Cisco Unified Computing System (UCS) Central Software Improper Certificate Validation (cisco-sa-ucs-invcert-eOpRvCKH)

According to its self-reported version, Cisco Unified Computing System Central Software is affected by an improper certificate validation vulnerability. An authenticated, adjacent attacker could exploit this, by sending a crafted HTTP request to the registration API, to register a rogue Cisco UCS...

Cisco Small Business RV Series Routers Multiple Vulnerabilities (cisco-sa-rv160-260-filewrite-7x9mnKjn)

According to its self-reported version, Cisco Small Business RV Series Router Firmware is affected by multiple directory traversal and arbitrary file write vulnerabilities. An unauthenticated, remote attack could exploit these, by sending crafted requests, to access files outside of the web root ...

Cisco Firepower Threat Defense Snort Application Detection Engine Policy Bypass (cisco-sa-snort-app-bypass-cSBYCATq)

According to its self-reported version, Cisco Firepower Threat Defense is affected by a vulnerability in the UTD SNORT IPS detection engine due to a flaw in the detection algorithm. An unauthenticated, remote attacker can exploit this by sending crafted packets that would flow through an affected...

Cisco IOS XE Products Snort Application Detection Engine Policy Bypass (cisco-sa-snort-app-bypass-cSBYCATq)

According to its self-reported version, Cisco IOS XE is affected by a vulnerability in the UTD SNORT IPS detection engine due to a flaw in the detection algorithm. An unauthenticated, remote attacker can exploit this by sending crafted packets that would flow through an affected system. A...

Cisco Unified Communications Products Vulnerabilities (cisco-sa-imp-trav-inj-dM687ZD6)

According to its self-reported version, multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service Unified CM IM&P could allow an attacker to conduct path traversal attacks and SQL injection attacks on an affected system. One of the SQL injection vulnerabilities that...

Cisco ASA Software Firepower Chassis Manager XSRF (cisco-sa-fxosfcm-csrf-uhO4e5BZ)

According to its self-reported version, Cisco Adaptive Security Appliance Software is affected by a cross-site request forgery vulnerability. The vulnerability is due to insufficient CSRF protections for the FCM interface. An unauthenticated, remote attacker can exploit this vulnerability by...

Cisco SD-WAN DoS (cisco-sa-sdwan-dosmulti-48jJuEUP)

According to its self-reported version, Cisco SD-WAN is affected by multiple vulnerabilities, including the following: - A denial of service DoS vulnerability exists in the VPN tunneling features of Cisco SD-WAN Software due to insufficient handling of malformed packets. An unauthenticated, remot...

Cisco Email Security Appliance Information Disclosure (cisco-sa-esa-wsa-sma-info-RHp44vAC)

According to its self-reported version, Cisco Email Security Appliance ESA is affected by a vulnerability in the authentication for the general purpose APIs due to the absence of a secure authentication token requirement when authenticating to the general purpose API. An unauthenticated, remote...

Cisco SD-WAN vManage SQLi (cisco-sa-vman-sqlinjm-xV8dsjq5)

According to its self-reported version, Cisco SD-WAN vManage is affected by a SQL Injection SQLi vulnerability in the web-based management interface due to improperly validating values in SQL queries. An authenticated, remote attacker can exploit this, by authenticating to the application and...

Cisco Content Security Management Appliance Information Disclosure (cisco-sa-esa-wsa-sma-info-RHp44vAC)

According to its self-reported version, Cisco Content Security Management Appliance SMA is affected by a vulnerability in the authentication for the general purpose APIs due to the absence of a secure authentication token requirement when authenticating to the general purpose API. An...

Cisco Jabber for Windows Multiple Vulnerbilities (cisco-sa-jabber-ZktzjpgO)

According to its self-reported version, Cisco Jabber is affected by multiple vulnerabilities which could allow a remote, authenticated attacker to execute arbitrary programs on the underlying operating system with elevated privileges or gain access to sensitive information. Please see the include...

Cisco Webex Meetings Information Disclosure (cisco-sa-webex-infodisc-4tvQzn4)

According to its self-reported version, Cisco Webex Meetings is affected by a information disclosure vulnerability. This vulnerability is due to insufficient protection of sensitive participant information. An unauthenticated, remote attacker could exploit this vulnerability by browsing the Webex...

Cisco Identity Services Engine Cross-Site Scripting (cisco-sa-ise-xxs-pkjCmq9d)

According to its self-reported version, Cisco Identity Services Engine Software is affected by a cross-site scripting XSS vulnerability. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An authenticated, remote attacker could...

Cisco IOS XE Software Packet Filtering Bypass (cisco-sa-cedge-filt-bypass-Y6wZMqm4)

According to its self-reported version, Cisco IOS XE is affected by a packet filtering bypass vulnerability. The vulnerability is due to improper traffic filtering conditions on an affected device. An unauthenticated, remote attacker could exploit this vulnerability by crafting a malicious TCP...

Cisco Integrated Management Controller RCE (cisco-sa-ucs-api-rce-UXwpeDHd)

According to its self-reported version, Cisco Unified Computing System E-Series Software UCSE is affected by multiple remote code execution RCE vulnerabilities in the API subsystem due to improper boundary checks for certain user-supplied input. An unauthenticated, remote attacker can exploit...

Cisco IOS XE Software IOx Application Hosting Privilege Escalation (cisco-sa-iosxe-iox-app-host-mcZcnsBt)

According to its self-reported version, Cisco IOS XE Software is affected by a privilege escalation vulnerability in the application-hosting subsystem due to incomplete input validation of the user payload of CLI commands and improper role-based access control when commands are issued at the...

Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (cisco-sa-webex-nbr-NOS6FQ24)

According to its self-reported version, Cisco Webex Network Recording Player for Windows and Cisco Webex player for Windows are affected by multiple arbitrary code execution vulnerabilities due to insufficient validation of certain elements of a Webex recording that is stored in the Advanced...

Cisco AnyConnect Secure Mobility Client for Windows Arbitrary File Read (cisco-sa-anyconnect-file-read-LsvDD6Uh)

According to its self-reported version, Cisco AnyConnect Secure Mobility Client is affected by a arbitrary file read vulnerability. The vulnerability is due to an exposed IPC function. An unauthenticated, local attacker could exploit this vulnerability by sending a crafted IPC message to the...

Cisco IOS XR RCE (cisco-sa-iosxr-pxe-unsign-code-exec-qAa78fD2)

According to its self-reported version, IOS-XR is affected by a remote code execution vulnerability in the enhanced Preboot eXecution Environment PXE boot loader due to a failure to verify commands issued during a network boot. An unauthenticated, remote attacker can exploit this to execute...

Cisco Webex Teams Web Interface Cross-Site Scripting Vulnerability Vulnerability (cisco-sa-webex-teams-xss-zLW9tD3)

According to its self-reported version, Cisco Webex Teams is affected by a vulnerability. The vulnerability is due to improper validation of usernames. An attacker could exploit this vulnerability by creating an account that contains malicious HTML or script content and joining a space using the...