Summary
Ein Angreifer kann mehrere Schwachstellen im Cisco Unified Computing System (UCS) und im Cisco Integrated Management Controller ausnutzen, um Administratorrechte zu erlangen, Cross-Site-Scripting-Angriffe durchzuführen, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder Benutzer auf bösartige Websites umzuleiten.
Product
Bei dem Cisco Unified Computing System (UCS) handelt es sich um eine Rechenzentrumsplattform, die Rechenleistung, Netzwerk, Storage-Zugriff und Virtualisierung in einem System zusammenführt.
Der Cisco Integrated Management Controller ist eine Serververwaltung für mehrere Cisco-Produkte.
Vulnerabilities 5
-
High 7.1
Cisco UCS Virtual Keyboard Video Monitor (vKVM) Open Redirect Vulnerability
A vulnerability in the Virtual Keyboard Video Monitor (vKVM) connection handling of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to redirect a user to a malicious website. This vulnerability is due to insufficie…
-
Medium 6.5
Cisco UCS Manager Software Command Injection Vulnerability
Multiple vulnerabilities in the CLI and web-based management interface of Cisco UCS Manager Software could allow an authenticated, remote attacker with administrative privileges to perform command injection attacks on an affected system and elevate privileges…
-
Medium 6.0
Cisco UCS Manager Software Command Injection Vulnerability
A vulnerability in the CLI of Cisco UCS Manager Software could allow an authenticated, local attacker with administrative privileges to read or create a file or overwrite any file on the file system of the underlying operating system of an affected device, in…
-
Medium 5.4
Cisco UCS Manager Software Stored Software Stored Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco UCS Manager Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient …
-
Medium 5.4
Cisco Integrated Management Controller Virtual Keyboard Video Monitor (vKVM) Stored Cross-Site Scripting Vulnerability
A vulnerability in the Virtual Keyboard Video Monitor (vKVM) connection handling of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker with low privileges to conduct a stored cross-site scripting (XSS) attack against a …
Revision history
-
#1
Initiale Fassung
References
-
Cisco Security Advisory cisco-sa-ucs-multi-cmdinj-E4Ukjyrz vom 2025-08-27
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-multi-cmdinj-E4Ukjyrz
-
Cisco Security Advisory cisco-sa-ucs-xss-Ey6XhyPS vom 2025-08-27
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-xss-Ey6XhyPS
-
Cisco Security Advisory cisco-sa-ucs-vkvmorv-CnKrV7HK vom 2025-08-27
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-vkvmorv-CnKrV7HK
-
Cisco Security Advisory cisco-sa-ucs-kvmsxss-6h7AnUyk vom 2025-08-27
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-kvmsxss-6h7AnUyk