Cisco Application Policy Infrastructure Controller vulnerabilities

CVE-2021-1582 [MEDIUM] CWE-79 CVE-2021-1582: A vulnerability in the web UI of Cisco Application Policy Infrastructure Controller (APIC) or Cisco A vulnerability in the web UI of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow an authenticated, remote attacker to perform a stored cross-site scripting attack on an affected system. This vulnerability is due to improper input validation in the web UI. An authenticated attacker could exploit this vulnerabilit

CVE-2020-3335 [MEDIUM] CWE-306 CVE-2020-3335: A vulnerability in the key store of Cisco Application Services Engine Software could allow an authen A vulnerability in the key store of Cisco Application Services Engine Software could allow an authenticated, local attacker to read sensitive information of other users on an affected device. The vulnerability is due to insufficient authorization limitations. An attacker could exploit this vulnerability by logging in to an affected device locally with

CVE-2025-20119 [MEDIUM] CWE-362 CVE-2025-20119: A vulnerability in the system file permission handling of Cisco APIC could allow an authenticated, l A vulnerability in the system file permission handling of Cisco APIC could allow an authenticated, local attacker to overwrite critical system files, which could cause a DoS condition. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to a race condition with handling system files. An

CVE-2019-1838 [MEDIUM] CWE-79 CVE-2019-1838: A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Con A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied i

CVE-2024-20279 [MEDIUM] CWE-284 CVE-2024-20279: A vulnerability in the restricted security domain implementation of Cisco Application Policy Infrast A vulnerability in the restricted security domain implementation of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to modify the behavior of default system policies, such as quality of service (QoS) policies, on an affected system. This vulnerability is due to improper access control when rest

CVE-2026-20107 [MEDIUM] CWE-1220 CVE-2026-20107: A vulnerability in the Object Model CLI component of Cisco Application Policy Infrastructure Control A vulnerability in the Object Model CLI component of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, local attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. To exploit this vulnerability, the attacker must have valid user credentials and any role th

CVE-2025-20116 [MEDIUM] CWE-79 CVE-2025-20116: A vulnerability in the web UI of Cisco APIC could allow an authenticated, remote attacker to perform A vulnerability in the web UI of Cisco APIC could allow an authenticated, remote attacker to perform a stored XSS attack on an affected system. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to improper input validation in the web UI. An authenticated attacker could exploit this vuln

CVE-2019-1587 [MEDIUM] CWE-399 CVE-2019-1587: A vulnerability in Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (AC A vulnerability in Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an authenticated, remote attacker to access sensitive information. The vulnerability occurs because the affected software does not properly validate user-supplied input. An attacker could exploit this vulnerability by issuing certain

CVE-2025-20118 [MEDIUM] CWE-212 CVE-2025-20118: A vulnerability in the implementation of the internal system processes of Cisco APIC could allow an A vulnerability in the implementation of the internal system processes of Cisco APIC could allow an authenticated, local attacker to access sensitive information on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient masking of sensitive information tha

CVE-2019-1586 [MEDIUM] CWE-320 CVE-2019-1586: A vulnerability in Cisco Application Policy Infrastructure Controller (APIC) Software could allow an A vulnerability in Cisco Application Policy Infrastructure Controller (APIC) Software could allow an unauthenticated, local attacker with physical access to obtain sensitive information from an affected device. The vulnerability is due to insecure removal of cleartext encryption keys stored on local partitions in the hard drive of an affected device.