Cisco IOS XE Software Arbitrary File Upload Vulnerability

A vulnerability in the web UI framework of Cisco IOS XE Software could allow an authenticated, remote attacker to make unauthorized changes to the filesystem of the affected device. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by crafting a...

Cisco IOS XE Software Privilege Escalation Vulnerability

A vulnerability in the authorization subsystem of Cisco IOS XE Software could allow an authenticated but unprivileged level 1, remote attacker to run privileged Cisco IOS commands by using the web UI. The vulnerability is due to improper validation of user privileges of web UI users. An attacker...

Cisco IOS and IOS XE Software Smart Call Home Certificate Validation Vulnerability

A vulnerability in the Cisco Smart Call Home feature of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data using an invalid certificate. The vulnerability is due to insufficient certificate validation by the affected...

Cisco IOS XE Software Information Disclosure Vulnerability

A vulnerability in the web UI of Cisco IOS XE Software could allow an unauthenticated, remote attacker to access sensitive configuration information. The vulnerability is due to improper access control to files within the web UI. An attacker could exploit this vulnerability by sending a malicious...

Cisco IOS XE Software Command Injection Vulnerability

A vulnerability in Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability occurs because the affected software improperly sanitizes user-supplied input. An attacker who has...

Cisco IOS XE Software Gigabit Ethernet Management Interface Access Control List Bypass Vulnerability

A vulnerability in access control list ACL functionality of the Gigabit Ethernet Management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to reach the configured IP addresses on the Gigabit Ethernet Management interface. The vulnerability is due to a logic err...

Cisco IOS and IOS XE Software Information Disclosure Vulnerability

A vulnerability in the Secure Storage feature of Cisco IOS and IOS XE Software could allow an authenticated, local attacker to access sensitive system information on an affected device. The vulnerability is due to improper memory operations performed at encryption time, when affected software...

Cisco IOS XE Software Command Injection Vulnerability

A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with elevated privileges. The vulnerability is due to insufficient input validation of commands supplied by the user. An attacker could exploit this vulnerability b...

Cisco IOS and IOS XE Software Short Message Service Denial of Service Vulnerability

A vulnerability in the implementation of the Short Message Service SMS handling functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a denial of service DoS condition on an affected device. The vulnerability is due to improper...

PT-2019-1711

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated but unprivileged remote attacker to run privileged Cisco IOS commands by using the web UI. Th...

CVE-2019-1748: Improper Certificate Validation

A vulnerability in the Cisco Network Plug-and-Play PnP agent of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data. The vulnerability exists because the affected software insufficiently validates certificates...

PT-2019-1736

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description A vulnerability in Performance Routing Version 3 PfRv3 of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the affected device to reload. The...

PT-2019-1737

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description The issue exists due to insufficient input validation in the Web Services Management Agent WSMA component of Cisco IOS XE Software. This allows a remote attacker to execute...

PT-2019-1707

Name of the Vulnerable Software and Affected Versions Cisco IOS Software and Cisco IOS XE Software affected versions not specified Description A vulnerability in the Cluster Management Protocol CMP processing code could allow an unauthenticated, adjacent attacker to trigger a denial of service Do...

CVE-2019-1742: Undefined Security Weakness

A vulnerability in the web UI of Cisco IOS XE Software could allow an unauthenticated, remote attacker to access sensitive configuration information. The vulnerability is due to improper access control to files within the web UI. An attacker could exploit this vulnerability by sending a malicious...

CVE-2019-1741: Improper Input Validation

A vulnerability in the Cisco Encrypted Traffic Analytics ETA feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to a logic error that exists when handling a malformed incoming packet, leading to...

CVE-2019-1746: Improper Input Validation

A vulnerability in the Cluster Management Protocol CMP processing code in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to trigger a denial of service DoS condition on an affected device. The vulnerability is due to insufficient input validation wh...

PT-2019-1715

Name of the Vulnerable Software and Affected Versions Cisco IOS Software and Cisco IOS XE Software affected versions not specified Description A vulnerability in the Network-Based Application Recognition NBAR feature could allow an unauthenticated, remote attacker to cause an affected device to...

PT-2019-1710

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description A vulnerability in the authorization subsystem of Cisco IOS XE Software could allow an authenticated but unprivileged remote attacker to run privileged Cisco IOS commands by usi...

PT-2019-1705

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with elevated privileges. The vulnerability ...