Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

15 records

Vendor: Cisco Component: Hyperflex Hx Data Platform Clear all filters
TI-2023-06967 CVE-2023-20263 · GHSA-fr6h-cvqr-2jq8

Open redirect in Cisco HyperFlex HX Data Platform

Priority LOW 28

A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to redirect a user to a malicious web page.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00579 Published 2023-09-06 No fix listed CWE-601
TI-2021-01226 CVE-2021-1499 · GHSA-389x-22j4-jr37

Cisco HyperFlex HX Data Platform File Upload Vulnerability

Priority HIGH 70

A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to upload files to an affected device.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.79978 Published 2021-05-06 No fix listed CWE-306
TI-2021-01225 CVE-2021-1498 · GHSA-h6vv-5xx4-c25q

Cisco HyperFlex HX Command Injection Vulnerabilities

Priority CRITICAL 100KEV

Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99999 Published 2021-05-06 No fix listed CWE-78
TI-2021-01224 CVE-2021-1497 · GHSA-2hv5-x25m-j674

Cisco HyperFlex HX Command Injection Vulnerabilities

Priority CRITICAL 100KEV

Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99922 Published 2021-05-06 No fix listed CWE-78
TI-2019-01578 CVE-2019-1958 · GHSA-9jvv-vrqg-9vhg

Cisco HyperFlex Software Cross-Site Request Forgery Vulnerability

Priority LOW 39

A vulnerability in the web-based management interface of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.006 Published 2019-08-08 No fix listed CWE-352
TI-2019-01293 CVE-2019-1667 · GHSA-4mrw-m8gp-8hgx

Cisco HyperFlex Arbitrary Statistics Write Vulnerability

Priority LOW 15

A vulnerability in the Graphite interface of Cisco HyperFlex software could allow an authenticated, local attacker to write arbitrary data to the Graphite interface.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00174 Published 2019-02-21 Fixed in 3.5(2a) CWE-345
TI-2019-01292 CVE-2019-1666 · GHSA-268p-g9gf-2gh5

Cisco HyperFlex Unauthenticated Statistics Retrieval Vulnerability

Priority LOW 34

A vulnerability in the Graphite service of Cisco HyperFlex software could allow an unauthenticated, remote attacker to retrieve data from the Graphite service.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02208 Published 2019-02-21 Fixed in 3.5(2a) CWE-284
TI-2019-01291 CVE-2019-1665 · GHSA-55q5-vmf8-xcfc

Cisco Hyperflex Stored Cross-Site Scripting Vulnerability

Priority LOW 29

A vulnerability in the web-based management interface of Cisco HyperFlex software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01094 Published 2019-02-21 Fixed in 3.5(1a) CWE-79
TI-2019-01290 CVE-2019-1664 · GHSA-jjrr-rj68-xhw3

Cisco HyperFlex Software Unauthenticated Root Access Vulnerability

Priority LOW 36

A vulnerability in the hxterm service of Cisco HyperFlex Software could allow an unauthenticated, local attacker to gain root access to all nodes in the cluster.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00334 Published 2019-02-21 Fixed in 3.5(2a) CWE-284
TI-2018-10942 CVE-2018-15380 · GHSA-39c5-pg2r-45hj

Cisco HyperFlex Software Command Injection Vulnerability

Priority MEDIUM 42

A vulnerability in the cluster service manager of Cisco HyperFlex Software could allow an unauthenticated, adjacent attacker to execute commands as the root user.

CVSS 3.0HIGH 8.8 Adjacent network No auth No interaction EPSS 0.01133 Published 2019-02-20 Fixed in 3.5(2a) CWE-78
TI-2018-10983 CVE-2018-15423 · GHSA-9g5x-wr2w-vx7m

Cisco HyperFlex UI Clickjacking Vulnerability

Priority LOW 23

A vulnerability in the web UI of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to affect the integrity of a device via a clickjacking attack.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00922 Published 2018-10-05 No fix listed CWE-693
TI-2018-10967 CVE-2018-15407 · GHSA-qg7x-r68h-9889

Cisco HyperFlex World-Readable Sensitive Information Vulnerability

Priority LOW 25

A vulnerability in the installation process of Cisco HyperFlex Software could allow an authenticated, local attacker to read sensitive information.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00286 Published 2018-10-05 No fix listed CWE-200
TI-2018-10944 CVE-2018-15382 · GHSA-w2hw-vrcc-cpx9

Cisco HyperFlex Software Static Signing Key Vulnerability

Priority MEDIUM 46

A vulnerability in Cisco HyperFlex Software could allow an unauthenticated, remote attacker to generate valid, signed session tokens.

CVSS 3.0HIGH 8.6 Network No auth No interaction EPSS 0.01281 Published 2018-10-05 No fix listed CWE-642
TI-2017-09091 CVE-2017-12315 · GHSA-wgm8-4c2w-8672

Information disclosure in Cisco HyperFlex System

Priority LOW 27

A vulnerability in system logging when replication is being configured with the Cisco HyperFlex System could allow an authenticated, local attacker to view sensitive information that should be restricted in the system lo…

CVSS 3.0MEDIUM 6.0 Local High privileges No interaction EPSS 0.00326 Published 2017-11-16 No fix listed CWE-200