Cisco Unified Intelligence Center vulnerabilities

A vulnerability in the Cisco Unified Intelligence Center allows an unauthenticated, remote attacker to execute unwanted actions. The issue is due to a lack of cross-site request forgery (CSRF) protection.

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to read the contents of the internal database of an affected device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.

A vulnerability in the API subsystem of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to obtain sensitive information from an affected system. This is due to improper validation of requests to certain API endpoints. An attacker could exploit this by sending a valid request to a specific API endpoint.