series servers allows remote attackers to bypass intended access restrictions by sending crafted DHCP response packets on the local network, aka Bug ID CSCuf52876. |
| CVE-2015-0599 | Medium | 2015-02-03 | Outside Waratek scope | No public exploit | The web interface in Cisco Integrated Management Controller in Cisco Unified Computing System (UCS) on C-Series Rack Servers does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCuf50138. |
| CVE-2014-8009 | Medium | 2014-12-10 | Outside Waratek scope | No public exploit | The Management subsystem in Cisco Unified Computing System 2.1(3f) and earlier allows remote attackers to obtain sensitive information by reading log files, aka Bug ID CSCur99239. |
| CVE-2014-8003 | High | 2014-12-10 | Outside Waratek scope | No public exploit | Cisco Integrated Management Controller in Cisco Unified Computing System 2.2(2c)A and earlier allows local users to obtain shell access via a crafted map-nfs command, aka Bug ID CSCup05998. |
| CVE-2014-7996 | Medium | 2014-11-18 | Outside Waratek scope | No public exploit | Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Integrated Management Controller in Cisco Unified Computing System allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuq45477. |
| CVE-2014-3348 | Medium | 2014-09-10 | Not applicable | No public exploit | The SSH module in the Integrated Management Controller (IMC) before 2.3.1 in Cisco Unified Computing System on E-Series blade servers allows remote attackers to cause a denial of service (IMC hang) via a crafted SSH packet, aka Bug ID CSCuo69206. |
| CVE-2014-3261 | High | 2014-05-26 | Not applicable | No public exploit | Buffer overflow in the Smart Call Home implementation in Cisco NX-OS on Fabric Interconnects in Cisco Unified Computing System 1.4 before 1.4(1i), NX-OS 5.0 before 5.0(3)U2(2) on Nexus 3000 devices, NX-OS 4.1 before 4.1(2)E1(1l) on Nexus 4000 devices, NX-OS 5.x before 5.1(3)N1(1) on Nexus 5000 devices, NX-OS 5.2 before 5.2(3a) on Nexus 7000 devices, and CG-OS CG4 before CG4(2) on Connected 1000 Connected Grid Routers allows remote SMTP servers to execute arbitrary code via a crafted reply, aka Bug IDs CSCtk00695, CSCts56633, CSCts56632, CSCts56628, CSCug14405, and CSCuf61322. |
| CVE-2014-0730 | Medium | 2014-02-22 | Not applicable | No public exploit | Cisco Unified Computing System (UCS) Central Software 1.1 and earlier allows local users to gain privileges via a CLI copy command in a local-mgmt context, aka Bug ID CSCul53128. |
| CVE-2013-5550 | Medium | 2013-10-22 | Outside Waratek scope | No public exploit | The fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to cause a denial of service via crafted command parameters that trigger hardware-component write operations, aka Bug ID CSCtq86549. |
| CVE-2012-4115 | Medium | 2013-10-21 | Outside Waratek scope | No public exploit | The fabric-interconnect component in Cisco Unified Computing System (UCS) does not encrypt KVM virtual-media data, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or modify this traffic by inserting packets into the client-server data stream, aka Bug ID CSCtr72964. |
| CVE-2012-4117 | Medium | 2013-10-19 | Outside Waratek scope | No public exploit | The fabric-interconnect component in Cisco Unified Computing System (UCS) does not properly verify X.509 certificates, which allows man-in-the-middle attackers to watch SSL KVM video-channel traffic or modify this traffic via a crafted certificate, aka Bug ID CSCtr73033. |
| CVE-2012-4116 | Medium | 2013-10-19 | Outside Waratek scope | No public exploit | The fabric-interconnect component in Cisco Unified Computing System (UCS) does not encrypt KVM media traffic, which allows remote attackers to obtain sensitive information, and consequently complete the authentication process for a server connection, by sniffing the network, aka Bug ID CSCtr72970. |
| CVE-2012-4114 | Medium | 2013-10-19 | Outside Waratek scope | No public exploit | The fabric-interconnect KVM module in Cisco Unified Computing System (UCS) does not encrypt video data, which allows man-in-the-middle attackers to watch KVM display content by sniffing the network or modify this traffic by inserting packets into the client-server data stream, aka Bug ID CSCtr72949. |
| CVE-2012-4113 | Medium | 2013-10-19 | Outside Waratek scope | No public exploit | The fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges and read arbitrary files via crafted command parameters within the command-line interface, aka Bug ID CSCtr43374. |
| CVE-2012-4112 | Medium | 2013-10-19 | Outside Waratek scope | No public exploit | The Baseboard Management Controller (BMC) in Cisco Unified Computing System (UCS) allows local users to gain privileges and execute arbitrary commands via crafted command parameters within the command-line interface, aka Bug ID CSCtr43330. |
| CVE-2012-4108 | Medium | 2013-10-13 | Outside Waratek scope | No public exploit | The fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges and execute arbitrary operating-system commands via crafted parameters to a file-related command, aka Bug ID CSCtq86554. |
| CVE-2012-4107 | Medium | 2013-10-13 | Outside Waratek scope | No public exploit | The fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges and execute arbitrary commands via crafted parameters to a file-related command, aka Bug ID CSCtq86489. |
| CVE-2012-4106 | Medium | 2013-10-13 | Outside Waratek scope | No public exploit | The fabric-interconnect component in Cisco Unified Computing System (UCS) uses the same privilege level for execution of every script, which allows local users to gain privileges and execute arbitrary commands via an unspecified script-execution approach, aka Bug ID CSCtq86477. |
| CVE-2012-4105 | Medium | 2013-10-13 | Outside Waratek scope | No public exploit | The fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to cause a denial of service (component crash) via crafted "debug hardware" parameters, aka Bug ID CSCtq86468. |
| CVE-2012-4084 | Medium | 2013-10-05 | Outside Waratek scope | No public exploit | Cross-site request forgery (CSRF) vulnerability in the web-management interface in the fabric interconnect (FI) component in Cisco Unified Computing System (UCS) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCtg20755. |
| CVE-2012-4136 | Medium | 2013-10-03 | Outside Waratek scope | No public exploit | The high-availability service in the Fabric Interconnect component in Cisco Unified Computing System (UCS) does not properly bind the cluster service to the management interface, which allows remote attackers to obtain sensitive information or cause a denial of service (peer-syncing outage) via a TELNET connection, aka Bug ID CSCtz72910. |
| CVE-2012-4111 | Medium | 2013-10-02 | Outside Waratek scope | No public exploit | The create certreq command in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges by embedding commands in an unspecified parameter, aka Bug ID CSCtq86563. |
| CVE-2012-4110 | Medium | 2013-10-02 | Outside Waratek scope | No public exploit | run-script in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges by embedding commands in an unspecified parameter, aka Bug ID CSCtq86560. |
| CVE-2012-4109 | Medium | 2013-10-02 | Outside Waratek scope | No public exploit | The clear sshkey command in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges by embedding commands in an unspecified parameter, aka Bug ID CSCtq86559. |
| CVE-2012-4104 | Medium | 2013-10-02 | Outside Waratek scope | No public exploit | Absolute path traversal vulnerability in the image-download process in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to overwrite or delete arbitrary files via a full pathname in an image header, aka Bug ID CSCtq02706. |
| CVE-2012-4103 | Medium | 2013-10-02 | Outside Waratek scope | No public exploit | ethanalyzer in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges by embedding commands in an unspecified parameter, aka Bug ID CSCtq02686. |
| CVE-2012-4102 | Medium | 2013-10-02 | Outside Waratek scope | No public exploit | The activate firmware command in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges by embedding commands in an unspecified parameter, aka Bug ID CSCtq02600. |
| CVE-2012-4095 | Medium | 2013-10-02 | Outside Waratek scope | No public exploit | The local file editor in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges, and read or modify arbitrary files, via unspecified key bindings, aka Bug ID CSCtn04521. |
| CVE-2012-4096 | Medium | 2013-10-01 | Outside Waratek scope | No public exploit | The local file editor in the Baseboard Management Controller (BMC) in Cisco Unified Computing System (UCS) allows local users to gain privileges and modify arbitrary fabric-interconnect files, in the context of a vi process, via unspecified commands, aka Bug ID CSCtn06574. |
| CVE-2012-1313 | Medium | 2013-09-27 | Outside Waratek scope | No public exploit | The remote debug shell on the PALO adapter card in Cisco Unified Computing System (UCS) allows local users to gain privileges via malformed show-macstats parameters, aka Bug ID CSCub13772. |
| CVE-2012-4092 | Medium | 2013-09-26 | Outside Waratek scope | No public exploit | The management interface in the Central Software component in Cisco Unified Computing System (UCS) does not properly validate the identity of vCenter consoles, which allows man-in-the-middle attackers to read or modify an inter-device data stream by spoofing an identity, aka Bug ID CSCtk00683. |
| CVE-2012-4088 | Medium | 2013-09-26 | Outside Waratek scope | No public exploit | The FTP server in Cisco Unified Computing System (UCS) has a hardcoded password for an unspecified user account, which makes it easier for remote attackers to read or modify files by leveraging knowledge of this password, aka Bug ID CSCtg20769. |
| CVE-2012-4079 | Medium | 2013-09-26 | Outside Waratek scope | No public exploit | The XML API service in the Fabric Interconnect component in Cisco Unified Computing System (UCS) allows remote attackers to cause a denial of service (API service outage) via a malformed XML document in a packet, aka Bug ID CSCtg48206. |
| CVE-2012-4086 | Medium | 2013-09-25 | Outside Waratek scope | No public exploit | A setup script for fabric interconnect devices in Cisco Unified Computing System (UCS) allows remote attackers to execute arbitrary commands via invalid parameters, aka Bug ID CSCtg20790. |
| CVE-2012-4094 | Medium | 2013-09-24 | Outside Waratek scope | No public exploit | Buffer overflow in the Smart Call Home feature in the fabric interconnect in Cisco Unified Computing System (UCS) allows remote attackers to cause a denial of service by reading and forging control messages associated with Smart Call Home reports, aka Bug ID CSCtl00198. |
| CVE-2012-4089 | Medium | 2013-09-24 | Outside Waratek scope | No public exploit | MCTOOLS in the fabric interconnect in Cisco Unified Computing System (UCS) allows local users to execute arbitrary Baseboard Management Controller (BMC) commands by leveraging (1) local, (2) shell-level, or (3) debug-level privileges at the operating-system layer, aka Bug ID CSCtg76239. |
| CVE-2012-4087 | Medium | 2013-09-24 | Outside Waratek scope | No public exploit | A cluster setup script for fabric interconnect devices in Cisco Unified Computing System (UCS) allows remote attackers to execute arbitrary commands via invalid parameters, aka Bug ID CSCtg20793. |
| CVE-2012-4085 | Medium | 2013-09-24 | Outside Waratek scope | No public exploit | The Intelligent Platform Management Interface (IPMI) implementation in the Blade Management Controller in Cisco Unified Computing System (UCS) allows remote attackers to enumerate valid usernames by observing IPMI interface responses, aka Bug ID CSCtg20761. |
| CVE-2012-4078 | High | 2013-09-24 | Outside Waratek scope | No public exploit | The Baseboard Management Controller (BMC) in Cisco Unified Computing System (UCS) does not properly handle SSH escape sequences, which allows remote authenticated users to bypass an unspecified authentication step via SSH port forwarding, aka Bug ID CSCtg17656. |
| CVE-2012-4093 | Medium | 2013-09-20 | Outside Waratek scope | No public exploit | The Manager component in Cisco Unified Computing System (UCS) allows local users to cause a denial of service via an invalid Smart Call Home contact address, aka Bug ID CSCtl00186. |
| CVE-2012-4083 | Medium | 2013-09-20 | Outside Waratek scope | No public exploit | Multiple buffer overflows in the administrative web interface in Cisco Unified Computing System (UCS) allow remote authenticated users to cause a denial of service (memory corruption and session termination) via long string values for unspecified parameters, aka Bug ID CSCtg20751. |
| CVE-2012-4082 | Medium | 2013-09-20 | Outside Waratek scope | No public exploit | MCTools in the Cisco Management Controller in Cisco Unified Computing System (UCS) allows local users to gain privileges by entering crafted command-line parameters on a Fabric Interconnect device, aka Bug ID CSCtg20749. |
| CVE-2012-4081 | Medium | 2013-09-20 | Outside Waratek scope | No public exploit | MCServer in the Cisco Management Controller in Cisco Unified Computing System (UCS) allows local users to cause a denial of service (application crash) via invalid MCTools parameters, aka Bug ID CSCtg20734. |
| CVE-2012-4074 | Medium | 2013-09-20 | Outside Waratek scope | No public exploit | The Board Management Controller (BMC) in the Serial over LAN (SoL) subsystem in Cisco Unified Computing System (UCS) relies on a hardcoded private key, which allows man-in-the-middle attackers to obtain sensitive information or modify the data stream by leveraging knowledge of this key, aka Bug ID CSCte90338. |
| CVE-2012-4073 | Medium | 2013-09-20 | Outside Waratek scope | No public exploit | The KVM subsystem in the client in Cisco Unified Computing System (UCS) does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers, and read or modify KVM data, via a crafted certificate, aka Bug ID CSCte90332. |
| CVE-2012-4072 | Medium | 2013-09-20 | Outside Waratek scope | No public exploit | The KVM subsystem in Cisco Unified Computing System (UCS) relies on a hardcoded X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers, and read keyboard and mouse events, by leveraging knowledge of this certificate's private key, aka Bug ID CSCte90327. |
| CVE-2013-3467 | Medium | 2013-08-30 | Not applicable | No public exploit | Memory leak in the CLI component on Cisco Unified Computing System (UCS) 6100 Fabric Interconnect devices, in certain situations that lack a SPAN session, allows local users to cause a denial of service (memory consumption and device reset) via a (1) "show monitor session all" or (2) "show monitor session" command, aka Bug ID CSCug20103. |
| CVE-2013-1190 | Medium | 2013-08-02 | Outside Waratek scope | No public exploit | The C-Series Rack Server component 1.4 in Cisco Unified Computing System (UCS) does not properly restrict inbound access to ports, which allows remote attackers to cause a denial of service (Integrated Management Controller reboot or hang) via crafted packets, as demonstrated by nmap, aka Bug ID CSCtx19850. |
| CVE-2013-1198 | Medium | 2013-04-29 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in a Flash component in Cisco Unified Computing System (UCS) Central allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCud15430. |
| CVE-2013-1186 | High | 2013-04-25 | Not applicable | No public exploit | Cisco Unified Computing System (UCS) 1.x before 1.4(4) and 2.x before 2.0(2m) allows remote attackers to bypass KVM authentication via a crafted authentication request to a Cisco Integrated Management Controller (IMC), aka Bug ID CSCts53746. |
| CVE-2013-1185 | High | 2013-04-25 | Not applicable | No public exploit | The web interface in the Manager component in Cisco Unified Computing System (UCS) 1.x and 2.x before 2.0(2m) allows remote attackers to obtain sensitive information by reading a (1) technical-support bundle file or (2) on-device configuration backup, aka Bug ID CSCtq86543. |
| CVE-2013-1184 | High | 2013-04-25 | Not applicable | No public exploit | The management API in the XML API management service in the Manager component in Cisco Unified Computing System (UCS) 1.x before 1.2(1b) allows remote attackers to cause a denial of service (service outage) via a malformed request, aka Bug ID CSCtg48206. |
| CVE-2013-1183 | High | 2013-04-25 | Not applicable | No public exploit | Buffer overflow in the Intelligent Platform Management Interface (IPMI) functionality in the Manager component in Cisco Unified Computing System (UCS) 1.0 and 1.1 before 1.1(1j) and 1.2 before 1.2(1b) allows remote attackers to execute arbitrary code via malformed data in a UDP packet, aka Bug ID CSCtd32371. |
| CVE-2013-1182 | High | 2013-04-25 | Not applicable | No public exploit | The login page in the Web Console in the Manager component in Cisco Unified Computing System (UCS) before 1.0(2h), 1.1 before 1.1(1j), and 1.3(x) allows remote attackers to bypass LDAP authentication via a malformed request, aka Bug ID CSCtc91207. |
| CVE-2013-1181 | High | 2013-04-25 | Not applicable | No public exploit | Cisco NX-OS on Nexus 5500 devices 4.x and 5.x before 5.0(3)N2(2), Nexus 3000 devices 5.x before 5.0(3)U3(2), and Unified Computing System (UCS) 6200 devices before 2.0(1w) allows remote attackers to cause a denial of service (device reload) by sending a jumbo packet to the management interface, aka Bug IDs CSCtx17544, CSCts10593, and CSCtx95389. |
| CVE-2013-1178 | High | 2013-04-25 | Not applicable | No public exploit | Multiple buffer overflows in the Cisco Discovery Protocol (CDP) implementation in Cisco NX-OS on Nexus 7000 devices 4.x and 5.x before 5.2(4) and 6.x before 6.1(1), Nexus 5000 and 5500 devices 4.x and 5.x before 5.1(3)N1(1), Nexus 4000 devices before 4.1(2)E1(1h), Nexus 3000 devices 5.x before 5.0(3)U3(1), Nexus 1000V devices 4.x before 4.2(1)SV1(5.1), MDS 9000 devices 4.x and 5.x before 5.2(4), Unified Computing System (UCS) 6100 and 6200 devices before 2.0(2m), and Connected Grid Router (CGR) 1000 devices before CG4(1) allow remote attackers to execute arbitrary code via malformed CDP packets, aka Bug IDs CSCtu10630, CSCtu10551, CSCtu10550, CSCtw56581, CSCtu10548, CSCtu10544, and CSCuf61275. |
| CVE-2012-1365 | Medium | 2012-08-06 | Not applicable | No public exploit | Cisco Unified Computing System (UCS) 1.4 and 2.0 allows remote authenticated users to cause a denial of service (device reload) via a malformed SNMP request to a Fabric Interconnect (FI) device, aka Bug ID CSCts32463. |
| CVE-2012-1364 | Medium | 2012-08-06 | Not applicable | No public exploit | Cisco Unified Computing System (UCS) 1.4 and 2.0 allows remote authenticated users to cause a denial of service (device reload) via a malformed SNMP request to a Fabric Interconnect (FI) device, aka Bug ID CSCts32452. |
| CVE-2012-1339 | Medium | 2012-08-06 | Not applicable | No public exploit | The Fabric Interconnect component in Cisco Unified Computing System (UCS) 2.0 allows remote attackers to cause a denial of service (process crash) via an attempted SSH session, aka Bug ID CSCtt94543. |
| CVE-2011-2569 | Medium | 2011-10-27 | Outside Waratek scope | No public exploit | Cisco Nexus OS (aka NX-OS) 4.2 and 5.0 and Cisco Unified Computing System with software 1.4 and 2.0 do not properly restrict command-line options, which allows local users to gain privileges via unspecified vectors, aka Bug IDs CSCtf40008, CSCtg18363, CSCtr44645, CSCts10195, and CSCts10188. |