CVE-2023-20026: Improper Neutralization of Special Elements used in a Command

A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320 and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary commands on an affected device. This vulnerability is due to improper validation of user input with...

CVE-2022-20967

CVE-2022-20967 affects Cisco Identity Services Engine (ISE) web-based management interface. The issue is stored cross-site scripting caused by improper validation of input before storage, enabling an authenticated, remote attacker to inject malicious HTML/script that can be used in subsequent XSS...

CVE-2022-20967

A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to conduct cross-site scripting attacks against other users of the application web-based management interface. This vulnerability is due to improper validation of...

CVE-2022-20964

A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system. This vulnerability is due to improper validation of user input within requests as part of the...

CVE-2022-20964

Cisco Identity Services Engine (ISE) web-based management interface vulnerability CVE-2022-20964 allows an authenticated, remote attacker to inject arbitrary OS commands due to improper input validation. Exploitation would run commands with the web services user’s privileges. The primary CVE reco...

CVE-2022-20966

Cisco Identity Services Engine (ISE) web-based management interface is affected by a stored XSS flaw due to improper input validation before storage. An authenticated, remote attacker could inject malicious HTML/script via entries created in the interface, enabling XSS against other users. Affect...

CVE-2022-20966

A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to conduct cross-site scripting attacks against other users of the application web-based management interface. This vulnerability is due to improper validation of...

CVE-2022-20965

CVE-2022-20965 concerns Cisco Identity Services Engine (ISE). The issue is improper access control in the web-based management interface, allowing an authenticated, remote attacker to perform privileged actions by sending direct requests that bypass internal checks. Affected product is Cisco ISE;...

CVE-2022-20964: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system. This vulnerability is due to improper validation of user input within requests as part of the...

CVE-2022-20967: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to conduct cross-site scripting attacks against other users of the application web-based management interface. This vulnerability is due to improper validation of...

CVE-2022-20966: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to conduct cross-site scripting attacks against other users of the application web-based management interface. This vulnerability is due to improper validation of...

CVE-2022-20965: Incorrect Use of Privileged APIs

A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to take privileges actions within the web-based management interface. This vulnerability is due to improper access control on a feature within the web-based...

Cisco Small Business Routers Vulnerable to Authentication Bypass and Remote Code Execution

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Multiple vulnerabilities were found in the web-based management interface of Cisco Small Business Routers. The authentication bypass vulnerability CVE-2023-20025 allows an unauthenticated attacker...

Cisco Issues Warning for Unpatched Vulnerabilities in EoL Business Routers

Cisco has warned of two security vulnerabilities affecting end-of-life EoL Small Business RV016, RV042, RV042G, and RV082 routers that it said will not be fixed, even as it acknowledged the public availability of proof-of-concept PoC exploit. The issues are rooted in the router's web-based...

Cisco Unified Intelligence Center Reflected Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. This vulnerability exists because the web-based management interface...

PT-2023-2551

Name of the Vulnerable Software and Affected Versions Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers versions prior to 2025-03-24 Cisco Small Business RV Series Routers versions prior to 2025-03-24 Description A vulnerability exists in the web-based management interfac...

PT-2023-1369 · Cisco · Cisco Broadworks Xtended Services Platform +2

Name of the Vulnerable Software and Affected Versions: Cisco BroadWorks Application Server affected versions not specified Cisco BroadWorks Xtended Services Platform affected versions not specified Cisco BroadWorks Application Delivery Platform affected versions not specified Description: The iss...

CVE-2022-45093

A vulnerability has been identified in SINEC INS All versions V1.0 SP2 Update 1. An authenticated remote attacker with access to the Web Based Management 443/tcp of the affected product as well as with access to the SFTP server of the affected product 22/tcp, could potentially read and write...

CVE-2022-45094

A vulnerability has been identified in SINEC INS All versions V1.0 SP2 Update 1. An authenticated remote attacker with access to the Web Based Management 443/tcp of the affected product, could potentially inject commands into the dhcpd configuration of the affected product. An attacker might...

Remote code execution

A vulnerability has been identified in SINEC INS All versions V1.0 SP2 Update 1. An authenticated remote attacker with access to the Web Based Management 443/tcp of the affected product, could potentially read and write arbitrary files from and to the device's file system. An attacker might...