Cisco Firepower Management Center Software Information Disclosure (cisco-sa-fmc-info-disc-UghNRRhP)

The version of Cisco Firepower Management Center installed on the remote host is prior to tested version. It is, therefore, affected by an information disclosure vulnerability due to missing authorization and insufficient entropy for certain resources in the web-based management interface, that...

CVE-2022-20935

CVE-2022-20935 affects Cisco Firepower Management Center (FMC) web-based management interface. The issue is a stored cross-site scripting (XSS) vulnerability caused by insufficient validation of user-supplied input in various FMC data fields. An authenticated, remote attacker could inject crafted...

CVE-2022-20932

CVE-2022-20932 involves multiple stored XSS vulnerabilities in the Cisco Firepower Management Center (FMC) web-based management interface. The issues arise from insufficient validation of user-supplied input in data fields, allowing an authenticated, remote attacker to inject script code that run...

CVE-2022-20839

Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface of an affected device. These vulnerabilities are due t...

CVE-2022-20839

Cisco Firepower Management Center (FMC) web UI contains multiple stored XSS vulnerabilities due to insufficient input validation. An authenticated, remote attacker could inject crafted input via FMC interface fields to execute script code in the user’s browser or access browser-based data; availa...

CVE-2022-20838

Cisco Firepower Management Center (FMC) web UI contains stored XSS vulnerabilities due to insufficient input validation. An authenticated, remote attacker could inject crafted input into UI fields to execute arbitrary script in the FMC interface context or access browser-based information, with p...

CVE-2022-20835

Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface of an affected device. These vulnerabilities are due t...

CVE-2022-20834

Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface of an affected device. These vulnerabilities are due t...

CVE-2022-20833

CVE-2022-20833 concerns multiple stored XSS flaws in the web-based management interface of Cisco Firepower Management Center (FMC). The root cause is inadequate validation of user-supplied input in the FMC web UI, enabling an authenticated, remote attacker to inject script code via various data f...

CVE-2022-20941

A vulnerability in the web-based management interface of Cisco Firepower Management Center FMC Software could allow an unauthenticated, remote attacker to access sensitive information. This vulnerability is due to missing authorization for certain resources in the web-based management interface...

CVE-2022-20926

CVE-2022-20926 relates to the Cisco Firepower Management Center (FMC) web management interface. The issue stems from insufficient validation of user-supplied parameters on certain API endpoints, allowing an authenticated remote attacker with valid Device permissions to send crafted input and exec...

CVE-2022-20925

Summary (CVE-2022-20925) : The Cisco Firepower Management Center (FMC) web management interface is affected by an API input validation vulnerability. An authenticated attacker with Device-permission credentials could exploit crafted input to API endpoints to execute arbitrary OS commands with low...

Cisco Firepower Management Center Software Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Firepower Management Center FMC Software could allow an unauthenticated, remote attacker to access sensitive information. This vulnerability is due to missing authorization for certain resources in the web-based management interface...

CVE-2022-20963

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. This vulnerability is due to...

CVE-2022-20961

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. This vulnerability is due to insufficient CSRF...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. This vulnerability is due to...

CVE-2022-20956

Cisco Identity Services Engine (ISE) exposes a vulnerability in its web-based management interface where improper access control could allow an authenticated remote attacker to bypass authorization and access system files. The issue arises from insufficient access controls in the web UI, enabling...

Vulnerabilities fixed in Cisco ESA, SWA and Secure Email and Web Manager

Cisco has fixed several vulnerabilities in Cisco Email Security Appliance ESA, Secure Web Appliance SWA, vh. Web Security Appliance and the Secure Email and Web Manager. A malicious party could exploit the vulnerabilities to cause a denial-of-service, to execute arbitrary commands execute with ro...

Vulnerabilities fixed in Cisco Identity Serrvices Engine (ISE).

Cisco has fixed several vulnerabilities in the Identity Services Engine ISE. A malicious person with access to the management interface can exploit the vulnerabilities for attacks that can lead to the following categories of damage: Cross-Site Request Forgery XSRF. Cross-Site Scripting XSS...

Cisco Identity Services Engine Insufficient Access Control Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to bypass authorization and access system files. This vulnerability is due to improper access control in the web-based management interface of an affected...