CVE-2021-1491

CVE-2021-1491 affects Cisco SD-WAN vManage Software. The issue is information disclosure via the web-based management interface caused by insufficient file scope limiting, enabling an authenticated remote attacker to read arbitrary files from the device’s underlying OS by crafting a specific file...

CVE-2021-1494

CVE-2021-1494 affects the Snort detection engine used by multiple Cisco products. The vulnerability arises from incorrect handling of specific HTTP header parameters, allowing an unauthenticated remote attacker to bypass a configured file policy for HTTP packets and deliver a malicious payload. I...

CVE-2022-20633

Cisco ECE (Enterprise Chat and Email) web-based management interface is affected by CVE-2022-20633. The issue arises from differences in authentication responses during login, enabling unauthenticated remote attackers to perform username enumeration and confirm existing user accounts. The vulnera...

CVE-2022-20632

Cisco Enterprise Chat and Email (ECE) web-based management interface vulnerability (CVE-2022-20632) allows an unauthenticated, remote attacker to perform a reflected XSS by enticing a user to click a crafted link. The issue arises from inadequate validation of user-supplied input in the interface...

CVE-2021-34753

Cisco Firepower Threat Defense (FTD) Software is affected by CVE-2021-34753 due to incomplete deep packet inspection in ENIP traffic processing, enabling unauthenticated remote bypass of configured ENIP access control and intrusion policies. The vulnerability concerns the payload inspection compo...

CVE-2021-34752

CVE-2021-34752 : A vulnerability in the Cisco Firepower Threat Defense (FTD) CLI allows an authenticated, local attacker with administrative privileges to execute arbitrary commands with root privileges on the underlying OS due to insufficient validation of user-supplied command arguments. Affect...

CVE-2021-34751

CVE-2021-34751 affects Cisco Firepower Management Center (FMC) software. The vulnerability stems from improper encryption of sensitive information stored in the FMC GUI configuration manager, allowing an authenticated, low-privilege, remote attacker to view sensitive configuration parameters in c...

CVE-2021-34750

Cisco Firepower Management Center Software contains an information-disclosure vulnerability in its web-based GUI configuration manager. An authenticated, low-privilege attacker could access sensitive configuration parameters in clear text due to improper encryption of stored data. Impact is limit...

CVE-2022-20626

Cisco Prime Access Registrar Appliance exposes a Cross-Site Scripting vulnerability in its web-based management interface. The issue stems from insufficient validation of user-supplied input, allowing an authenticated attacker with device credentials to persuade a user to click a crafted link, po...

CVE-2022-20631

Cisco Enterprise Chat and Email (ECE) exposes a cross-site scripting (XSS) vulnerability in its web-based management interface. An unauthenticated, remote attacker could inject malicious script via the chat window due to improper input validation, potentially executing code in the interface conte...

CVE-2022-20654

CVE-2022-20654 affects Cisco Webex Meetings: an unauthenticated remote attacker can exploit insufficient input validation in the web-based interface to trigger cross-site scripting (XSS) by enticing a user to click a crafted link. Impact per sources includes execution of arbitrary script code in ...

CVE-2022-20634

Cisco Enterprise Chat and Email (ECE) Web-based management interface vulnerability (CVE-2022-20634) allows an unauthenticated, remote attacker to cause user redirection to a malicious URL via crafted links. Root cause: improper input validation of URL parameters in HTTP requests. Affects Cisco EC...

CVE-2022-20648

CVE-2022-20648 affects Cisco StarOS Software’s Redundancy Configuration Manager (RCM). A debug service incorrectly listens to/accepts incoming connections, enabling an unauthenticated, remote attacker to connect to the debug port, execute commands, and view confidential debugging information. Cis...

CVE-2022-20649

CVE-2022-20649 is a Cisco StarOS/RCM vulnerability where an incorrectly enabled debug mode on specific services allows an unauthenticated remote attacker to execute arbitrary commands as root inside the configured container. The issue stems from debug mode listening/enabled for certain services, ...

CVE-2022-20652

Cisco Tetration contains a command-injection vulnerability in the web-based management interface and API subsystem. An authenticated remote attacker with administrator credentials can submit crafted HTTP messages to execute commands with root privileges due to insufficient input validation. Impac...

CVE-2022-20655

CVE-2022-20655 describes a CLI command-injection vulnerability in ConfD on Cisco devices. It results from insufficient validation of a process argument in the CLI, enabling an authenticated, local attacker to inject commands during execution and potentially run arbitrary commands with the privile...

CVE-2022-20657

The CVE-2022-20657 issue affects Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network Manager (EPNM) where the web-based management interface does not adequately validate user input, enabling an unauthenticated, remote attacker to perform a cross-site scripting (XSS) attack. An ...

CVE-2022-20663

CVE-2022-20663 affects Cisco Secure Network Analytics (formerly Stealthwatch Enterprise). The issue is a cross-site scripting (XSS) vulnerability in the web-based management interface caused by insufficient validation of user-supplied input, exploitable when a user clicks a crafted link. An unaut...

CVE-2022-20685

CVE-2022-20685 is a DoS vulnerability in the Snort Modbus preprocessor caused by an integer overflow when processing Modbus traffic. An unauthenticated, remote attacker could craft traffic to cause the Snort process to hang and halt traffic inspection. Cisco has released software updates addressi...

CVE-2022-20656

CVE-2022-20656 affects Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network Manager (EPNM). The issue is in the web-based management interface where insufficient input validation of the HTTPS URL allows an authenticated, remote attacker to perform a path traversal attack, potent...