CVE-2018-0141

Cisco Prime Collaboration Provisioning (PCP) Software 11.6 is affected by CVE-2018-0141, a hard-coded SSH password vulnerability that allows an unauthenticated, local attacker to log into the PCP host and gain low-privilege OS access, then escalate to root privileges. The issue stems from a hard-...

CVE-2018-0147

A vulnerability in Java deserialization used by Cisco Secure Access Control System ACS prior to release 5.8 patch 9 could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by...

CVE-2018-0209

A vulnerability in the Simple Network Management Protocol SNMP subsystem communication channel through the Cisco 550X Series Stackable Managed Switches could allow an authenticated, remote attacker to cause the device to reload unexpectedly, causing a denial of service DoS condition. The device n...

CVE-2018-0214

The CVE-2018-0214 entry concerns Cisco Identity Services Engine (ISE) with a Local Command Injection vulnerability in certain CLI commands caused by insufficient input validation. An authenticated, local attacker with valid device credentials could issue crafted CLI input to execute arbitrary com...

CVE-2018-0144

CVE-2018-0144 is a cross-site scripting (XSS) vulnerability in Cisco Prime Data Center Network Manager (DCNM) web-based management interface. The root cause is insufficient validation of user-supplied input, allowing an unauthenticated, remote attacker to entice a user to click a crafted link and...

CVE-2018-0147

A vulnerability in Java deserialization used by Cisco Secure Access Control System ACS prior to release 5.8 patch 9 could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by...

Cisco UCS Central Software < 2.0(1c) HTTP Request Handling RCE

The version of Cisco Unified Computing System UCS Central Software running on the remote host is prior to 1.31c. It is, therefore, affected by a flaw in its web framework due to improper validation of user-supplied input. An authenticated, remote attacker can exploit this, via a specially crafted...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due...

Code injection

A vulnerability in Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to bypass security protections, gain elevated privileges, and execute arbitrary code. The vulnerability is due to insecure key generation during application configuration. An attacker...

Cross site scripting

A vulnerability in the web-based management interface of the Cisco Data Center Analytics Framework application could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface of an affected system. The vulnerability is due to...

Cross site scripting

A vulnerability in the User Provisioning tab in the Cisco Prime Collaboration Provisioning Tool could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by...

CVE-2018-0130

A vulnerability in the use of JSON web tokens by the web-based service portal of Cisco Elastic Services Controller Software could allow an unauthenticated, remote attacker to gain administrative access to an affected system. The vulnerability is due to the presence of static default credentials f...

CVE-2018-0204

A vulnerability in the web portal of the Cisco Prime Collaboration Provisioning Tool could allow an unauthenticated, remote attacker to create a denial of service DoS condition for individual users. The vulnerability is due to weak login controls. An attacker could exploit this vulnerability by...

CVE-2018-0124

A vulnerability in Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to bypass security protections, gain elevated privileges, and execute arbitrary code. The vulnerability is due to insecure key generation during application configuration. An attacker...

CVE-2018-0203

A vulnerability in the SMTP relay of Cisco Unity Connection could allow an unauthenticated, remote attacker to send unsolicited email messages, aka a Mail Relay Vulnerability. The vulnerability is due to improper handling of domain information in the affected software. An unauthenticated, remote...

CVE-2018-0205

A vulnerability in the User Provisioning tab in the Cisco Prime Collaboration Provisioning Tool could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by...

Design/Logic Flaw

A vulnerability in the SMTP relay of Cisco Unity Connection could allow an unauthenticated, remote attacker to send unsolicited email messages, aka a Mail Relay Vulnerability. The vulnerability is due to improper handling of domain information in the affected software. An unauthenticated, remote...

Cross site scripting

A vulnerability in the web-based interface of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web-based interface of an affected product. The vulnerability is due to insufficient validation of...

CVE-2018-0203

CVE-2018-0203 : A vulnerability in the SMTP relay of Cisco Unity Connection allows an unauthenticated, remote attacker to send unsolicited email messages due to improper handling of domain information. A successful exploit could deliver emails to arbitrary addresses. Affected product: Cisco Unity...

CVE-2018-0206

The CVE affects Cisco Unified Communications Manager (CUCM) web-based management interface. It stems from insufficient validation of user-supplied input, enabling an unauthenticated, remote attacker to trigger a reflected cross-site scripting (XSS) attack by guiding a user to click a crafted link...