Cisco Prime Service Catalog vulnerabilities

16 CVEs affecting Cisco Prime Service Catalog, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-20680, published 2022-02-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability, published 2021-12-10. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker…
CVE-2018-0285, published 2018-05-02. Medium severity, CVSS 6.5. EPSS: 2.6% chance of exploitation in the next 30 days. A vulnerability in service logging for Cisco Prime Service Catalog could allow an authenticated, remote attacker to deny service to the user interface. The vulnerability is due to exhaustion of disk…
CVE-2015-0581, published 2015-01-28. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. The XML parser in Cisco Prime Service Catalog before 10.1 allows remote authenticated users to read arbitrary files or cause a denial of service (CPU and memory consumption) via an external entity…
CVE-2015-6395, published 2015-12-12. Medium severity, CVSS 6.5. EPSS: 1.5% chance of exploitation in the next 30 days. Cisco Prime Service Catalog 10.0, 10.0(R2), 10.1, and 11.0 does not properly restrict access to web pages, which allows remote attackers to modify the configuration via a direct request, aka Bug ID…
CVE-2015-6350, published 2015-10-30. Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days. SQL injection vulnerability in the web framework in Cisco Prime Service Catalog 11.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuw50843.
CVE-2015-4190, published 2015-06-17. Medium severity, CVSS 4.3. EPSS: 1.3% chance of exploitation in the next 30 days. Cisco Cloud Portal in Cisco Prime Service Catalog 9.4.1_vortex on Cloud Portal appliances allows man-in-the-middle attackers to modify data via unspecified vectors, aka Bug ID CSCuh19683.
CVE-2017-12364, published 2017-11-30. Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days. A SQL Injection vulnerability in the web framework of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to execute unauthorized Structured Query Language (SQL) queries. The…
CVE-2017-3866, published 2017-03-17. Medium severity, CVSS 6.1. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability in the web framework code of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web…
CVE-2018-0200, published 2018-02-22. Medium severity, CVSS 6.1. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability in the web-based interface of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of…
CVE-2017-3810, published 2017-02-03. Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days. A vulnerability in the web framework of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conduct a web URL redirect attack against a user who is logged in to an affected…

Latest

CVE-2022-20680, published 2022-02-10. Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to access sensitive information on an affected device. This…
CVE-2019-1875, published 2019-06-20. Medium severity, CVSS 4.8. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the…
CVE-2019-1874, published 2019-06-20. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Prime Service Catalog Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on…
CVE-2018-15451, published 2018-11-08. Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the…
CVE-2018-0107, published 2018-01-18. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability in the web framework of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to execute unwanted actions on an affected device. The vulnerability is due to a…