CVE Daily – Nexus Repository (High+Critical) https://cvedaily.com/pages/tags/nexus.html CVE Daily – Nexus Repository (High+Critical) en Wed, 03 Jun 2026 21:26:44 +0000 [Critical] CVE-2026-5189 – CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager vers... https://nvd.nist.gov/vuln/detail/CVE-2026-5189 https://nvd.nist.gov/vuln/detail/CVE-2026-5189 Wed, 15 Apr 2026 19:16:37 +0000 Critical CVE-2026-5189

CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 allows an unauthenticated attacker with network access to gain unauthorized read/write access to the internal database and execute arbitrary OS commands as the Nexus process user. Exploitation requires the non-default nexus.orient.binaryListenerEnabled=true configuration to be enabled.

CVSS: 9.2 · CWE: CWE-798

View on NVD

]]> [Critical] CVE-2026-3199 – A vulnerability in the task management component of Sonatype Nexus Repository ve... https://nvd.nist.gov/vuln/detail/CVE-2026-3199 https://nvd.nist.gov/vuln/detail/CVE-2026-3199 Wed, 08 Apr 2026 23:16:59 +0000 Critical CVE-2026-3199

A vulnerability in the task management component of Sonatype Nexus Repository versions 3.22.1 through 3.90.2 allows an authenticated attacker with task creation permissions to execute arbitrary code, bypassing the nexus.scripts.allowCreation security control.

CVSS: 9.4 · CWE: CWE-502

View on NVD

]]> [High] CVE-2026-20051 – A vulnerability with the Ethernet VPN (EVPN) Layer 2 ingress packet processing o... https://nvd.nist.gov/vuln/detail/CVE-2026-20051 https://nvd.nist.gov/vuln/detail/CVE-2026-20051 Wed, 25 Feb 2026 17:25:26 +0000 High CVE-2026-20051

A vulnerability with the Ethernet VPN (EVPN) Layer 2 ingress packet processing of Cisco Nexus 3600 Platform Switches and Cisco Nexus 9500-R Series Switching Platforms could allow an unauthenticated, adjacent attacker to trigger a Layer 2 traffic loop. This vulnerability is due to a logic error when processing a crafted Layer 2 ingress frame. An attacker could exploit this vulnerability by send…

CVSS: 7.4 · CWE: CWE-457

View on NVD

]]> [High] CVE-2026-20048 – A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Ci... https://nvd.nist.gov/vuln/detail/CVE-2026-20048 https://nvd.nist.gov/vuln/detail/CVE-2026-20048 Wed, 25 Feb 2026 17:25:25 +0000 High CVE-2026-20048

A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco Nexus 9000 Series Fabric Switches in ACI mode could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper processing when parsing SNMP requests. An attacker could exploit this vulnerability by continuously sending SNMP q…

CVSS: 7.7 · CWE: CWE-789

View on NVD

]]> [High] CVE-2026-20033 – A vulnerability in Cisco Nexus 9000 Series Fabric Switches in ACI mode could all... https://nvd.nist.gov/vuln/detail/CVE-2026-20033 https://nvd.nist.gov/vuln/detail/CVE-2026-20033 Wed, 25 Feb 2026 17:25:24 +0000 High CVE-2026-20033

A vulnerability in Cisco Nexus 9000 Series Fabric Switches in ACI mode could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient validation when processing specific Ethernet frames. An attacker could exploit this vulnerability by sending a crafted Ethernet frame to the management interfac…

CVSS: 7.4 · CWE: CWE-805

View on NVD

]]> [High] CVE-2025-9868 – Server-Side Request Forgery (SSRF) in the Remote Browser Plugin in Sonatype Nexu... https://nvd.nist.gov/vuln/detail/CVE-2025-9868 https://nvd.nist.gov/vuln/detail/CVE-2025-9868 Wed, 08 Oct 2025 18:15:35 +0000 High CVE-2025-9868

Server-Side Request Forgery (SSRF) in the Remote Browser Plugin in Sonatype Nexus Repository 2.x up to and including 2.15.2 allows unauthenticated remote attackers to exfiltrate proxy repository credentials via crafted HTTP requests.

CVSS: 8.7 · CWE: CWE-918

View on NVD

]]> [High] CVE-2025-39788 – In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: ... https://nvd.nist.gov/vuln/detail/CVE-2025-39788 https://nvd.nist.gov/vuln/detail/CVE-2025-39788 Thu, 11 Sep 2025 17:15:45 +0000 High CVE-2025-39788

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE On Google gs101, the number of UTP transfer request slots (nutrs) is 32, and in this case the driver ends up programming the UTRL_NEXUS_TYPE incorrectly as 0. This is because the left hand side of the shift is 1, which is of type int, i.e. 31 bits wide. Shifting by more…

CVSS: 7.8 · CWE: CWE-787

View on NVD

]]> [High] CVE-2025-20241 – A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) featur... https://nvd.nist.gov/vuln/detail/CVE-2025-20241 https://nvd.nist.gov/vuln/detail/CVE-2025-20241 Wed, 27 Aug 2025 17:15:34 +0000 High CVE-2025-20241

A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, adjacent attacker to cause the IS-IS process to unexpectedly restart, which could cause an affected device to reload. This vulnerability is due to insufficient…

CVSS: 7.4 · CWE: CWE-733

View on NVD

]]> [High] CVE-2025-20163 – A vulnerability in the SSH implementation of Cisco Nexus Dashboard Fabric Contro... https://nvd.nist.gov/vuln/detail/CVE-2025-20163 https://nvd.nist.gov/vuln/detail/CVE-2025-20163 Wed, 04 Jun 2025 17:15:26 +0000 High CVE-2025-20163

A vulnerability in the SSH implementation of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauthenticated, remote attacker to impersonate Cisco NDFC-managed devices. This vulnerability is due to insufficient SSH host key validation. An attacker could exploit this vulnerability by performing a machine-in-the-middle attack on SSH connections to Cisco NDFC-managed devices, which…

CVSS: 8.7 · CWE: CWE-322

View on NVD

]]> [High] CVE-2024-13957 – SSRF Server Side Request Forgery vulnerabilities exist in ASPECT if administrato... https://nvd.nist.gov/vuln/detail/CVE-2024-13957 https://nvd.nist.gov/vuln/detail/CVE-2024-13957 Thu, 22 May 2025 19:15:40 +0000 High CVE-2024-13957

SSRF Server Side Request Forgery vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

CVSS: 7.6 · CWE: CWE-918

View on NVD

]]> [High] CVE-2024-13955 – 2nd Order SQL injection vulnerabilities in ASPECT allow unintended access and ma... https://nvd.nist.gov/vuln/detail/CVE-2024-13955 https://nvd.nist.gov/vuln/detail/CVE-2024-13955 Thu, 22 May 2025 19:15:39 +0000 High CVE-2024-13955

2nd Order SQL injection vulnerabilities in ASPECT allow unintended access and manipulation of database repositories if administrator credentials become compromised.This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

CVSS: 8.8 · CWE: CWE-89

View on NVD

]]> [High] CVE-2024-13952 – Predictable filename vulnerabilities in ASPECT may expose sensitive information ... https://nvd.nist.gov/vuln/detail/CVE-2024-13952 https://nvd.nist.gov/vuln/detail/CVE-2024-13952 Thu, 22 May 2025 19:15:39 +0000 High CVE-2024-13952

Predictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attacker if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

CVSS: 8.4 · CWE: CWE-94

View on NVD

]]> [High] CVE-2024-13951 – One way hash with predictable salt vulnerabilities in ASPECT may expose sensitiv... https://nvd.nist.gov/vuln/detail/CVE-2024-13951 https://nvd.nist.gov/vuln/detail/CVE-2024-13951 Thu, 22 May 2025 19:15:38 +0000 High CVE-2024-13951

One way hash with predictable salt vulnerabilities in ASPECT may expose sensitive information to a potential attackerThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

CVSS: 7.6 · CWE: CWE-760

View on NVD

]]> [High] CVE-2024-13948 – Windows permissions for ASPECT configuration toolsets are not fully secured allo... https://nvd.nist.gov/vuln/detail/CVE-2024-13948 https://nvd.nist.gov/vuln/detail/CVE-2024-13948 Thu, 22 May 2025 19:15:38 +0000 High CVE-2024-13948

Windows permissions for ASPECT configuration toolsets are not fully secured allow-ing exposure of configuration informationThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

CVSS: 7.3 · CWE: CWE-276

View on NVD

]]> [High] CVE-2025-30172 – Remote Code Execution vulnerabilities are present in ASPECT if session administr... https://nvd.nist.gov/vuln/detail/CVE-2025-30172 https://nvd.nist.gov/vuln/detail/CVE-2025-30172 Thu, 22 May 2025 18:15:42 +0000 High CVE-2025-30172

Remote Code Execution vulnerabilities are present in ASPECT if session administrator credentials become compromised This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.

CVSS: 8.0 · CWE: CWE-94

View on NVD

]]> [Critical] CVE-2025-30171 – System File Deletion vulnerabilities in ASPECT provide attackers access to delet... https://nvd.nist.gov/vuln/detail/CVE-2025-30171 https://nvd.nist.gov/vuln/detail/CVE-2025-30171 Thu, 22 May 2025 18:15:41 +0000 Critical CVE-2025-30171

System File Deletion vulnerabilities in ASPECT provide attackers access to delete system files if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.

CVSS: 9.0 · CWE: CWE-863

View on NVD

]]> [Critical] CVE-2025-2410 – Port manipulation vulnerabilities in ASPECT provide attackers with the ability t... https://nvd.nist.gov/vuln/detail/CVE-2025-2410 https://nvd.nist.gov/vuln/detail/CVE-2025-2410 Thu, 22 May 2025 18:15:41 +0000 Critical CVE-2025-2410

Port manipulation vulnerabilities in ASPECT provide attackers with the ability to con-trol TCP/IP port access if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.

CVSS: 9.1 · CWE: CWE-99

View on NVD

]]> [Critical] CVE-2025-2409 – File corruption vulnerabilities in ASPECT provide attackers access to overwrite ... https://nvd.nist.gov/vuln/detail/CVE-2025-2409 https://nvd.nist.gov/vuln/detail/CVE-2025-2409 Thu, 22 May 2025 18:15:40 +0000 Critical CVE-2025-2409

File corruption vulnerabilities in ASPECT provide attackers access to overwrite sys-tem files if session administrator credentials become compromised This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.

CVSS: 9.1 · CWE: CWE-73

View on NVD

]]> [High] CVE-2024-9639 – Remote Code Execution vulnerabilities are present in ASPECT if session administr... https://nvd.nist.gov/vuln/detail/CVE-2024-9639 https://nvd.nist.gov/vuln/detail/CVE-2024-9639 Thu, 22 May 2025 18:15:40 +0000 High CVE-2024-9639

Remote Code Execution vulnerabilities are present in ASPECT if session administra-tor credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.

CVSS: 8.0 · CWE: CWE-94

View on NVD

]]> [High] CVE-2024-13931 – Relative Path Traversal vulnerabilities in ASPECT allow access to file resources... https://nvd.nist.gov/vuln/detail/CVE-2024-13931 https://nvd.nist.gov/vuln/detail/CVE-2024-13931 Thu, 22 May 2025 18:15:40 +0000 High CVE-2024-13931

Relative Path Traversal vulnerabilities in ASPECT allow access to file resources if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.

CVSS: 7.2 · CWE: CWE-606

View on NVD

]]> [High] CVE-2024-13929 – Servlet injection vulnerabilities in ASPECT allow remote code execution if sessi... https://nvd.nist.gov/vuln/detail/CVE-2024-13929 https://nvd.nist.gov/vuln/detail/CVE-2024-13929 Thu, 22 May 2025 18:15:39 +0000 High CVE-2024-13929

Servlet injection vulnerabilities in ASPECT allow remote code execution if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.

CVSS: 7.2 · CWE: CWE-94

View on NVD

]]> [High] CVE-2024-13928 – SQL injection vulnerabilities in ASPECT allow unintended access and manipulation... https://nvd.nist.gov/vuln/detail/CVE-2024-13928 https://nvd.nist.gov/vuln/detail/CVE-2024-13928 Thu, 22 May 2025 18:15:39 +0000 High CVE-2024-13928

SQL injection vulnerabilities in ASPECT allow unintended access and manipulation of database repositories if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.

CVSS: 7.2 · CWE: CWE-94

View on NVD

]]> [Critical] CVE-2024-48853 – An escalation of privilege vulnerability in ASPECT could provide an attacker roo... https://nvd.nist.gov/vuln/detail/CVE-2024-48853 https://nvd.nist.gov/vuln/detail/CVE-2024-48853 Thu, 22 May 2025 17:15:23 +0000 Critical CVE-2024-48853

An escalation of privilege vulnerability in ASPECT could provide an attacker root access to a server when logged in as a "non" root ASPECT user. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.

CVSS: 9.0 · CWE: CWE-286

View on NVD

]]> [High] CVE-2024-48850 – Absolute File Traversal vulnerabilities in ASPECT allows access and modification... https://nvd.nist.gov/vuln/detail/CVE-2024-48850 https://nvd.nist.gov/vuln/detail/CVE-2024-48850 Thu, 22 May 2025 17:15:23 +0000 High CVE-2024-48850

Absolute File Traversal vulnerabilities in ASPECT allows access and modification of unintended resources. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.

CVSS: 7.2 · CWE: CWE-36

View on NVD

]]> [High] CVE-2025-20111 – A vulnerability in the health monitoring diagnostics of Cisco Nexus 3000 Series ... https://nvd.nist.gov/vuln/detail/CVE-2025-20111 https://nvd.nist.gov/vuln/detail/CVE-2025-20111 Wed, 26 Feb 2025 17:15:22 +0000 High CVE-2025-20111

A vulnerability in the health monitoring diagnostics of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, adjacent attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to the incorrect handling of specific Ethernet frames. An attacker could ex…

CVSS: 7.4 · CWE: CWE-1220

View on NVD

]]> [Critical] CVE-2024-51547 – Use of Hard-coded Credentials vulnerability in ABB ASPECT-Enterprise, ABB NEXUS ... https://nvd.nist.gov/vuln/detail/CVE-2024-51547 https://nvd.nist.gov/vuln/detail/CVE-2024-51547 Thu, 06 Feb 2025 05:15:12 +0000 Critical CVE-2024-51547

Use of Hard-coded Credentials vulnerability in ABB ASPECT-Enterprise, ABB NEXUS Series, ABB MATRIX Series.This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

CVSS: 9.8 · CWE: CWE-798

View on NVD

]]> [Critical] CVE-2024-6784 – Server-Side Request Forgery vulnerabilities were found providing a potential for... https://nvd.nist.gov/vuln/detail/CVE-2024-6784 https://nvd.nist.gov/vuln/detail/CVE-2024-6784 Thu, 05 Dec 2024 13:15:10 +0000 Critical CVE-2024-6784

Server-Side Request Forgery vulnerabilities were found providing a potential for access to unauthorized resources and unintended information disclosure.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CVSS: 9.9 · CWE: CWE-918

View on NVD

]]> [Critical] CVE-2024-6516 – Cross Site Scripting vulnerabilities where found providing a potential for malic... https://nvd.nist.gov/vuln/detail/CVE-2024-6516 https://nvd.nist.gov/vuln/detail/CVE-2024-6516 Thu, 05 Dec 2024 13:15:10 +0000 Critical CVE-2024-6516

Cross Site Scripting vulnerabilities where found providing a potential for malicious scripts to be injected into a client browser.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CVSS: 9.0 · CWE: CWE-79

View on NVD

]]> [Critical] CVE-2024-6515 – Web browser interface may manipulate application username/password in clear text... https://nvd.nist.gov/vuln/detail/CVE-2024-6515 https://nvd.nist.gov/vuln/detail/CVE-2024-6515 Thu, 05 Dec 2024 13:15:10 +0000 Critical CVE-2024-6515

Web browser interface may manipulate application username/password in clear text or Base64 encoding providing a higher probability of unintended credentails exposure.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CVSS: 9.6 · CWE: CWE-319

View on NVD

]]> [Critical] CVE-2024-51555 – Default Credentail vulnerabilities allows access to an Aspect device using publi... https://nvd.nist.gov/vuln/detail/CVE-2024-51555 https://nvd.nist.gov/vuln/detail/CVE-2024-51555 Thu, 05 Dec 2024 13:15:08 +0000 Critical CVE-2024-51555

Default Credentail vulnerabilities allows access to an Aspect device using publicly available default credentials since the system does not require the installer to change default credentials.  Affected products: ABB ASPECT - Enterprise v3.07.02; NEXUS Series v3.07.02; MATRIX Series v3.07.02

CVSS: 10.0 · CWE: CWE-1393

View on NVD

]]> [Critical] CVE-2024-51554 – Default Credentail vulnerabilities in ASPECT on Linux allows access to the produ... https://nvd.nist.gov/vuln/detail/CVE-2024-51554 https://nvd.nist.gov/vuln/detail/CVE-2024-51554 Thu, 05 Dec 2024 13:15:08 +0000 Critical CVE-2024-51554

Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CVSS: 9.1 · CWE: CWE-193

View on NVD

]]> [Critical] CVE-2024-51551 – Default Credentail vulnerabilities in ASPECT on Linux allows access to the produ... https://nvd.nist.gov/vuln/detail/CVE-2024-51551 https://nvd.nist.gov/vuln/detail/CVE-2024-51551 Thu, 05 Dec 2024 13:15:08 +0000 Critical CVE-2024-51551

Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials.  Affected products: ABB ASPECT - Enterprise v3.07.02; NEXUS Series v3.07.02; MATRIX Series v3.07.02

CVSS: 10.0 · CWE: CWE-1287

View on NVD

]]> [Critical] CVE-2024-51550 – Data Validation / Data Sanitization vulnerabilities in Linux allows unvalidated... https://nvd.nist.gov/vuln/detail/CVE-2024-51550 https://nvd.nist.gov/vuln/detail/CVE-2024-51550 Thu, 05 Dec 2024 13:15:08 +0000 Critical CVE-2024-51550

Data Validation / Data Sanitization vulnerabilities in Linux allows unvalidated and unsanitized data to be injected in an Aspect device.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CVSS: 10.0 · CWE: CWE-1287

View on NVD

]]> [Critical] CVE-2024-51549 – Absolute File Traversal vulnerabilities allows access and modification of un-in... https://nvd.nist.gov/vuln/detail/CVE-2024-51549 https://nvd.nist.gov/vuln/detail/CVE-2024-51549 Thu, 05 Dec 2024 13:15:08 +0000 Critical CVE-2024-51549

Absolute File Traversal vulnerabilities allows access and modification of un-intended resources.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CVSS: 10.0 · CWE: CWE-36

View on NVD

]]> [Critical] CVE-2024-51548 – Dangerous File Upload vulnerabilities allow upload of malicious scripts.  Affect... https://nvd.nist.gov/vuln/detail/CVE-2024-51548 https://nvd.nist.gov/vuln/detail/CVE-2024-51548 Thu, 05 Dec 2024 13:15:08 +0000 Critical CVE-2024-51548

Dangerous File Upload vulnerabilities allow upload of malicious scripts.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CVSS: 9.9 · CWE: CWE-434

View on NVD

]]> [High] CVE-2024-51546 – Credentials Disclosure vulnerabilities allow access to on board project back-up ... https://nvd.nist.gov/vuln/detail/CVE-2024-51546 https://nvd.nist.gov/vuln/detail/CVE-2024-51546 Thu, 05 Dec 2024 13:15:08 +0000 High CVE-2024-51546

Credentials Disclosure vulnerabilities allow access to on board project back-up bundles.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CVSS: 7.5 · CWE: CWE-1287

View on NVD

]]> [Critical] CVE-2024-51545 – Username Enumeration vulnerabilities allow access to application level username ... https://nvd.nist.gov/vuln/detail/CVE-2024-51545 https://nvd.nist.gov/vuln/detail/CVE-2024-51545 Thu, 05 Dec 2024 13:15:07 +0000 Critical CVE-2024-51545

Username Enumeration vulnerabilities allow access to application level username add, delete, modify and list functions.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CVSS: 10.0 · CWE: CWE-522

View on NVD

]]> [High] CVE-2024-51544 – Service Control vulnerabilities allow access to service restart requests and vm ... https://nvd.nist.gov/vuln/detail/CVE-2024-51544 https://nvd.nist.gov/vuln/detail/CVE-2024-51544 Thu, 05 Dec 2024 13:15:07 +0000 High CVE-2024-51544

Service Control vulnerabilities allow access to service restart requests and vm configuration settings.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CVSS: 8.2 · CWE: CWE-15

View on NVD

]]> [High] CVE-2024-51543 – Information Disclosure vulnerabilities allow access to application configuration... https://nvd.nist.gov/vuln/detail/CVE-2024-51543 https://nvd.nist.gov/vuln/detail/CVE-2024-51543 Thu, 05 Dec 2024 13:15:07 +0000 High CVE-2024-51543

Information Disclosure vulnerabilities allow access to application configuration information.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CVSS: 8.2 · CWE: CWE-15

View on NVD

]]> [High] CVE-2024-51542 – Configuration Download vulnerabilities allow access to dependency configuration ... https://nvd.nist.gov/vuln/detail/CVE-2024-51542 https://nvd.nist.gov/vuln/detail/CVE-2024-51542 Thu, 05 Dec 2024 13:15:07 +0000 High CVE-2024-51542

Configuration Download vulnerabilities allow access to dependency configuration information.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CVSS: 8.2 · CWE: CWE-552

View on NVD

]]> [High] CVE-2024-51541 – Local File Inclusion vulnerabilities allow access to sensitive system informatio... https://nvd.nist.gov/vuln/detail/CVE-2024-51541 https://nvd.nist.gov/vuln/detail/CVE-2024-51541 Thu, 05 Dec 2024 13:15:07 +0000 High CVE-2024-51541

Local File Inclusion vulnerabilities allow access to sensitive system information.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CVSS: 8.2 · CWE: CWE-98

View on NVD

]]> [High] CVE-2024-48847 – MD5 Checksum Bypass vulnerabilities where found exploiting a weakness in the way... https://nvd.nist.gov/vuln/detail/CVE-2024-48847 https://nvd.nist.gov/vuln/detail/CVE-2024-48847 Thu, 05 Dec 2024 13:15:07 +0000 High CVE-2024-48847

MD5 Checksum Bypass vulnerabilities where found exploiting a weakness in the way an application dependency calculates or validates MD5 checksum hashes.  Affected products: ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01; MATRIX Series v3.08.01

CVSS: 8.2 · CWE: CWE-328

View on NVD

]]> [High] CVE-2024-48846 – Cross Site Request Forgery vulnerabilities where found providing a potiential fo... https://nvd.nist.gov/vuln/detail/CVE-2024-48846 https://nvd.nist.gov/vuln/detail/CVE-2024-48846 Thu, 05 Dec 2024 13:15:06 +0000 High CVE-2024-48846

Cross Site Request Forgery vulnerabilities where found providing a potiential for exposing sensitive information or changing system settings.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CVSS: 7.1 · CWE: CWE-352

View on NVD

]]> [Critical] CVE-2024-48845 – Weak Password Reset Rules vulnerabilities where found providing a potiential fo... https://nvd.nist.gov/vuln/detail/CVE-2024-48845 https://nvd.nist.gov/vuln/detail/CVE-2024-48845 Thu, 05 Dec 2024 13:15:06 +0000 Critical CVE-2024-48845

Weak Password Reset Rules vulnerabilities where found providing a potiential for the storage of weak passwords that could facilitate unauthorized admin/application access.  Affected products: ABB ASPECT - Enterprise v3.07.02; NEXUS Series v3.07.02; MATRIX Series v3.07.02

CVSS: 9.4 · CWE: CWE-521

View on NVD

]]> [High] CVE-2024-48844 – Denial of Service vulnerabilities where found providing a potiential for device ... https://nvd.nist.gov/vuln/detail/CVE-2024-48844 https://nvd.nist.gov/vuln/detail/CVE-2024-48844 Thu, 05 Dec 2024 13:15:06 +0000 High CVE-2024-48844

Denial of Service vulnerabilities where found providing a potiential for device service disruptions.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CVSS: 7.7 · CWE: CWE-770

View on NVD

]]> [High] CVE-2024-48843 – Denial of Service vulnerabilities where found providing a potiential for device ... https://nvd.nist.gov/vuln/detail/CVE-2024-48843 https://nvd.nist.gov/vuln/detail/CVE-2024-48843 Thu, 05 Dec 2024 13:15:06 +0000 High CVE-2024-48843

Denial of Service vulnerabilities where found providing a potiential for device service disruptions.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CVSS: 7.7 · CWE: CWE-770

View on NVD

]]> [Critical] CVE-2024-48840 – Unauthorized Access vulnerabilities allow Remote Code Execution.  Affected produ... https://nvd.nist.gov/vuln/detail/CVE-2024-48840 https://nvd.nist.gov/vuln/detail/CVE-2024-48840 Thu, 05 Dec 2024 13:15:06 +0000 Critical CVE-2024-48840

Unauthorized Access vulnerabilities allow Remote Code Execution.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CVSS: 10.0 · CWE: CWE-94

View on NVD

]]> [Critical] CVE-2024-48839 – Improper Input Validation vulnerability allows Remote Code Execution.  Affected ... https://nvd.nist.gov/vuln/detail/CVE-2024-48839 https://nvd.nist.gov/vuln/detail/CVE-2024-48839 Thu, 05 Dec 2024 13:15:06 +0000 Critical CVE-2024-48839

Improper Input Validation vulnerability allows Remote Code Execution.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CVSS: 10.0 · CWE: CWE-94

View on NVD

]]> [Critical] CVE-2024-11317 – Session Fixation vulnerabilities allow an attacker to fix a users session identi... https://nvd.nist.gov/vuln/detail/CVE-2024-11317 https://nvd.nist.gov/vuln/detail/CVE-2024-11317 Thu, 05 Dec 2024 13:15:05 +0000 Critical CVE-2024-11317

Session Fixation vulnerabilities allow an attacker to fix a users session identifier before login providing an opportunity for session takeover on a product.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CVSS: 10.0 · CWE: CWE-384

View on NVD

]]> [High] CVE-2024-11316 – Fileszie Check vulnerabilities allow a malicious user to bypass size limits or o... https://nvd.nist.gov/vuln/detail/CVE-2024-11316 https://nvd.nist.gov/vuln/detail/CVE-2024-11316 Thu, 05 Dec 2024 13:15:04 +0000 High CVE-2024-11316

Fileszie Check vulnerabilities allow a malicious user to bypass size limits or overload to the product.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CVSS: 7.5 · CWE: CWE-770

View on NVD

]]> [High] CVE-2024-5082 – A Remote Code Execution vulnerability has been discovered in Sonatype Nexus Repo... https://nvd.nist.gov/vuln/detail/CVE-2024-5082 https://nvd.nist.gov/vuln/detail/CVE-2024-5082 Thu, 14 Nov 2024 03:15:03 +0000 High CVE-2024-5082

A Remote Code Execution vulnerability has been discovered in Sonatype Nexus Repository 2.  This issue affects Nexus Repository 2 OSS/Pro versions up to and including 2.15.1.

CVSS: 7.1 · CWE: CWE-94

View on NVD

]]> [High] CVE-2024-20536 – A vulnerability in a REST API endpoint and web-based management interface of Cis... https://nvd.nist.gov/vuln/detail/CVE-2024-20536 https://nvd.nist.gov/vuln/detail/CVE-2024-20536 Wed, 06 Nov 2024 17:15:19 +0000 High CVE-2024-20536

A vulnerability in a REST API endpoint and web-based management interface of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, remote attacker with read-only privileges to execute arbitrary SQL commands on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted…

CVSS: 8.8 · CWE: CWE-89

View on NVD

]]> [High] CVE-2024-20449 – A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an... https://nvd.nist.gov/vuln/detail/CVE-2024-20449 https://nvd.nist.gov/vuln/detail/CVE-2024-20449 Wed, 02 Oct 2024 17:15:16 +0000 High CVE-2024-20449

A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, remote attacker with low privileges to execute arbitrary code on an affected device. This vulnerability is due to improper path validation. An attacker could exploit this vulnerability by using the Secure Copy Protocol (SCP) to upload malicious code to an affected device using path traversal techniq…

CVSS: 8.8 · CWE: CWE-23

View on NVD

]]> [Critical] CVE-2024-20432 – A vulnerability in the REST API and web UI of Cisco Nexus Dashboard Fabric Contr... https://nvd.nist.gov/vuln/detail/CVE-2024-20432 https://nvd.nist.gov/vuln/detail/CVE-2024-20432 Wed, 02 Oct 2024 17:15:15 +0000 Critical CVE-2024-20432

A vulnerability in the REST API and web UI of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attacker to perform a command injection attack against an affected device.   This vulnerability is due to improper user authorization and insufficient validation of command arguments. An attacker could exploit this vulnerability by submitting cra…

CVSS: 9.9 · CWE: CWE-77

View on NVD

]]> [Critical] CVE-2024-6298 – Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXU... https://nvd.nist.gov/vuln/detail/CVE-2024-6298 https://nvd.nist.gov/vuln/detail/CVE-2024-6298 Fri, 05 Jul 2024 11:15:10 +0000 Critical CVE-2024-6298

Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to execute arbitrary code remotely

CVSS: 10.0 · CWE: CWE-1287

View on NVD

]]> [Critical] CVE-2024-6209 – Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXU... https://nvd.nist.gov/vuln/detail/CVE-2024-6209 https://nvd.nist.gov/vuln/detail/CVE-2024-6209 Fri, 05 Jul 2024 11:15:10 +0000 Critical CVE-2024-6209

Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to access files unauthorized

CVSS: 10.0 · CWE: CWE-552

View on NVD

]]> [High] CVE-2024-4007 – Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series... https://nvd.nist.gov/vuln/detail/CVE-2024-4007 https://nvd.nist.gov/vuln/detail/CVE-2024-4007 Mon, 01 Jul 2024 13:15:06 +0000 High CVE-2024-4007

Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series version 3.07 allows attacker to login to product instances wrongly configured.

CVSS: 8.8 · CWE: CWE-1392

View on NVD

]]> [Critical] CVE-2024-30163 – Invision Community before 4.7.16 allow SQL injection via the applications/nexus/... https://nvd.nist.gov/vuln/detail/CVE-2024-30163 https://nvd.nist.gov/vuln/detail/CVE-2024-30163 Fri, 07 Jun 2024 17:15:50 +0000 Critical CVE-2024-30163

Invision Community before 4.7.16 allow SQL injection via the applications/nexus/modules/front/store/store.php IPS\nexus\modules\front\store\_store::_categoryView() method, where user input passed through the filter request parameter is not properly sanitized before being used to execute SQL queries. This can be exploited by unauthenticated attackers to carry out Blind SQL Injection attacks.

CVSS: 9.8 · CWE: CWE-89

View on NVD

]]> [High] CVE-2024-4956 – Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker... https://nvd.nist.gov/vuln/detail/CVE-2024-4956 https://nvd.nist.gov/vuln/detail/CVE-2024-4956 Thu, 16 May 2024 16:15:10 +0000 High CVE-2024-4956

Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1.

CVSS: 7.5 · CWE: CWE-22

View on NVD

]]> [High] CVE-2024-20348 – A vulnerability in the Out-of-Band (OOB) Plug and Play (PnP) feature of Cisco Ne... https://nvd.nist.gov/vuln/detail/CVE-2024-20348 https://nvd.nist.gov/vuln/detail/CVE-2024-20348 Wed, 03 Apr 2024 17:15:49 +0000 High CVE-2024-20348

A vulnerability in the Out-of-Band (OOB) Plug and Play (PnP) feature of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauthenticated, remote attacker to read arbitrary files. This vulnerability is due to an unauthenticated provisioning web server. An attacker could exploit this vulnerability through direct web requests to the provisioning server. A successful exploit could all…

CVSS: 7.5 · CWE: CWE-27

View on NVD

]]> [High] CVE-2024-20281 – A vulnerability in the web-based management interface of Cisco Nexus Dashboard a... https://nvd.nist.gov/vuln/detail/CVE-2024-20281 https://nvd.nist.gov/vuln/detail/CVE-2024-20281 Wed, 03 Apr 2024 17:15:47 +0000 High CVE-2024-20281

A vulnerability in the web-based management interface of Cisco Nexus Dashboard and Cisco Nexus Dashboard hosted services could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. This vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected system. An attacker could exploit thi…

CVSS: 7.5 · CWE: CWE-352

View on NVD

]]> [High] CVE-2023-50768 – A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Platform Plug... https://nvd.nist.gov/vuln/detail/CVE-2023-50768 https://nvd.nist.gov/vuln/detail/CVE-2023-50768 Wed, 13 Dec 2023 18:15:43 +0000 High CVE-2023-50768

A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

CVSS: 8.8 · CWE: CWE-352

View on NVD

]]> [High] CVE-2023-50766 – A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Platform Plug... https://nvd.nist.gov/vuln/detail/CVE-2023-50766 https://nvd.nist.gov/vuln/detail/CVE-2023-50766 Wed, 13 Dec 2023 18:15:43 +0000 High CVE-2023-50766

A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML.

CVSS: 8.8 · CWE: CWE-352

View on NVD

]]> [High] CVE-2023-20169 – A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) protoc... https://nvd.nist.gov/vuln/detail/CVE-2023-20169 https://nvd.nist.gov/vuln/detail/CVE-2023-20169 Wed, 23 Aug 2023 19:15:07 +0000 High CVE-2023-20169

A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) protocol of Cisco NX-OS Software for the Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, adjacent attacker to cause the IS-IS process to unexpectedly restart, which could cause an affected device to reload. This vulnerability is due to insuffi…

CVSS: 7.4 · CWE: CWE-788

View on NVD

]]> [High] CVE-2023-20185 – A vulnerability in the Cisco ACI Multi-Site CloudSec encryption feature of Cisco... https://nvd.nist.gov/vuln/detail/CVE-2023-20185 https://nvd.nist.gov/vuln/detail/CVE-2023-20185 Wed, 12 Jul 2023 14:15:09 +0000 High CVE-2023-20185

A vulnerability in the Cisco ACI Multi-Site CloudSec encryption feature of Cisco Nexus 9000 Series Fabric Switches in ACI mode could allow an unauthenticated, remote attacker to read or modify intersite encrypted traffic. This vulnerability is due to an issue with the implementation of the ciphers that are used by the CloudSec encryption feature on affected switches. An attacker with an on-pat…

CVSS: 7.4 · CWE: CWE-330

View on NVD

]]> [High] CVE-2023-0636 – Improper Input Validation vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT... https://nvd.nist.gov/vuln/detail/CVE-2023-0636 https://nvd.nist.gov/vuln/detail/CVE-2023-0636 Mon, 05 Jun 2023 04:15:10 +0000 High CVE-2023-0636

Improper Input Validation vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules), ABB Ltd. NEXUS Series on NEXUS Series, Linux (2CQG100102R2021, 2CQG100104R2021, 2CQG100105R2021, 2CQG100106R2021, 2CQG100110R2021, 2CQG100112R2021, 2CQG100103R2021, 2CQG100107R2021, 2CQG100108R2021, 2CQG100109R2021, 2CQG1…

CVSS: 7.2 · CWE: CWE-77

View on NVD

]]> [High] CVE-2023-0635 – Improper Privilege Management vulnerability in ABB Ltd. ASPECT®-Enterprise on AS... https://nvd.nist.gov/vuln/detail/CVE-2023-0635 https://nvd.nist.gov/vuln/detail/CVE-2023-0635 Mon, 05 Jun 2023 04:15:09 +0000 High CVE-2023-0635

Improper Privilege Management vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules), ABB Ltd. NEXUS Series on NEXUS Series, Linux (2CQG100102R2021, 2CQG100104R2021, 2CQG100105R2021, 2CQG100106R2021, 2CQG100110R2021, 2CQG100112R2021, 2CQG100103R2021, 2CQG100107R2021, 2CQG100108R2021, 2CQG100109R2021, 2…

CVSS: 7.8 · CWE: CWE-1391

View on NVD

]]> [High] CVE-2023-20014 – A vulnerability in the DNS functionality of Cisco Nexus Dashboard Software could... https://nvd.nist.gov/vuln/detail/CVE-2023-20014 https://nvd.nist.gov/vuln/detail/CVE-2023-20014 Wed, 01 Mar 2023 08:15:11 +0000 High CVE-2023-20014

A vulnerability in the DNS functionality of Cisco Nexus Dashboard Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to the improper processing of DNS requests. An attacker could exploit this vulnerability by sending a continuous stream of DNS requests to an affected device. A successful exploit could allow the attac…

CVSS: 7.5 · CWE: CWE-399

View on NVD

]]> [High] CVE-2023-20089 – A vulnerability in the Link Layer Discovery Protocol (LLDP) feature for Cisco Ne... https://nvd.nist.gov/vuln/detail/CVE-2023-20089 https://nvd.nist.gov/vuln/detail/CVE-2023-20089 Thu, 23 Feb 2023 20:15:13 +0000 High CVE-2023-20089

A vulnerability in the Link Layer Discovery Protocol (LLDP) feature for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) Mode could allow an unauthenticated, adjacent attacker to cause a memory leak, which could result in an unexpected reload of the device. This vulnerability is due to incorrect error checking when parsing ingress LLDP packets. An attacker could…

CVSS: 7.4 · CWE: CWE-789

View on NVD

]]> [Critical] CVE-2022-36030 – Project-nexus is a general-purpose blog website framework. Affected versions are... https://nvd.nist.gov/vuln/detail/CVE-2022-36030 https://nvd.nist.gov/vuln/detail/CVE-2022-36030 Sat, 20 Aug 2022 00:15:42 +0000 Critical CVE-2022-36030

Project-nexus is a general-purpose blog website framework. Affected versions are subject to SQL injection due to a lack of sensitization of user input. This issue has not yet been patched. Users are advised to restrict user input and to upgrade when a new release becomes available.

CVSS: 9.8 · CWE: CWE-89

View on NVD

]]> [Critical] CVE-2022-20861 – Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated... https://nvd.nist.gov/vuln/detail/CVE-2022-20861 https://nvd.nist.gov/vuln/detail/CVE-2022-20861 Thu, 21 Jul 2022 04:15:10 +0000 Critical CVE-2022-20861

Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload container image files, or perform a cross-site request forgery attack. For more information about these vulnerabilities, see the Details section of this advisory.

CVSS: 9.8 · CWE: CWE-306

View on NVD

]]> [High] CVE-2022-20860 – A vulnerability in the SSL/TLS implementation of Cisco Nexus Dashboard could all... https://nvd.nist.gov/vuln/detail/CVE-2022-20860 https://nvd.nist.gov/vuln/detail/CVE-2022-20860 Thu, 21 Jul 2022 04:15:10 +0000 High CVE-2022-20860

A vulnerability in the SSL/TLS implementation of Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to alter communications with associated controllers or view sensitive information. This vulnerability exists because SSL server certificates are not validated when Cisco Nexus Dashboard is establishing a connection to Cisco Application Policy Infrastructure Controller (APIC), Cis…

CVSS: 7.4 · CWE: CWE-295

View on NVD

]]> [Critical] CVE-2022-20858 – Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated... https://nvd.nist.gov/vuln/detail/CVE-2022-20858 https://nvd.nist.gov/vuln/detail/CVE-2022-20858 Thu, 21 Jul 2022 04:15:10 +0000 Critical CVE-2022-20858

Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload container image files, or perform a cross-site request forgery attack. For more information about these vulnerabilities, see the Details section of this advisory.

CVSS: 9.8 · CWE: CWE-306

View on NVD

]]> [Critical] CVE-2022-20857 – Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated... https://nvd.nist.gov/vuln/detail/CVE-2022-20857 https://nvd.nist.gov/vuln/detail/CVE-2022-20857 Thu, 21 Jul 2022 04:15:10 +0000 Critical CVE-2022-20857

Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload container image files, or perform a cross-site request forgery attack. For more information about these vulnerabilities, see the Details section of this advisory.

CVSS: 9.8 · CWE: CWE-306

View on NVD

]]> [High] CVE-2022-20623 – A vulnerability in the rate limiter for Bidirectional Forwarding Detection (BFD)... https://nvd.nist.gov/vuln/detail/CVE-2022-20623 https://nvd.nist.gov/vuln/detail/CVE-2022-20623 Wed, 23 Feb 2022 18:15:18 +0000 High CVE-2022-20623

A vulnerability in the rate limiter for Bidirectional Forwarding Detection (BFD) traffic of Cisco NX-OS Software for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to cause BFD traffic to be dropped on an affected device. This vulnerability is due to a logic error in the BFD rate limiter functionality. An attacker could exploit this vulnerability by sending a cra…

CVSS: 8.6 · CWE: CWE-399

View on NVD

]]> [High] CVE-2021-40143 – Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header ... https://nvd.nist.gov/vuln/detail/CVE-2021-40143 https://nvd.nist.gov/vuln/detail/CVE-2021-40143 Tue, 07 Sep 2021 20:15:08 +0000 High CVE-2021-40143

Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance.

CVSS: 8.2 · CWE: CWE-74

View on NVD

]]> [High] CVE-2021-1586 – A vulnerability in the Multi-Pod or Multi-Site network configurations for Cisco ... https://nvd.nist.gov/vuln/detail/CVE-2021-1586 https://nvd.nist.gov/vuln/detail/CVE-2021-1586 Wed, 25 Aug 2021 20:15:11 +0000 High CVE-2021-1586

A vulnerability in the Multi-Pod or Multi-Site network configurations for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an unauthenticated, remote attacker to unexpectedly restart the device, resulting in a denial of service (DoS) condition. This vulnerability exists because TCP traffic sent to a specific port on an affected device is not pro…

CVSS: 8.6 · CWE: CWE-345

View on NVD

]]> [High] CVE-2021-1523 – A vulnerability in Cisco Nexus 9000 Series Fabric Switches in Application Centri... https://nvd.nist.gov/vuln/detail/CVE-2021-1523 https://nvd.nist.gov/vuln/detail/CVE-2021-1523 Wed, 25 Aug 2021 19:15:07 +0000 High CVE-2021-1523

A vulnerability in Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) Mode could allow an unauthenticated, remote attacker to cause a queue wedge on a leaf switch, which could result in critical control plane traffic to the device being dropped. This could result in one or more leaf switches being removed from the fabric. This vulnerability is due to mishandling o…

CVSS: 8.6 · CWE: CWE-772

View on NVD

]]> [Critical] CVE-2021-37167 – An insecure permissions issue was discovered in HMI3 Control Panel in Swisslog H... https://nvd.nist.gov/vuln/detail/CVE-2021-37167 https://nvd.nist.gov/vuln/detail/CVE-2021-37167 Mon, 02 Aug 2021 13:15:07 +0000 Critical CVE-2021-37167

An insecure permissions issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. A user logged in using the default credentials can gain root access to the device, which provides permissions for all of the functionality of the device.

CVSS: 9.8 · CWE: CWE-269

View on NVD

]]> [High] CVE-2021-37166 – A buffer overflow issue leading to denial of service was discovered in HMI3 Cont... https://nvd.nist.gov/vuln/detail/CVE-2021-37166 https://nvd.nist.gov/vuln/detail/CVE-2021-37166 Mon, 02 Aug 2021 13:15:07 +0000 High CVE-2021-37166

A buffer overflow issue leading to denial of service was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. When HMI3 starts up, it binds a local service to a TCP port on all interfaces of the device, and takes extensive time for the GUI to connect to the TCP socket, allowing the connection to be hijacked by…

CVSS: 7.5 · CWE: CWE-120

View on NVD

]]> [Critical] CVE-2021-37164 – A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthc... https://nvd.nist.gov/vuln/detail/CVE-2021-37164 https://nvd.nist.gov/vuln/detail/CVE-2021-37164 Mon, 02 Aug 2021 13:15:07 +0000 Critical CVE-2021-37164

A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. In the tcpTxThread function, the received data is copied to a stack buffer. An off-by-3 condition can occur, resulting in a stack-based buffer overflow.

CVSS: 9.8 · CWE: CWE-787

View on NVD

]]> [Critical] CVE-2021-37163 – An insecure permissions issue was discovered in HMI3 Control Panel in Swisslog H... https://nvd.nist.gov/vuln/detail/CVE-2021-37163 https://nvd.nist.gov/vuln/detail/CVE-2021-37163 Mon, 02 Aug 2021 13:15:07 +0000 Critical CVE-2021-37163

An insecure permissions issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus operated by released versions of software before Nexus Software 7.2.5.7. The device has two user accounts with passwords that are hardcoded.

CVSS: 9.8 · CWE: CWE-798

View on NVD

]]> [Critical] CVE-2021-37162 – A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthc... https://nvd.nist.gov/vuln/detail/CVE-2021-37162 https://nvd.nist.gov/vuln/detail/CVE-2021-37162 Mon, 02 Aug 2021 13:15:07 +0000 Critical CVE-2021-37162

A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. If an attacker sends a malformed UDP message, a buffer underflow occurs, leading to an out-of-bounds copy and possible remote code execution.

CVSS: 9.8 · CWE: CWE-120

View on NVD

]]> [Critical] CVE-2021-37161 – A buffer overflow issue was discovered in the HMI3 Control Panel contained withi... https://nvd.nist.gov/vuln/detail/CVE-2021-37161 https://nvd.nist.gov/vuln/detail/CVE-2021-37161 Mon, 02 Aug 2021 13:15:07 +0000 Critical CVE-2021-37161

A buffer overflow issue was discovered in the HMI3 Control Panel contained within the Swisslog Healthcare Nexus Panel, operated by released versions of software before Nexus Software 7.2.5.7. A buffer overflow allows an attacker to overwrite an internal queue data structure and can lead to remote code execution.

CVSS: 9.8 · CWE: CWE-120

View on NVD

]]> [Critical] CVE-2021-37160 – A firmware validation issue was discovered in HMI3 Control Panel in Swisslog Hea... https://nvd.nist.gov/vuln/detail/CVE-2021-37160 https://nvd.nist.gov/vuln/detail/CVE-2021-37160 Mon, 02 Aug 2021 13:15:07 +0000 Critical CVE-2021-37160

A firmware validation issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. There is no firmware validation (e.g., cryptographic signature validation) during a File Upload for a firmware update.

CVSS: 9.8 · CWE: CWE-347

View on NVD

]]> [Critical] CVE-2021-37165 – A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthc... https://nvd.nist.gov/vuln/detail/CVE-2021-37165 https://nvd.nist.gov/vuln/detail/CVE-2021-37165 Mon, 02 Aug 2021 11:15:11 +0000 Critical CVE-2021-37165

A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. When a message is sent to the HMI TCP socket, it is forwarded to the hmiProcessMsg function through the pendingQ, and may lead to remote code execution.

CVSS: 9.8 · CWE: CWE-120

View on NVD

]]> [Critical] CVE-2021-1361 – A vulnerability in the implementation of an internal file management service for... https://nvd.nist.gov/vuln/detail/CVE-2021-1361 https://nvd.nist.gov/vuln/detail/CVE-2021-1361 Wed, 24 Feb 2021 20:15:13 +0000 Critical CVE-2021-1361

A vulnerability in the implementation of an internal file management service for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode that are running Cisco NX-OS Software could allow an unauthenticated, remote attacker to create, delete, or overwrite arbitrary files with root privileges on the device. This vulnerability exists because TCP port 9075 is in…

CVSS: 9.8 · CWE: CWE-552

View on NVD

]]> [High] CVE-2021-1230 – A vulnerability with the Border Gateway Protocol (BGP) for Cisco Nexus 9000 Seri... https://nvd.nist.gov/vuln/detail/CVE-2021-1230 https://nvd.nist.gov/vuln/detail/CVE-2021-1230 Wed, 24 Feb 2021 20:15:12 +0000 High CVE-2021-1230

A vulnerability with the Border Gateway Protocol (BGP) for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an unauthenticated, remote attacker to cause a routing process to crash, which could lead to a denial of service (DoS) condition. This vulnerability is due to an issue with the installation of routes upon receipt of a BGP update. An attack…

CVSS: 8.6 · CWE: CWE-233

View on NVD

]]> [High] CVE-2021-1228 – A vulnerability in the fabric infrastructure VLAN connection establishment of Ci... https://nvd.nist.gov/vuln/detail/CVE-2021-1228 https://nvd.nist.gov/vuln/detail/CVE-2021-1228 Wed, 24 Feb 2021 20:15:12 +0000 High CVE-2021-1228

A vulnerability in the fabric infrastructure VLAN connection establishment of Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) Mode could allow an unauthenticated, adjacent attacker to bypass security validations and connect an unauthorized server to the infrastructure VLAN. This vulnerability is due to insufficient security requirements during the Link Layer Di…

CVSS: 7.4 · CWE: CWE-284

View on NVD

]]> [High] CVE-2020-0016 – In the Broadcom Nexus firmware, there is an insecure default password. This coul... https://nvd.nist.gov/vuln/detail/CVE-2020-0016 https://nvd.nist.gov/vuln/detail/CVE-2020-0016 Mon, 14 Dec 2020 23:15:11 +0000 High CVE-2020-0016

In the Broadcom Nexus firmware, there is an insecure default password. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-171413483

CVSS: 7.8 · CWE: CWE-798

View on NVD

]]> [High] CVE-2020-15012 – A Directory Traversal issue was discovered in Sonatype Nexus Repository Manager ... https://nvd.nist.gov/vuln/detail/CVE-2020-15012 https://nvd.nist.gov/vuln/detail/CVE-2020-15012 Mon, 12 Oct 2020 21:15:13 +0000 High CVE-2020-15012

A Directory Traversal issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.19. A user that requests a crafted path can traverse up the file system to get access to content on disk (that the user running nxrm also has access to).

CVSS: 8.6 · CWE: CWE-22

View on NVD

]]> [High] CVE-2020-3394 – A vulnerability in the Enable Secret feature of Cisco Nexus 3000 Series Switches... https://nvd.nist.gov/vuln/detail/CVE-2020-3394 https://nvd.nist.gov/vuln/detail/CVE-2020-3394 Thu, 27 Aug 2020 16:15:12 +0000 High CVE-2020-3394

A vulnerability in the Enable Secret feature of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, local attacker to issue the enable command and get full administrative privileges. To exploit this vulnerability, the attacker would need to have valid credentials for the affected device. The vulnerability is due to a logic e…

CVSS: 7.8 · CWE: CWE-285

View on NVD

]]> [High] CVE-2020-15868 – Sonatype Nexus Repository Manager OSS/Pro before 3.26.0 has Incorrect Access Con... https://nvd.nist.gov/vuln/detail/CVE-2020-15868 https://nvd.nist.gov/vuln/detail/CVE-2020-15868 Wed, 12 Aug 2020 22:15:12 +0000 High CVE-2020-15868

Sonatype Nexus Repository Manager OSS/Pro before 3.26.0 has Incorrect Access Control.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [High] CVE-2020-15871 – Sonatype Nexus Repository Manager OSS/Pro version before 3.25.1 allows Remote Co... https://nvd.nist.gov/vuln/detail/CVE-2020-15871 https://nvd.nist.gov/vuln/detail/CVE-2020-15871 Fri, 31 Jul 2020 20:15:12 +0000 High CVE-2020-15871

Sonatype Nexus Repository Manager OSS/Pro version before 3.25.1 allows Remote Code Execution.

CVSS: 8.8 · CWE: N/A

View on NVD

]]> [High] CVE-2020-11753 – An issue was discovered in Sonatype Nexus Repository Manager in versions 3.21.1 ... https://nvd.nist.gov/vuln/detail/CVE-2020-11753 https://nvd.nist.gov/vuln/detail/CVE-2020-11753 Mon, 20 Apr 2020 19:15:11 +0000 High CVE-2020-11753

An issue was discovered in Sonatype Nexus Repository Manager in versions 3.21.1 and 3.22.0. It is possible for a user with appropriate privileges to create, modify, and execute scripting tasks without use of the UI or API. NOTE: in 3.22.0, scripting is disabled by default (making this not exploitable).

CVSS: 8.8 · CWE: CWE-863

View on NVD

]]> [High] CVE-2020-11444 – Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect A... https://nvd.nist.gov/vuln/detail/CVE-2020-11444 https://nvd.nist.gov/vuln/detail/CVE-2020-11444 Thu, 02 Apr 2020 18:15:18 +0000 High CVE-2020-11444

Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control.

CVSS: 8.8 · CWE: CWE-276

View on NVD

]]> [High] CVE-2020-10204 – Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution. https://nvd.nist.gov/vuln/detail/CVE-2020-10204 https://nvd.nist.gov/vuln/detail/CVE-2020-10204 Wed, 01 Apr 2020 19:15:14 +0000 High CVE-2020-10204

Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.

CVSS: 7.2 · CWE: CWE-20

View on NVD

]]> [High] CVE-2020-10199 – Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2). https://nvd.nist.gov/vuln/detail/CVE-2020-10199 https://nvd.nist.gov/vuln/detail/CVE-2020-10199 Wed, 01 Apr 2020 19:15:14 +0000 High CVE-2020-10199

Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).

CVSS: 8.8 · CWE: CWE-917

View on NVD

]]> [High] CVE-2020-3168 – A vulnerability in the Secure Login Enhancements capability of Cisco Nexus 1000V... https://nvd.nist.gov/vuln/detail/CVE-2020-3168 https://nvd.nist.gov/vuln/detail/CVE-2020-3168 Wed, 26 Feb 2020 17:15:12 +0000 High CVE-2020-3168

A vulnerability in the Secure Login Enhancements capability of Cisco Nexus 1000V Switch for VMware vSphere could allow an unauthenticated, remote attacker to cause an affected Nexus 1000V Virtual Supervisor Module (VSM) to become inaccessible to users through the CLI. The vulnerability is due to improper resource allocation during failed CLI login attempts when login parameters that are part of t…

CVSS: 7.5 · CWE: CWE-399

View on NVD

]]> [High] CVE-2013-3314 – The Loftek Nexus 543 IP Camera allows remote attackers to obtain (1) IP addresse... https://nvd.nist.gov/vuln/detail/CVE-2013-3314 https://nvd.nist.gov/vuln/detail/CVE-2013-3314 Thu, 21 Nov 2019 20:15:15 +0000 High CVE-2013-3314

The Loftek Nexus 543 IP Camera allows remote attackers to obtain (1) IP addresses via a request to get_realip.cgi or (2) firmware versions (ui and system), timestamp, serial number, p2p port number, and wifi status via a request to get_status.cgi.

CVSS: 7.5 · CWE: CWE-200

View on NVD

]]>