Cisco Unified Computing System Central Software vulnerabilities

12 CVEs affecting Cisco Unified Computing System Central Software, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-1354, published 2021-02-04.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-0701, published 2015-05-07. High severity, CVSS 10.0. EPSS: 4.5% chance of exploitation in the next 30 days. Cisco UCS Central Software before 1.3(1a) allows remote attackers to execute arbitrary commands via a crafted HTTP request, aka Bug ID CSCut46961.
CVE-2018-0094, published 2018-01-18. High severity, CVSS 7.5. EPSS: 2.3% chance of exploitation in the next 30 days. A vulnerability in IPv6 ingress packet processing for Cisco UCS Central Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition due to high CPU…
CVE-2016-1352, published 2016-04-14. Critical severity, CVSS 9.8. EPSS: 2.2% chance of exploitation in the next 30 days. Cisco Unified Computing System (UCS) Central Software 1.3(1b) and earlier allows remote attackers to execute arbitrary OS commands via a crafted HTTP request, aka Bug ID CSCuv33856.
CVE-2018-0113, published 2018-02-08. High severity, CVSS 8.8. EPSS: 2.2% chance of exploitation in the next 30 days. A vulnerability in an operations script of Cisco UCS Central could allow an authenticated, remote attacker to execute arbitrary shell commands with the privileges of the daemon user. The…
CVE-2015-6388, published 2015-12-05. Medium severity, CVSS 5.0. EPSS: 2% chance of exploitation in the next 30 days. Cisco Unified Computing System (UCS) Central software 1.3(0.1) allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted request, aka Bug ID CSCux33575.
CVE-2015-4286, published 2015-07-29. Medium severity, CVSS 5.0. EPSS: 1.7% chance of exploitation in the next 30 days. The web framework in Cisco UCS Central Software 1.3(0.99) allows remote attackers to read arbitrary files via a crafted HTTP request, aka Bug ID CSCuu41377.
CVE-2015-6387, published 2015-12-05. Medium severity, CVSS 4.3. EPSS: 1.4% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Cisco Unified Computing System (UCS) Central Software 1.3(0.1) allows remote attackers to inject arbitrary web script or HTML via a crafted value in a URL,…
CVE-2016-1401, published 2016-05-21. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the management interface in Cisco Unified Computing System (UCS) Central Software 1.4(1a) allows remote attackers to inject arbitrary web script or HTML…
CVE-2017-12349, published 2017-11-30. Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days. Multiple vulnerabilities in the web-based management interface of Cisco UCS Central Software could allow a remote attacker to conduct a cross-site scripting (XSS) attack against a user of the…
CVE-2017-12348, published 2017-11-30. Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days. Multiple vulnerabilities in the web-based management interface of Cisco UCS Central Software could allow a remote attacker to conduct a cross-site scripting (XSS) attack against a user of the…

Latest

CVE-2021-1354, published 2021-02-04. Low severity, CVSS 3.5. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability in the certificate registration process of Cisco Unified Computing System (UCS) Central Software could allow an authenticated, adjacent attacker to register a rogue Cisco Unified…