Vulnerabilities > Cisco > Integrated Management Controller Supervisor

DATE CVE VULNERABILITY TITLE RISK
2021-12-10 CVE-2021-44228 Deserialization of Untrusted Data vulnerability in multiple products
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints.
10.0
2020-05-06 CVE-2020-3329 Unspecified vulnerability in Cisco products
A vulnerability in role-based access control of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow a read-only authenticated, remote attacker to disable user accounts on an affected system.
network
low complexity
cisco
4.3
2019-08-21 CVE-2019-1974 Improper Authentication vulnerability in Cisco products
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to bypass user authentication and gain access as an administrative user.
network
low complexity
cisco CWE-287
critical
9.8
2019-08-21 CVE-2019-1937 Improper Authentication vulnerability in Cisco products
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to acquire a valid session token with administrator privileges, bypassing user authentication.
network
low complexity
cisco CWE-287
critical
9.8
2019-08-21 CVE-2019-1936 Improper Input Validation vulnerability in Cisco products
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an authenticated, remote attacker to execute arbitrary commands on the underlying Linux shell as the root user.
network
low complexity
cisco CWE-20
7.2
2019-08-21 CVE-2019-1935 Use of Hard-coded Credentials vulnerability in Cisco products
A vulnerability in Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to log in to the CLI of an affected system by using the SCP User account (scpuser), which has default user credentials.
network
low complexity
cisco CWE-798
critical
9.8
2019-08-21 CVE-2019-1908 Unspecified vulnerability in Cisco products
A vulnerability in the Intelligent Platform Management Interface (IPMI) implementation of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to view sensitive system information.
network
low complexity
cisco
7.5
2019-08-21 CVE-2019-1907 Unspecified vulnerability in Cisco products
A vulnerability in the web server of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to set sensitive configuration values and gain elevated privileges.
network
low complexity
cisco
8.8
2019-08-21 CVE-2019-1900 NULL Pointer Dereference vulnerability in Cisco products
A vulnerability in the web server of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to cause the web server process to crash, causing a denial of service (DoS) condition on an affected system.
network
low complexity
cisco CWE-476
7.5
2019-08-21 CVE-2019-1896 OS Command Injection vulnerability in Cisco products
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to inject arbitrary commands and obtain root privileges.
network
low complexity
cisco CWE-78
7.2