CVE-2019-1622

A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device. The vulnerability is due to improper access controls for certain URLs on affected DCNM software. An attacker could exploit this vulnerability by connecting to the web-based management interface of an affected device and requesting specific URLs. A successful exploit could allow the attacker to download log files and diagnostic information from the affected device.

• CWE-284
• CWE-532

• http://packetstormsecurity.com/files/153546/Cisco-Data-Center-Network-Manager-11.1-1-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/154304/Cisco-Data-Center-Network-Manager-Unauthenticated-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/Jul/7Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/108908Third Party Advisory, VDB Entry
• https://seclists.org/bugtraq/2019/Jul/11Mailing List, Third Party Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190626-dcnm-infodisclVendor Advisory
• http://packetstormsecurity.com/files/153546/Cisco-Data-Center-Network-Manager-11.1-1-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/154304/Cisco-Data-Center-Network-Manager-Unauthenticated-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/Jul/7Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/108908Third Party Advisory, VDB Entry
• https://seclists.org/bugtraq/2019/Jul/11Mailing List, Third Party Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190626-dcnm-infodisclVendor Advisory

Published

Jun 27, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-16214Libra Core before 2019-09-03 has an erroneous regular expres…5.7
• CVE-2019-16215The Markdown parser in Zulip server before 2.0.5 used a regu…6.5
• CVE-2019-16216Zulip server before 2.0.5 incompletely validated the MIME ty…5.4
• CVE-2019-16217WordPress before 5.2.3 allows XSS in media uploads because w…6.1
• CVE-2019-16218WordPress before 5.2.3 allows XSS in stored comments.6.1
• CVE-2019-16219WordPress before 5.2.3 allows XSS in shortcode previews.6.1
• CVE-2019-16220In WordPress before 5.2.3, validation and sanitization of a …6.1
• CVE-2019-16221WordPress before 5.2.3 allows reflected XSS in the dashboard…6.1
• CVE-2019-16222WordPress before 5.2.3 has an issue with URL sanitization in…6.1
• CVE-2019-16223WordPress before 5.2.3 allows XSS in post previews by authen…5.4
• CVE-2019-16224An issue was discovered in py-lmdb 0.97. For certain values …9.8
• CVE-2019-16225An issue was discovered in py-lmdb 0.97. For certain values …9.8