CVE-2018-0398

CVE-2018-0398 affects Cisco Finesse Web-based management interface. The issue is an unauthenticated SSRF vulnerability (server-side request forgery) that could allow remote attackers to trigger unintended requests from the Cisco Finesse server. The connected sources (Cisco Security Advisory and N...

CVE-2018-0399

Cisco Finesse suffers an information-disclosure vulnerability in its web-based management interface that could let an unauthenticated, remote attacker retrieve cleartext passwords. Multiple sources (NVD entry CVE-2018-0399; Cisco security advisory cisco-sa-20180718-finesse; Nessus plugin) describ...

CVE-2018-0400

CVE-2018-0400 concerns Cisco Unified Contact Center Express (Unified CCX) and its web-based management interface. The connected documents confirm a cross-site scripting (XSS) vulnerability that could be exploited by an unauthenticated, remote attacker who entices a user to click a crafted link, e...

Multiple Vulnerabilities in Cisco Unified Contact Center Express

Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express Unified CCX could allow an unauthenticated, remote attacker to conduct cross-site scripting XSS attacks against a user of the interface, conduct a cross-site request forgery CSRF attack, or...

Multiple Vulnerabilities in Cisco Finesse

Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a server-side request forgery SSRF attack or retrieve a cleartext password from an affected system. For more information about these vulnerabilities, see the...

CVE-2018-0366

CVE-2018-0366 affects Cisco Web Security Appliance (WSA) and concerns a reflected cross-site scripting (XSS) vulnerability in the web-based management interface caused by insufficient input validation. An unauthenticated, remote attacker could lure a user to click a crafted link, resulting in arb...

Information Disclosure in the PAN-OS Management Web Interface

A local privilege escalation vulnerability exists in the PAN-OS management web interface that allows the administrator to access the password hashes of local users by manipulating the HTML markup. Ref. PAN-91564; CVE-2018-9334 Successful exploitation of this issue requires the attacker to be...

CVE-2018-0363

A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service formerly CUPS could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. The...

CVE-2018-0365

A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF...

Cross site request forgery (csrf)

A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service formerly CUPS could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. The...

Cross site request forgery (csrf)

A vulnerability in the web-based management interface of Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CS...

Session fixation

A vulnerability in the session identification management functionality of the web-based management interface for Cisco Meeting Server could allow an unauthenticated, local attacker to hijack a valid user session identifier, aka Session Fixation. The vulnerability exists because the affected...

CVE-2018-0364

A vulnerability in the web-based management interface of Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CS...

CVE-2018-0359

Cisco Meeting Server web-based management interface is affected by a Session Fixation vulnerability (CVE-2018-0359). Root cause: the app does not refresh the session identifier upon user authentication, enabling a local attacker to hijack an authenticated user’s browser session via a hijacked ses...

CVE-2018-0359

A vulnerability in the session identification management functionality of the web-based management interface for Cisco Meeting Server could allow an unauthenticated, local attacker to hijack a valid user session identifier, aka Session Fixation. The vulnerability exists because the affected...

CVE-2018-0363

CVE-2018-0363 affects Cisco Unified Communications Manager IM & Presence Service (CUCM/IM & Presence). The issue is a CSRF vulnerability due to insufficient protections in the web-based management interface, allowing an unauthenticated remote attacker to convince a user to click a crafted link an...

CVE-2018-0365

A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF...

CVE-2018-0363

A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service formerly CUPS could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. The...

CVE-2018-0364

Cisco Unified Communications Domain Manager is affected by a CSRF vulnerability in its web-based management interface. The issue arises from insufficient CSRF protections, allowing an unauthenticated or user-trresent remote attacker to coax a logged-in user to click a crafted link and perform arb...

CVE-2018-0359

A vulnerability in the session identification management functionality of the web-based management interface for Cisco Meeting Server could allow an unauthenticated, local attacker to hijack a valid user session identifier, aka Session Fixation. The vulnerability exists because the affected...