CVE Feed

    Dashboard / CVE / CVE-2011-0966

    CVE-2011-0966

    Directory traversal vulnerability in cwhp/auditLog.do in the Homepage Auditing component in Cisco CiscoWorks Common Services 3.3 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, aka Bug ID CSCto35577.

    Published:May 20, 2011
    Last Modified:Apr 11, 2025
    EPS:May 20, 2011
    EPSS Score:0.41998
    CVSS Score:6.8

    Affected Products

    Vendor
    Cisco
    Product
    Ciscoworks Common Services

    Exploits

    http://archives.neohapsis.com/archives/fulldisclosure/2011-05/0371.htmlhttp://www.exploit-db.com/exploits/17304http://www.senseofsecurity.com.au/advisories/SOS-11-006.pdfhttp://archives.neohapsis.com/archives/fulldisclosure/2011-05/0371.htmlhttp://www.exploit-db.com/exploits/17304http://www.senseofsecurity.com.au/advisories/SOS-11-006.pdfhttps://www.exploit-db.com/exploits/35781https://www.exploit-db.com/exploits/17304

    Related CVEs

    CVE-2011-4237 (CVSS 4.3) — CRLF injection vulnerability in autologin.jsp in Cisco CiscoWorks Common Services 4.0, as used in Cisco Prime …
    CVE-2011-2042 (CVSS 5) — The Sybase SQL Anywhere database component in Cisco CiscoWorks Common Services 3.x and 4.x before 4.1 allows r…
    CVE-2011-3310 (CVSS 9) — The Home Page component in Cisco CiscoWorks Common Services before 4.1 on Windows, as used in CiscoWorks LAN M…
    CVE-2011-0961 (CVSS 4.3) — Cross-site scripting (XSS) vulnerability in cwhp/device.center.do in the Help servlet in Cisco CiscoWorks Comm…
    CVE-2010-3036 (CVSS 10) — Multiple buffer overflows in the authentication functionality in the web-server module in Cisco CiscoWorks Com…
    CVE-2009-1161 (CVSS 10) — Directory traversal vulnerability in the TFTP service in Cisco CiscoWorks Common Services (CWCS) 3.0.x through…
    CVE-2008-2054 (CVSS 9.3) — Unspecified vulnerability in Cisco CiscoWorks Common Services 3.0.3 through 3.1.1 allows remote attackers to e…
    CVE-2005-0356 (CVSS 5) — Multiple TCP implementations with Protection Against Wrapped Sequence Numbers (PAWS) with the timestamps optio…
    CVE-2004-0112 (CVSS 5) — The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not…
    CVE-2004-0081 (CVSS 5) — OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to c…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High