CVE-2021-1444

CVE-2021-1444 affects Cisco ASA and Cisco FTD/FMC web services interface. The issue arises from insufficient validation of user-supplied input, enabling an unauthenticated, remote attacker to lure a user into clicking a crafted link and trigger cross-site scripting (XSS) in the interface context....

CVE-2021-1462

CVE-2021-1462 affects Cisco SD-WAN vManage Software CLI. The issue arises from an incorrect privilege assignment that lets an authenticated local attacker with a valid Administrator account create a malicious file that the system later parses, potentially granting the attacker root privileges on ...

CVE-2024-0793

CVE-2024-0793 – Kubernetes kube-controller-manager DoS (KCM pods churn) Affects kube-controller-manager where applying an HPA YAML without a .spec.behavior.scaleUp block can cause denial of service via KCM pods restarting (restart churn). The issue is documented in multiple sources, with IBM X-Fo...

CVE-2023-4639

Undertow contains a flaw in how cookies with certain value-delimiting characters are parsed from incoming requests. The issue can allow an attacker to construct a cookie value to exfiltrate HttpOnly cookies or spoof additional cookie values, leading to unauthorized data access or modification. Th...

CVE-2023-0657

The CVE-2023-0657 entries concern Keycloak, where a flaw is described as improper enforcement of token types when validating signatures locally. This could let an authenticated attacker exchange a logout token for an access token, potentially accessing data outside of enforced permissions. The co...

CVE-2020-25720

A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator...

CVE-2017-13313

A denial of service vulnerability exists in the Media framework of Google Android versions 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, and 8.1 . The root cause is an incorrect bounds check in the ElementaryStreamQueue::dequeueAccessUnitMPEG4Video function of ESQueue.cpp, which can trigger an infinite loo...

CVE-2017-13314

CVE-2017-13314 affects Android by with a missing permission check in NetworkManagementService.setAllowOnlyVpnForUids, enabling local escalation of privilege to access non-VPN networks when VPN-only access is intended. The issue is described as a security settings bypass in NetworkManagementServic...

CVE-2017-13312

CVE-2017-13312 affects Android’s Media framework (MediaCas.java) where a parcel read/write mismatch in createFromParcel, due to improper input validation, can enable local elevation of privilege on Android 8.0 (Oreo). An app could start an activity with system privileges without extra execution p...

CVE-2017-13311

The Android Framework is affected by an Elevation of Privilege (EoP) vulnerability caused by a read/write serialization issue in the read() function of ProcessStats.java. This flaw allows a local malicious application to bypass permissions and start an activity with system privileges without requ...

CVE-2017-13310

The CVE-2017-13310 issue is described as a read/write serialization bug in ViewPager.java.createFromParcel, causing a permissions bypass and enabling local escalation of privilege (an app could start an activity with system privileges without extra execution privileges). The vulnerability affects...

CVE-2021-1466

CVE-2021-1466 affects Cisco SD-WAN vManage, targeting the vDaemon service. The issue is incomplete bounds checks on data fed to vDaemon, risking a buffer overflow that can reload the service and cause DoS. Attacks are described as authenticated, local, with exploitation via sending malicious data...

CVE-2021-1470

Cisco SD-WAN vManage Software is affected by CVE-2021-1470, an SQL injection vulnerability in the web-based management interface. The issue arises from improper input validation of SQL queries, allowing an authenticated, remote attacker to send malicious queries and potentially modify values on t...

CVE-2021-1464

CVE-2021-1464 affects Cisco SD-WAN vManage Software. The issue is insufficient input validation for certain commands, allowing an authenticated, remote attacker to bypass authorization and gain restricted access to configuration data by sending crafted requests. Cisco has released software update...

CVE-2021-1483

Cisco SD-WAN vManage Software contains an XXE handling flaw in its web UI that could allow an authenticated remote attacker to read and write files within the affected application by convincing a user to import a crafted XML file. The issue stems from improper XML External Entity processing durin...

CVE-2021-1484

Cisco SD-WAN vManage Software has a web UI vulnerability (CVE-2021-1484) allowing an authenticated, remote attacker to inject arbitrary commands via crafted device template configuration input, leading to DoS. Root cause: improper input validation of user-supplied device template inputs. Affected...

CVE-2021-1494

Removed by vendor...

CVE-2021-34752

CVE-2021-34752 : A vulnerability in the Cisco Firepower Threat Defense (FTD) CLI allows an authenticated, local attacker with administrative privileges to execute arbitrary commands with root privileges on the underlying OS due to insufficient validation of user-supplied command arguments. Affect...

CVE-2022-20631

Cisco Enterprise Chat and Email (ECE) exposes a cross-site scripting (XSS) vulnerability in its web-based management interface. An unauthenticated, remote attacker could inject malicious script via the chat window due to improper input validation, potentially executing code in the interface conte...

CVE-2022-20634

Cisco Enterprise Chat and Email (ECE) Web-based management interface vulnerability (CVE-2022-20634) allows an unauthenticated, remote attacker to cause user redirection to a malicious URL via crafted links. Root cause: improper input validation of URL parameters in HTTP requests. Affects Cisco EC...