CVE-2018-0399

Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to retrieve a cleartext password from an affected system. Cisco Bug IDs: CSCvg71044...

CVE-2018-0390

Cisco Webex DOM-based XSS (CVE-2018-0390) affects the Webex web framework and arises from insufficient input validation of POST parameters, enabling an unauthenticated, remote attacker to inject scripts that run in a user’s browser for the affected web UI. The issue is documented across multiple ...

CVE-2018-0347

A vulnerability in the Zero Touch Provisioning ZTP subsystem of the Cisco SD-WAN Solution could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this...

CVE-2018-0392

A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by another user. The vulnerability is due to insufficient access control permissions i.e., World-Readable. An attacker could exploit this vulnerability by logging in to the CLI. An...

CVE-2018-0394

A vulnerability in the web upload function of Cisco Cloud Services Platform 2100 could allow an authenticated, remote attacker to obtain restricted shell access on an affected system. The vulnerability is due to insufficient input validation of parameters passed to a specific function within the...

CVE-2018-0344

The CVE-2018-0344 entry describes a vulnerability in the Cisco SD-WAN Solution where the vManage dashboard’s login parameter validation is insufficient, enabling an authenticated, remote attacker to inject and execute arbitrary commands with vManage user privileges by configuring a malicious user...

CVE-2018-0379

Multiple vulnerabilities exist in the Cisco Webex Network Recording Player for Advanced Recording Format ARF and Webex Recording Format WRF files. An attacker could exploit these vulnerabilities by providing a user with a malicious .arf or .wrf file via email or URL and convincing the user to...

CVE-2018-0343

A vulnerability in the configuration and management service of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to execute arbitrary code with vmanage user privileges or cause a denial of service DoS condition on an affected system. The vulnerability is due to insufficient...

CVE-2018-0398

CVE-2018-0398 affects Cisco Finesse Web-based management interface. The issue is an unauthenticated SSRF vulnerability (server-side request forgery) that could allow remote attackers to trigger unintended requests from the Cisco Finesse server. The connected sources (Cisco Security Advisory and N...

CVE-2018-0351

A vulnerability in the command-line tcpdump utility in the Cisco SD-WAN Solution could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerabilit...

CVE-2018-0401

Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express Unified CCX could allow an unauthenticated, remote attacker to conduct cross-site scripting XSS attacks against a user of the interface. Cisco Bug IDs: CSCvg70967...

CVE-2018-0399

Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to retrieve a cleartext password from an affected system. Cisco Bug IDs: CSCvg71044...

CVE-2018-0402

Cisco Unified Contact Center Express (Unified CCX) web-based management interface is affected by CVE-2018-0402, a CSRF vulnerability in the interface. Exploitation, as described in the connected Cisco advisory and multiple CNVD/PRION/NVD records, could allow an unauthenticated, remote attacker to...

CVE-2018-0380

CVE-2018-0380 affects Cisco Webex Network Recording Player components for ARF and WRF files. The vulnerabilities allow an attacker to cause a crash/DoS by delivering a malicious .arf or .wrf file and convincing the user to open it, with exploitation described as a resource-management/DoS conditio...

CVE-2018-0394

Cisco Cloud Services Platform 2100 has a web upload function input-validation vulnerability that allows an authenticated, remote attacker to inject code and obtain restricted shell access. Root cause: insufficient validation of parameters in a UI function. Impact: restricted shell access on affec...

CVE-2018-0348

Cisco SD-WAN Solution CVE-2018-0348 is a command-injection vulnerability in the CLI due to insufficient input validation. It affects vBond Orchestrator Software, vEdge 100/1000/2000/5000 Series Routers, vEdge Cloud Router Platform, vManage Network Management Software, and vSmart Controller Softwa...

CVE-2018-0393

Cisco Policy Suite's Policy Builder interface is affected by CVE-2018-0393, a Read-Only User Effect Change vulnerability caused by insufficient authorization controls. An authenticated, remote attacker could modify an HTTP request via the Policy Builder interface to change existing policies. The ...

CVE-2018-0387

CVE-2018-0387 describes a remote code execution vulnerability in Cisco Webex Teams for Windows and macOS. The issue stems from improper input sanitization, allowing an unauthenticated, remote attacker to craft a malicious link that, when opened by a user, could execute arbitrary code with elevate...

CVE-2018-0380

Multiple vulnerabilities exist in the Cisco Webex Network Recording Player for Advanced Recording Format ARF and Webex Recording Format WRF files. An attacker could exploit these vulnerabilities by providing a user with a malicious .arf or .wrf file via email or URL and convincing the user to...

CVE-2018-0398

Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a server-side request forgery SSRF attack. Cisco Bug IDs: CSCvg71018...