Priority MEDIUM 45
A vulnerability in the REST API and web UI of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attacker to perform a command injection attack against an affected device.
CVSS 3.1CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.01142 · Published 2024-10-02 · No fix listed CWE-77
Priority MEDIUM 42
A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, remote attacker with low privileges to execute arbitrary code on an affected device.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00946 · Published 2024-10-02 · No fix listed CWE-23
Priority MEDIUM 41
A vulnerability in a REST API endpoint and web-based management interface of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, remote attacker with read-only privileges to execute arbitrary SQL…
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00767 · Published 2024-11-06 · No fix listed CWE-89
Priority LOW 38
A vulnerability in the web-based management interface of Cisco Nexus Dashboard and Cisco Nexus Dashboard hosted services could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) atta…
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.0026 · Published 2024-04-03 · No fix listed CWE-352
Priority LOW 37
A vulnerability in a logging function of Cisco Nexus Dashboard Insights could allow an attacker with access to a tech support file to view sensitive information.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.00286 · Published 2024-10-02 · No fix listed CWE-200
Priority LOW 37
A vulnerability in a logging function of Cisco Nexus Dashboard Fabric Controller (NDFC) and Cisco Nexus Dashboard Orchestrator (NDO) could allow an attacker with access to a tech support file to view sensitive informatio…
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.00286 · Published 2024-10-02 · No fix listed CWE-200
Priority LOW 36
A vulnerability in the Cisco Nexus Dashboard Fabric Controller (NDFC) software, formerly Cisco Data Center Network Manager (DCNM), could allow an attacker with access to a backup file to view sensitive information.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.0012 · Published 2024-10-02 · No fix listed CWE-313
Priority LOW 34
A vulnerability in the Out-of-Band (OOB) Plug and Play (PnP) feature of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauthenticated, remote attacker to read arbitrary files.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00803 · Published 2024-04-03 · No fix listed CWE-27
Priority LOW 29
A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to learn sensitive information on an affected device.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00491 · Published 2024-10-02 · No fix listed CWE-285
Priority LOW 28
A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC), formerly Cisco Data Center Network Manager (DCNM), could allow an authenticated, remote attacker with network-admin privileges to perform a command injec…
CVSS 3.1MEDIUM 5.5· Network · High privileges · No interaction · EPSS 0.00755 · Published 2024-10-02 · No fix listed CWE-88
Priority LOW 28
A vulnerability in the REST API endpoints of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to read or write files on an affected device.
CVSS 3.1MEDIUM 6.3· Network · Low privileges · No interaction · EPSS 0.00362 · Published 2024-10-02 · No fix listed CWE-693
Priority LOW 25
A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to upload or delete files on an affected device.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00453 · Published 2024-10-02 · No fix listed CWE-862
Priority LOW 24
A vulnerability in the REST API endpoints of Cisco Nexus Dashboard could allow an authenticated, low-privileged, remote attacker to perform limited Administrator actions on an affected device.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00362 · Published 2024-10-02 · No fix listed CWE-862