CVE-2020-26067

CVE-2020-26067 concerns Cisco Webex Teams web interface. Affected component: web-based interface; issue arises from improper validation of usernames. An authenticated, remote attacker can create an account containing malicious HTML/script and join a space with that name, enabling cross-site scrip...

CVE-2020-26062

Cisco Integrated Management Controller (CIMC) suffers a username-enumeration vulnerability due to differences in authentication responses. An unauthenticated, remote attacker can determine valid usernames by sending authentication requests to CIMC over the network. Multiple connected sources (CVE...

CVE-2020-26063

CVE-2020-26063 — Cisco Integrated Management Controller (IMC) API endpoints have improper authorization checks, enabling an authenticated remote attacker to bypass authorization and actions on the vulnerable system. Exploitation involves sending crafted API requests that could download files or m...

CVE-2020-26071

CVE-2020-26071 affects Cisco SD-WAN Software CLI. The issue is caused by insufficient input validation for specific commands, allowing an authenticated, local attacker to create or overwrite arbitrary files on an affected device, potentially leading to a DoS. Cisco has released software updates a...

CVE-2020-27124

Cisco ASA SSL/TLS DoS (CVE-2020-27124): Vulnerability in the SSL/TLS handler due to improper error handling on established SSL/TLS connections can cause an unauthenticated remote attacker to reload the device, leading to DoS. Affected products: Cisco ASA Software. Impact: device reload and servic...

CVE-2020-3431

Cisco Small Business RV042 and RV042G Dual WAN Router series are affected by an unauthenticated XSS vulnerability in the web-based management interface due to insufficient input validation. An attacker can lure a user to click a crafted link, potentially executing arbitrary script code in the use...

CVE-2020-26073

Cisco SD-WAN vManage Software is affected by a directory traversal/local file inclusion issue in the application data endpoints (APIs). It enables an unauthenticated attacker to read sensitive files and tokens via crafted API requests. The core issue is improper validation of directory traversal ...

CVE-2020-3532

CVE-2020-3532 affects Cisco Unified Communications Manager and related components (CUCM, CUCM Session Management Edition, IM&P, Unity Connection). The web-based management interface fails to properly validate input, enabling unauthenticated, remote attackers to persuade users to click crafted lin...

CVE-2020-3548

CVE-2020-3548 affects Cisco AsyncOS software for Cisco Email Security Appliance (ESA). The issue is in the TLS protocol implementation, caused by inefficient processing of incoming TLS traffic. An unauthenticated, remote attacker can send crafted TLS packets to trigger a prolonged state of high C...

CVE-2021-1132

CVE-2021-1132 affects Cisco Network Services Orchestrator (NSO) API and web-management interface. The issue arises from improper validation of user-supplied input, allowing an unauthenticated, remote attacker to send crafted HTTP requests containing directory traversal sequences to access sensiti...

CVE-2021-1410

CVE-2021-1410 affects Cisco Webex Meetings. The vulnerability stems from insufficient authorization enforcement for requests to update distribution lists, allowing an authenticated, remote attacker to modify a distribution list belonging to another user within the same organization. The issue is ...

CVE-2021-1424

CVE-2021-1424 concerns Cisco ASR 5000 Series Software (StarOS) where the ipsecmgr process is vulnerable to unauthenticated, remote DoS via specially malformed IKEv2 packets. The issue stems from insufficient validation of incoming IKEv2 traffic, and exploitation can cause the ipsecmgr process to ...

CVE-2021-1444

CVE-2021-1444 affects Cisco ASA and Cisco FTD/FMC web services interface. The issue arises from insufficient validation of user-supplied input, enabling an unauthenticated, remote attacker to lure a user into clicking a crafted link and trigger cross-site scripting (XSS) in the interface context....

CVE-2021-1462

CVE-2021-1462 affects Cisco SD-WAN vManage Software CLI. The issue arises from an incorrect privilege assignment that lets an authenticated local attacker with a valid Administrator account create a malicious file that the system later parses, potentially granting the attacker root privileges on ...

CVE-2024-0793

CVE-2024-0793 – Kubernetes kube-controller-manager DoS (KCM pods churn) Affects kube-controller-manager where applying an HPA YAML without a .spec.behavior.scaleUp block can cause denial of service via KCM pods restarting (restart churn). The issue is documented in multiple sources, with IBM X-Fo...

CVE-2023-4639

Undertow contains a flaw in how cookies with certain value-delimiting characters are parsed from incoming requests. The issue can allow an attacker to construct a cookie value to exfiltrate HttpOnly cookies or spoof additional cookie values, leading to unauthorized data access or modification. Th...

CVE-2023-0657

The CVE-2023-0657 entries concern Keycloak, where a flaw is described as improper enforcement of token types when validating signatures locally. This could let an authenticated attacker exchange a logout token for an access token, potentially accessing data outside of enforced permissions. The co...

CVE-2020-25720

A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator...

CVE-2017-13313

CVE-2017-13313 affects the Android Media framework (ESQueue.cpp, ElementaryStreamQueue::dequeueAccessUnitMPEG4Video). The issue is an infinite loop caused by an incorrect bounds check, leading to remote denial of service with no additional privileges required. Availability impact is DoS; exploita...

CVE-2017-13314

CVE-2017-13314 affects Android by with a missing permission check in NetworkManagementService.setAllowOnlyVpnForUids, enabling local escalation of privilege to access non-VPN networks when VPN-only access is intended. The issue is described as a security settings bypass in NetworkManagementServic...