CVE-2022-20734: Exposure of Sensitive System Information to an Unauthorized Control Sphere

A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, local attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerabilit...

Cisco Firepower Threat Defense 安全漏洞

Cisco Firepower Threat Defense is a suite of unified software from Cisco that provides next-generation firewall services.Cisco Firepower Threat Defense Software is vulnerable to an input validation error that could be exploited by an authenticated local attacker to inject XML into the command...

CVE-2022-20732

A vulnerability in the configuration file protections of Cisco Virtualized Infrastructure Manager VIM could allow an authenticated, local attacker to access confidential information and elevate privileges on an affected device. This vulnerability is due to improper access permissions for certain...

CVE-2022-20732

A vulnerability in the configuration file protections of Cisco Virtualized Infrastructure Manager VIM could allow an authenticated, local attacker to access confidential information and elevate privileges on an affected device. This vulnerability is due to improper access permissions for certain...

Cisco Virtualized Infrastructure Manager 访问控制错误漏洞

Cisco Virtualized Infrastructure Manager is a fully automated cloud lifecycle management system from Cisco, U.S. An access control error vulnerability exists in Cisco Virtualized Infrastructure Manager, which stems from certain configuration files' The vulnerability is caused by an access privile...

CVE-2022-20716

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain escalated privileges. This vulnerability is due to improper access control on files within the affected system. A local attacker could exploit this vulnerability by modifying certain files on...

CVE-2022-20739

A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system as the root user. The attacker must be authenticated on the affected system as a low-privileged user to exploit this...

PT-2022-2277 · Cisco · Cisco Ios Xe

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software affected versions not specified Description: A vulnerability in the Tool Command Language Tcl interpreter could allow an authenticated, local attacker to escalate from privilege level 15 to root-level privileges. This...

Zyxel VMG3312-T20A 安全漏洞

The Zyxel VMG3312-T20A is a state-of-the-art VDSL2 gateway from China's Heqin Technology Zyxel. A security vulnerability exists in the Zyxel VMG3312-T20A version 5.30ABFX.5C0, which stems from a potential buffer overflow vulnerability found in some internal functions. An authenticated, local...

PT-2022-1962 · Cisco · Cisco Ultra Cloud Core - Subscriber Microservices Infrastructure

Name of the Vulnerable Software and Affected Versions: Cisco Ultra Cloud Core - Subscriber Microservices Infrastructure SMI affected versions not specified Description: The issue is related to insufficient access control in the Common Execution Environment CEE ConfD CLI, which could allow an...

Cisco StarOS 命令注入漏洞

Cisco StarOS is a virtualized operating system from Cisco. A command injection vulnerability exists in Cisco StarOS that can be exploited by an authenticated, local attacker to elevate privileges on an affected device. The vulnerability is due to insufficient input validation of CLI commands. An...

Linux kernel 代码问题漏洞

Linux kernel is the kernel used by the Linux Foundation's open source operating system, Linux. Linux kernel is vulnerable due to a NULL pointer dereference flaw in the udffilewriteiter function in the udf file system. By using a constructed UDF image, an authenticated local attacker could exploit...

CVE-2021-42833

A Use of Hardcoded Credentials vulnerability exists in AquaView versions 1.60, 7.x, and 8.x that could allow an authenticated local attacker to manipulate users and system settings...

CVE-2021-42757

A buffer overflow CWE-121 in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments...

CVE-2021-39976

There is a privilege escalation vulnerability in CloudEngine 5800 V200R020C00SPC600. Due to lack of privilege restrictions, an authenticated local attacker can perform specific operation to exploit this vulnerability. Successful exploitation may cause the attacker to obtain a higher privilege...

CVE-2021-37207: Incorrect Permission Assignment for Critical Resource

A vulnerability has been identified in SENTRON powermanager V3 All versions. The affected application assigns improper access rights to a specific folder containing configuration files. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges...

CVE-2021-34756

Multiple vulnerabilities in the CLI of Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges. For more information about these vulnerabilities, see the Details section of this advisory...

CVE-2021-34761

A vulnerability in Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to overwrite or append arbitrary data to system files using root-level privileges. The attacker must have administrative credentials on the device. This vulnerability is due to incomplete...

CVE-2021-34788

A vulnerability in the shared library loading mechanism of Cisco AnyConnect Secure Mobility Client for Linux and Mac OS could allow an authenticated, local attacker to perform a shared library hijacking attack on an affected device if the VPN Posture HostScan Module is installed on the AnyConnect...

CVE-2021-34788

A vulnerability in the shared library loading mechanism of Cisco AnyConnect Secure Mobility Client for Linux and Mac OS could allow an authenticated, local attacker to perform a shared library hijacking attack on an affected device if the VPN Posture HostScan Module is installed on the AnyConnect...