CVE-2022-20828

CVE-2022-20828 affects Cisco FirePOWER Software for ASA FirePOWER Module. Root cause: CLI parser mishandles undefined parameters, enabling authenticated remote command injection to execute arbitrary commands as root on the FirePOWER OS. Exploitation paths include crafted CLI commands or crafted H...

CVE-2022-20829

CVE-2022-20829 concerns Cisco ASA Software and ASDM packaging: an authenticated admin can upload a crafted ASDM image to a device running ASA, exploiting insufficient validation of ASDM image authenticity to execute arbitrary code on the target. Exploitation path involves the attacker delivering ...

CVE-2022-20829 Cisco Adaptive Security Device Manager and Adaptive Security Appliance Software Client-side Arbitrary Code Execution Vulnerability

A vulnerability in the packaging of Cisco Adaptive Security Device Manager ASDM images and the validation of those images by Cisco Adaptive Security Appliance ASA Software could allow an authenticated, remote attacker with administrative privileges to upload an ASDM image that contains malicious...

CVE-2022-20829 Cisco Adaptive Security Device Manager and Adaptive Security Appliance Software Client-side Arbitrary Code Execution Vulnerability

A vulnerability in the packaging of Cisco Adaptive Security Device Manager ASDM images and the validation of those images by Cisco Adaptive Security Appliance ASA Software could allow an authenticated, remote attacker with administrative privileges to upload an ASDM image that contains malicious...

Cisco FirePOWER Software for ASA FirePOWER Module Command Injection Vulnerability

A vulnerability in the CLI parser of Cisco FirePOWER Software for Adaptive Security Appliance ASA FirePOWER module could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected ASA FirePOWER module as the root user. This vulnerabilit...

PT-2022-3059 · Cisco · Cisco Firepower Services Software For Asa +1

Name of the Vulnerable Software and Affected Versions: Cisco FirePOWER Services Software for ASA affected versions not specified Description: The issue is related to improper handling of undefined command parameters in the CLI parser of Cisco FirePOWER Software for Adaptive Security Appliance ASA...

Cisco ASA-X with FirePOWER Services Authenticated Command Injection

This module exploits an authenticated command injection vulnerability affecting Cisco ASA-X with FirePOWER Services. This exploit is executed through the ASA's ASDM web server and lands in the FirePower Services SFR module's Linux virtual machine as the root user. Access to the virtual machine...

U.S. Dept Of Defense: XSS DUE TO CVE-2020-3580

Hello Team, During my research, I found multiple hosts to be vulnerable to Cisco ASA XSS CVE-2020-3580, This vulnerability targets the saml service within the VPN. It is triggered via a POST request to domain/+CSCOE+/saml/sp/acs?tgname=a References...

Cisco Adaptive Security Appliance Software Transparent Mode DoS (cisco-sa-asa-ftd-dos-JxYWMJyL)

According to its self-reported version, Cisco ASA Software is affected by a denial of service vulnerability. A denial of service DoS vulnerability exists in the TCP Normalizer. An unauthenticated, remote attacker can exploit this issue, via poisoning MAC address tables in adjacent devices and cau...

Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability

A buffer overflow vulnerability in the Simple Network Management Protocol SNMP code of Cisco ASA software could allow an attacker to cause a reload of the affected system or to remotely execute code...

Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability

A vulnerability in the command-line interface CLI parser of Cisco ASA software could allow an authenticated, local attacker to create a denial-of-service DoS condition or potentially execute code...

Security update for cacti, cacti-spine (moderate)

openSUSE Security Update: Security update for cacti, cacti-spine Announcement ID: openSUSE-SU-2022:0145-1 Rating: moderate References: 1192408 1196692 Cross-References: CVE-2022-0730 CVSS scores: CVE-2022-0730 NVD : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux...

The vulnerability of the implementation of the VPN Secure Sockets Layer (SSL) function in microprogramming-based network interface controllers of Cisco Adaptive Security Appliances (ASA) and Cisco Firepower Threat Defense (FTD) allows a attacker to cause service interruptions.

The vulnerability of the implementation of the VPN Secure Sockets Layer SSL function in microprogramming-based network interface controllers from Cisco Adaptive Security Appliances ASA and Cisco Firepower Threat Defense FTD is related to resource management errors. Exploiting this vulnerability c...

Cisco Adaptive Security Appliance Software IPsec IKEv2 VPN Information Disclosure (cisco-sa-asaftd-ipsec-mitm-CKnLr4)

According to its self-reported version, Cisco ASA Software is affected by a vulnerability due to an improper implementation of Galois/Counter Mode GCM ciphers. An unauthenticated, remote attacker can, by intercepting a sufficient number of encrypted messages from the affected device, use...

Cisco Adaptive Security Appliance Software IKEv2 Site-to-Site VPN Denial of Service (cisco-sa-asaftd-ikev2-dos-g4cmrr7C)

A vulnerability in the Internet Key Exchange Version 2 IKEv2 implementation of Cisco Adaptive Security Appliance ASA Software could allow an authenticated, remote attacker to trigger a denial of service DoS condition on an affected device. This vulnerability is due to improper control of a...

Cisco Firepower Threat Defense and Cisco Adaptive Security Appliances Software Denial of Service Vulnerability

Cisco Firepower Threat Defense FTD and Cisco Adaptive Security Appliances Software ASA Software are both products of Cisco U.S.A. Cisco Firepower Threat Defense is a set of unified software that provides next-generation firewall services.Cisco Adaptive Security Appliances Software is a firewall a...

Cisco Issues Patches for 3 New Flaws Affecting Enterprise NFVIS Software

Cisco Systems on Wednesday shipped security patches to contain three flaws impacting its Enterprise NFV Infrastructure Software NFVIS that could permit an attacker to fully compromise and take control over the hosts. Tracked as CVE-2022-20777, CVE-2022-20779, and CVE-2022-20780, the vulnerabiliti...

Cisco Adaptive Security Appliance Software Clientless SSL VPN Heap Overflow (cisco-sa-asa-ssl-vpn-heap-zLX3FdX)

According to its self-reported version, Cisco ASA Software is affected by an heap overflow condition in the handler for HTTP authentication resources accessed through the Clientless SSL VPN portal which allows an authenticated, remote attacker to cause a denial of service condition or obtain...

CVE-2022-20760

A vulnerability in the DNS inspection handler of Cisco Adaptive Security Appliance ASA Software and Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a denial of service condition DoS on an affected device. This vulnerability is due to a lack of proper...

CVE-2022-20737

A vulnerability in the handler for HTTP authentication for resources accessed through the Clientless SSL VPN portal of Cisco Adaptive Security Appliance ASA Software could allow an authenticated, remote attacker to cause a denial of service DoS condition on an affected device or to obtain portion...