CVE-2020-27128

The Cisco SD-WAN vManage Software Arbitrary File Creation vulnerability (CVE-2020-27128) affects the application data endpoints and stems from improper validation of API requests, enabling an authenticated, remote attacker to perform directory traversal and write arbitrary files to an attacker-co...

CVE-2020-27128 Cisco SD-WAN vManage Software Arbitrary File Creation Vulnerability

A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to write arbitrary files to an affected system. The vulnerability is due to improper validation of requests to APIs. An attacker could exploit this vulnerability by...

CVE-2020-27128 Cisco SD-WAN vManage Software Arbitrary File Creation Vulnerability

A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to write arbitrary files to an affected system. The vulnerability is due to improper validation of requests to APIs. An attacker could exploit this vulnerability by...

Cisco SD-WAN vManage XSS (cisco-sa-vmanxsshi-9KHEqRpM)

According to its self-reported version, Cisco SD-WAN vManage is affected by a cross-site scripting XSS vulnerability in the web-based management interface due to not properly validating user-supplied input. An authenticated, remote attacker can exploit this, by convincing a user to click a...

Cisco SD-WAN vManage Software Privilege Escalation (cisco-sa-vmanage-escalation-Jhqs5Skf)

According to its self-reported version, Cisco SD-WAN vManage is affected by a privilege escalation vulnerability due to improper validation of path input to the system file transfer functions. An authenticated, local attacker can exploit this to overwrite arbitrary files, allowing the attacker to...

Cisco SD-WAN vManage Software Authorization Bypass (cisco-sa-uabvman-SYGzt8Bv)

According to its self-reported version, Cisco SD-WAN vManage is affected by a vulnerability. Please see the included Cisco BIDs and Cisco Security Advisory for more information. TRUSTED...

Cisco SD-WAN vManage Software Command Injection (cisco-sa-vmanage-privilege-zPmMf73k)

According to its self-reported version, Cisco SD-WAN vManage is affected by a command injection vulnerability in its remote management feature due to insufficient validation of commands to the remote management CLI. An authenticated, local attacker can exploit this, by sending specially crafted...

Cisco SD-WAN vManage XML External Entity Injection Vulnerability (CNVD-2020-66211)

Cisco SD-WAN Solution is a suite of network extension solutions from Cisco, of which vManage is the console. An XML external entity injection vulnerability exists in the web UI of Cisco SD-WAN vManage 20.1.12 and earlier. The vulnerability stems from improper handling of XML External Entity XXE...

Cisco SD-WAN vManage Cross-Site Scripting Vulnerability

Cisco SD-WAN Solution is a suite of network extension solutions from Cisco, of which vManage is the console. A cross-site scripting vulnerability exists in the Web management interface of Cisco SD-WAN vManage. The vulnerability stems from the Web management interface failing to properly validate...

Cisco SD-WAN vManage XML External Entity Injection Vulnerability

Cisco SD-WAN Solution is a suite of network extension solutions from Cisco, of which vManage is the console. An XML external entity injection vulnerability exists in the web UI of Cisco SD-WAN vManage 20.1.12 and earlier. The vulnerability stems from improper handling of XML External Entity XXE...

Cisco SD-WAN vManage Elevation of Privilege Vulnerability

Cisco SD-WAN Solution is a suite of network extension solutions from Cisco, of which vManage is the console. An elevation of privilege vulnerability exists in the System File Transfer feature of Cisco SD-WAN vManage. The vulnerability stems from improper validation of the path input to the System...

Cisco SD-WAN vManage Command Injection Vulnerability (CNVD-2020-61949)

Cisco SD-WAN Solution is a suite of network extension solutions from Cisco, of which vManage is the console. A command injection vulnerability exists in the remote management feature of Cisco SD-WAN vManage versions prior to 20.3.1. The vulnerability stems from improper command validation of the...

Cisco SD-WAN vManage Path Traversal Vulnerability

Cisco SD-WAN Solution is a suite of network extension solutions from Cisco, of which vManage is the console. A path traversal vulnerability exists in the Web management interface of Cisco SD-WAN vManage 20.1.12 and earlier. The vulnerability stems from insufficient authentication of HTTP requests...

Cisco SD-WAN vManage Software Arbitrary File Creation Vulnerability

A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to write arbitrary files to an affected system. The vulnerability is due to improper validation of requests to APIs. An attacker could exploit this vulnerability by...

Cisco SD-WAN vManage Software XML External Entity Vulnerability

A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity XXE entries when parsing certain XML...

CVE-2020-27129

A vulnerability in the remote management feature of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to inject arbitrary commands and potentially gain elevated privileges. The vulnerability is due to improper validation of commands to the remote management CLI of the...

Cisco SD-WAN vManage Software Path Traversal Vulnerability

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct path traversal attacks and obtain read access to sensitive files on an affected system. The vulnerability is due to insufficient validation of HTTP...

Cisco SD-WAN vManage Software Command Injection Vulnerability

A vulnerability in the remote management feature of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to inject arbitrary commands and potentially gain elevated privileges. The vulnerability is due to improper validation of commands to the remote management CLI of the...

Cisco SD-WAN vManage Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of the Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. The vulnerability exists because the web-based management interface does not...

Cisco SD-WAN vManage Software Authorization Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization and modify the configuration of an affected system. The vulnerability is due to insufficient authorization checking on an affected system. A...