Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

11 records

Vendor: Cisco Component: Network Services Orchestrator Clear all filters
TI-2021-00859 CVE-2021-1132 · GHSA-pm93-mhpj-x843

Cisco Network Services Orchestrator Path Traversal Vulnerability

Priority MEDIUM 42

A vulnerability in the API subsystem and in the web-management interface of Cisco Network Services Orchestrator (NSO) could allow an unauthenticated, remote attacker to access sensitive data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01629 Published 2024-11-18 No fix listed CWE-35
TI-2024-13314 CVE-2024-20381 · GHSA-rg27-7v3v-xmhh

Cisco Network Services Orchestrator Configuration Update Authorization Bypass Vulnerability

Priority MEDIUM 41

A vulnerability in the JSON-RPC API feature in Cisco Crosswork Network Services Orchestrator (NSO) and ConfD that is used by the web-based management interfaces of Cisco Optical Site Manager and Cisco RV340 Dual WAN Giga…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00576 Published 2024-09-11 No fix listed CWE-285
TI-2024-13299 CVE-2024-20366 · GHSA-fpvx-gw57-2p3v

Uncontrolled search path in Cisco Network Services Orchestrator

Priority LOW 35

A vulnerability in the Tail-f High Availability Cluster Communications (HCC) function pack of Cisco Crosswork Network Services Orchestrator (NSO) could allow an authenticated, local attacker to elevate privileges to root…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00198 Published 2024-05-15 No fix listed CWE-73
TI-2024-13302 CVE-2024-20369 · GHSA-g96r-v5qq-9qch

Open redirect in Cisco Network Services Orchestrator

Priority LOW 27

A vulnerability in the web-based management interface of Cisco Crosswork Network Services Orchestrator (NSO) could allow an unauthenticated, remote attacker to redirect a user to a malicious web page.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00312 Published 2024-05-15 No fix listed CWE-601
TI-2023-06749 CVE-2023-20040 · GHSA-v96g-9h62-76pj

Path traversal in Cisco Network Services Orchestrator

Priority LOW 27

A vulnerability in the NETCONF service of Cisco Network Services Orchestrator (NSO) could allow an authenticated, remote attacker to cause a denial of service (DoS) on an affected system that is running as the root user.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.01276 Published 2023-01-19 No fix listed CWE-23
TI-2021-19919 CVE-2021-44228 · GHSA-jfh8-c2jp-5v3q

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

Priority CRITICAL 100KEV

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other J…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.99999 Published 2021-12-10 Partial fix · 2.15.0, 2.3.1 +5 CWE-20
TI-2021-01296 CVE-2021-1572 · GHSA-jjcm-mvqj-g3mq

ConfD CLI Secure Shell Server Privilege Escalation Vulnerability

Priority LOW 35

A vulnerability in ConfD could allow an authenticated, local attacker to execute arbitrary commands at the level of the account under which ConfD is running, which is commonly root.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00229 Published 2021-08-04 No fix listed CWE-266
TI-2020-02914 CVE-2020-3362 · GHSA-jx7x-rhq6-mfr6

Cisco Network Services Orchestrator Information Disclosure Vulnerability

Priority LOW 21

A vulnerability in the CLI of Cisco Network Services Orchestrator (NSO) could allow an authenticated, local attacker to access confidential information on an affected device.

CVSS 3.1MEDIUM 4.7 Local Low privileges No interaction EPSS 0.00254 Published 2020-06-18 No fix listed CWE-200
TI-2018-00422 CVE-2018-0463 · GHSA-q65f-gxh5-gqxg

Cisco Network Services Orchestrator Network Plug and Play Information Disclosure Vulnerability

Priority MEDIUM 42

A vulnerability in the Cisco Network Plug and Play server component of Cisco Network Services Orchestrator (NSO) could allow an unauthenticated, remote attacker to gain unauthorized access to configuration data that is s…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01487 Published 2018-10-05 No fix listed CWE-264
TI-2018-00233 CVE-2018-0274 · GHSA-73h9-784v-5f52

Improper input validation in Cisco Network Services Orchestrator unknown

Priority MEDIUM 47

A vulnerability in the CLI parser of Cisco Network Services Orchestrator (NSO) could allow an authenticated, remote attacker to execute arbitrary shell commands with the privileges of the root user.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03769 Published 2018-06-07 No fix listed CWE-20