Deserialization of untrusted data

A vulnerability in Java deserialization used by Cisco Secure Access Control System ACS prior to release 5.8 patch 9 could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due to...

Input validation

A vulnerability in specific CLI commands for the Cisco Identity Services Engine could allow an authenticated, local attacker to cause a denial of service DoS condition. The device may need to be manually rebooted to recover. The vulnerability is due to lack of proper input validation of the CLI...

CVE-2018-0220

The vulnerability CVE-2018-0220 affects Cisco Videoscape AnyRes Live's web-based management interface. It is a cross-site scripting (XSS) flaw caused by insufficient validation of user-supplied input. An authenticated, remote attacker could lure a user into clicking a crafted link, enabling arbit...

CVE-2018-0208

A vulnerability in the web-based management interface of the cloud based Cisco Registered Envelope Service could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of the affected service. The vulnerability is...

CVE-2018-0220

A vulnerability in the web-based management interface of Cisco Videoscape AnyRes Live could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient...

CVE-2018-0217

Cisco StarOS CLI Command Injection (CVE-2018-0217) affects the CLI of Cisco ASR 5000 Series StarOS. The vulnerability stems from insufficient validation of commands submitted to CLI configurations, enabling an authenticated local attacker with valid admin credentials to inject and execute arbitra...

CVE-2018-0141

A vulnerability in Cisco Prime Collaboration Provisioning PCP Software 11.6 could allow an unauthenticated, local attacker to log in to the underlying Linux operating system. The vulnerability is due to a hard-coded account password on the system. An attacker could exploit this vulnerability by...

CVE-2018-0221

CVE-2018-0221 describes a local command-injection vulnerability in the Cisco Identity Services Engine (ISE) CLI. The issue arises from inadequate input validation of CLI ISE configuration commands, allowing an authenticated administrator to inject commands into the underlying Linux OS or cause th...

CVE-2018-0213

CVE-2018-0213 concerns Cisco Identity Services Engine (ISE). A vulnerability in the credential reset functionality allows an authenticated, remote attacker with valid credentials to escalate privileges due to insufficient input validation. Exploitation requires the attacker to authenticate to the...

CVE-2018-0214

A vulnerability in certain CLI commands of Cisco Identity Services Engine ISE could allow an authenticated, local attacker to execute arbitrary commands on the host operating system with the privileges of the local user, aka Command Injection. These commands should have been restricted from this...

CVE-2018-0144

A vulnerability in the web-based management interface of Cisco Prime Data Center Network Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due to...

CVE-2018-0209

A vulnerability in the Simple Network Management Protocol SNMP subsystem communication channel through the Cisco 550X Series Stackable Managed Switches could allow an authenticated, remote attacker to cause the device to reload unexpectedly, causing a denial of service DoS condition. The device n...

CVE-2018-0223

Cisco Security Manager is affected by CVE-2018-0223 due to a reflected cross-site scripting (XSS) flaw in the DesktopServlet of the web-based management interface. The issue arises from insufficient validation of input, enabling an unauthenticated, remote attacker to entice a user to click a craf...

CVE-2018-0212

CVE-2018-0212 affects Cisco Identity Services Engine (ISE) and is a web-based management interface XSS vulnerability caused by insufficient validation of user-supplied input. An unauthenticated, remote attacker could lure a user to click a crafted link, potentially executing arbitrary script in t...

CVE-2018-0216

The CVE-2018-0216 issue affects the web-based management interface of Cisco Identity Services Engine (ISE). The vulnerability arises from insufficient CSRF protections, enabling an unauthenticated, remote attacker to persuade a user to click a crafted link and perform arbitrary actions on the dev...

CVE-2018-0208

A vulnerability in the web-based management interface of the cloud based Cisco Registered Envelope Service could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of the affected service. The vulnerability is...

CVE-2018-0218

CVE-2018-0218 affects Cisco Secure Access Control Server (ACS) web UI prior to 5.8 patch 9. The issue arises from improper handling of XML External Entities (XXEs) when parsing XML files, enabling an unauthenticated, remote attacker to read information from the system. Connected sources identify ...

CVE-2018-0221

A vulnerability in specific CLI commands for the Cisco Identity Services Engine ISE could allow an authenticated, local attacker to perform command injection to the underlying operating system or cause a hang or disconnect of the user session. The attacker needs valid administrator credentials fo...

CVE-2018-0216

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF...