Cisco Integrated Management Controller vulnerabilities

Cisco Integrated Management Controller in Cisco Unified Computing System 2.2(2c)A and earlier allows local users to obtain shell access via a crafted map-nfs command.

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with Admin privileges to execute arbitrary commands on the underlying OS and elevate privileges to root. This is due to improper input validation, and exploitation involves entering crafted inputs. Successful exploitation allows command execution as root.

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user. This is due to insufficient input validation, and exploitation involves persuading a user to click a crafted link. Successful exploitation could allow arbitrary script execution in the user's browser or access to sensitive browser-based information.