Cisco Identity Services Engine Multiple Stored Cross-Site Scripting Vulnerabilities (cisco-sa-20191016-ise-stored-xss)

A cross-site scripting XSS vulnerability exists in the web-based management interface of Cisco Identity Services Engine ISE due to improper validation of user-supplied input before returning it to users. An authenticated, remote attacker can exploit this, persuading a user of the interface to cli...

Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerability (cisco-sa-20191016-ise-store-xss)

A cross-site scripting XSS vulnerability exists in the web-based management interface of Cisco Identity Services Engine ISE due to improper validation of user-supplied input before returning it to users. An authenticated, remote attacker can exploit this, persuading a user of the interface to cli...

CVE-2019-15282

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE Software could allow an unauthenticated, remote attacker read tcpdump files generated on an affected device. The vulnerability is due an issue in the authentication logic of the web-based management...

Design/Logic Flaw

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE Software could allow an unauthenticated, remote attacker read tcpdump files generated on an affected device. The vulnerability is due an issue in the authentication logic of the web-based management...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The attacker must have...

CVE-2019-15281 Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The attacker must have...

CVE-2019-15281 Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The attacker must have...

CVE-2019-15282

Cisco Identity Services Engine (ISE) exposes an information-disclosure flaw in its web-based management interface. An unauthenticated, remote attacker can read tcpdump files generated on an affected device by sending a crafted request due to an issue in the authentication logic. The CVE describes...

CVE-2019-15281

The CVE-2019-15281 issue affects Cisco Identity Services Engine (ISE) web-based management interface. It is a stored XSS vulnerability caused by insufficient validation of user-supplied input, exploitable by injecting malicious code into a troubleshooting file. An attacker must have valid adminis...

CVE-2019-12637

Cisco Identity Services Engine (ISE) web-based management interface is affected by multiple stored XSS vulnerabilities due to insufficient validation of user input. An authenticated, remote attacker can lure a user to click a crafted link, potentially executing arbitrary script code in the user’s...

CVE-2019-12638

CVE-2019-12638 affects Cisco Identity Services Engine (ISE) stores XSS in the web-based management interface due to insufficient input validation. The issue allows an authenticated, remote attacker to coerce a user into clicking a crafted link, resulting in execution of arbitrary script code in t...

CVE-2019-12638 Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to conduct cross-site scripting XSS attacks against a user of the web-based management interface. The vulnerability is due to insufficient validation of...

Cisco Identity Services Engine Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE Software could allow an unauthenticated, remote attacker read tcpdump files generated on an affected device. The vulnerability is due an issue in the authentication logic of the web-based management...

CVE-2019-15281: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The attacker must have...

Cisco Identity Services Engine CVE-2019-12638 HTML Injection Vulnerability

Description Cisco Identity Services Engine is prone to an HTML-injection vulnerability because it fails to properly validate user-supplied input. Successful exploits will result in the execution of arbitrary attacker-supplied HTML and script code in the context of the affected application,...

CVE-2019-15282: Missing Authentication for Critical Function

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE Software could allow an unauthenticated, remote attacker read tcpdump files generated on an affected device. The vulnerability is due an issue in the authentication logic of the web-based management...

Cisco Identity Services Engine Cross-Site Scripting Vulnerability (CNVD-2019-36625)

Cisco Identity Services Engine ISE is an identity-based environment awareness platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. A cross-site scripting...

CVE-2019-12631

CVE-2019-12631 affects Cisco Identity Services Engine (ISE) web-based guest portal. An unauthenticated remote attacker can trigger a cross-site scripting (XSS) by prompting a user to click a crafted link, exploiting insufficient validation of input in the web interface. Impact described as arbitr...

SQL Injection in Zingbox Inspector

An SQL injection vulnerability exists in the Zingbox Inspector management interface that allows for unsanitized data provided by an authenticated user to be passed from the web UI into the database. Ref: CVE-2019-15016 The vulnerability allows for authenticated users to pass unsanitized commands ...

Cisco Identity Services Engine Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability exists...