PT-2019-3365

Name of the Vulnerable Software and Affected Versions Cisco IOS XE and Cisco IOS affected versions not specified Description The issue is related to a lack of authentication in the Layer 2 Traceroute utility of Cisco IOS XE and Cisco IOS operating systems. This could allow a remote attacker to...

CVE-2019-12666: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in the Guest Shell of Cisco IOS XE Software could allow an authenticated, local attacker to perform directory traversal on the base Linux operating system of Cisco IOS XE Software. The vulnerability is due to incomplete validation of certain commands. An attacker could exploit thi...

PT-2019-3339

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description The issue is related to insufficient file location validation in the filesystem of Cisco IOS XE Software, which could allow an authenticated, local attacker with physical access...

PT-2019-3327

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description The issue is related to the absence of digital signature verification for system image files during the boot process in Cisco IOS XE Software. This could allow an authenticated,...

PT-2019-3332

Name of the Vulnerable Software and Affected Versions Cisco NX-OS Software affected versions not specified Cisco IOS XE Software affected versions not specified Description A vulnerability in Cisco NX-OS Software and Cisco IOS XE Software could allow an authenticated, local attacker with valid...

PT-2019-3335

Name of the Vulnerable Software and Affected Versions Cisco NX-OS Software affected versions not specified Cisco IOS XE affected versions not specified Description The issue exists due to insufficient validation of arguments passed to a specific command related to the virtualization manager VMAN ...

PT-2019-3320

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description The issue is related to insufficient argument validation in the web-based user interface Web UI of Cisco IOS XE Software. This could allow an authenticated, remote attacker to...

CVE-2019-12670: Improper Access Control

A vulnerability in the filesystem of Cisco IOS XE Software could allow an authenticated, local attacker within the IOx Guest Shell to modify the namespace container protections on an affected device. The vulnerability is due to insufficient file permissions. An attacker could exploit this...

CVE-2019-12668: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web framework code of Cisco IOS and Cisco IOS XE Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the web interface of the affected software using the banner parameter. The vulnerability is due to...

CVE-2019-12672: Improper Link Resolution Before File Access

A vulnerability in the filesystem of Cisco IOS XE Software could allow an authenticated, local attacker with physical access to an affected device to execute arbitrary code on the underlying operating system OS with root privileges. The vulnerability is due to insufficient file location validatio...

CVE-2019-12660: Exposure of Resource to Wrong Sphere

A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to write values to the underlying memory of an affected device. The vulnerability is due to improper input validation and authorization of specific commands that a user can execute within the CLI. An...

CVE-2019-12658: Uncontrolled Resource Consumption

A vulnerability in the filesystem resource management code of Cisco IOS XE Software could allow an unauthenticated, remote attacker to exhaust filesystem resources on an affected device and cause a denial of service DoS condition. The vulnerability is due to ineffective management of the underlyi...

CVE-2019-12667: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web framework code of Cisco IOS XE Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the web interface of the affected software. The vulnerability is due to insufficient input validation of some...

CVE-2019-12651: Improper Neutralization of Special Elements used in a Command

Multiple vulnerabilities in the web-based user interface Web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands with elevated privileges on the affected device. For more information about these vulnerabilities, see the Details section of this advisory...

CVE-2019-12650: Improper Neutralization of Special Elements used in a Command

Multiple vulnerabilities in the web-based user interface Web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands with elevated privileges on the affected device. For more information about these vulnerabilities, see the Details section of this advisory...

CVE-2019-12649: Improper Verification of Cryptographic Signature

A vulnerability in the Image Verification feature of Cisco IOS XE Software could allow an authenticated, local attacker to install and boot a malicious software image or execute unsigned binaries on an affected device. The vulnerability exists because, under certain circumstances, an affected...

CVE-2019-12657: Improper Input Validation

A vulnerability in Unified Threat Defense UTD in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to improper validation of IPv6 packets through the UTD feature. An attacker could exploit this vulnerability by...

CVE-2019-12653: Improper Input Validation

A vulnerability in the Raw Socket Transport feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service DoS condition. The vulnerability is due to improper parsing of Raw Socket Transport payloads. An...

PT-2019-3331

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description The issue is related to insufficient validation of arguments passed to a specific Virtualization Manager VMAN CLI command, allowing an authenticated, local attacker to execute...

CVE-2019-12663: Improper Input Validation

A vulnerability in the Cisco TrustSec CTS Protected Access Credential PAC provisioning module of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device, resulting in a denial of service DoS condition. The vulnerability is due to improper...