Cisco IOS Software Secure Shell Connection on VRF (cisco-sa-20190109-ios-ssh-vrf)

According to its self-reported version, Cisco IOS Software is affected by a vulnerability in the access control logic of the Secure Shell SSH server due to a missing check in the SSH server. An authenticated, remote attacker can exploit this, by providing valid credentials to access a device in...

Cisco Unified Communications Manager SQL Injection Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web-based management interface improperly validates SQL values. ...

Cisco IOS XE Software REST API Authorization Bypass (cisco-sa-20180328-rest)

According to its self-reported version, Cisco IOS XE Software is affected by an authorization bypass vulnerability in the REST API due to insufficient authorization checks for requests that are sent to the REST API of the affected software. An authenticated, remote attacker can exploit this, by...

Cisco IOS XE Software Authentication, Authorization, and Accounting Login Authentication RCE (cisco-sa-20180606-aaa)

According to its self-reported version, Cisco IOS XE Software is affected by a remote code execution vulnerability in the authentication, authorization, and accounting AAA security services due to incorrect memory operations that the affected software performs when the software parses a username...

Cisco FXOS Software Command Injection (cisco-sa-20190306-nxos-cmdinj-1611)

According to its self-reported version, Cisco FXOS Software is affected by a command injection vulnerability due to insufficient validation of arguments passed to certain CLI commands. An authenticated, local attacker with valid administrator credentials can exploit this by including malicious...

Cisco Webex Network Recording Admin Page Privilege Escalation Vulnerability (cisco-sa-20191106-wbs-privilege)

According to its self-reported version, Cisco Webex Meetings is prior to 39.7.0. It is, therefore, affected by a privilege escalation vulnerability in its Network Recording Admin page due to insufficient access control validation. An authenticated, remote attacker could exploit this, by issuing...

Cisco IOS Software 802.1x Multiple-Authentication Port Authentication Bypass (cisco-sa-20180328-dot1x)

According to its self-reported version, Cisco IOS is affected by an authentication bypass vulnerability in the 802.1x multiple-authentication multi-auth feature due to a logic change error introduced into the code. An unauthenticated, adjacent attacker could exploit this, by trying to access an...

Cisco IOS XE Software User EXEC Mode Root Shell Access Multiple Vulnerabilities (cisco-sa-20180328-privesc1)

According to its self-reported version, Cisco IOS XE Software is affected by multiple vulnerabilities in the CLI parser due to improper sanitization of command arguments to prevent access to internal data structures on a device. An authenticated, local attacker with user EXEC mode access to an...

Cisco IOS XE Software Internet Group Management Protocol Memory Leak (cisco-sa-20180328-igmp)

According to its self-reported version, Cisco IOS XE Software is affected by a denial of service DoS vulnerability in the Internet Group Management Protocol IGMP packet-processing functionality. An unauthenticated, adjacent attacker can exploit this, by sending a large number of IGMP Membership...

Cisco IOS XE Software with Cisco Umbrella Integration DoS (cisco-sa-20180328-opendns-dos)

According to its self-reported version, Cisco IOS XE Software is affected by a denial of service DoS vulnerability in the Cisco Umbrella Integration feature due to a logic error that exists when handling a malformed incoming packet, leading to access to an internal data structure after it has bee...

Cisco IOS Software Internet Key Exchange Memory Leak (cisco-sa-20180328-ike)

According to its self-reported version, Cisco IOS is affected by a denial of service DoS vulnerability in the Internet Key Exchange Version 2 IKEv2 module due to incorrect processing of certain IKEv2 packets. An unauthenticated, remote attacker can exploit this, by sending crafted IKEv2 packets t...

Cisco IOS XE Software Internet Key Exchange Memory Leak (cisco-sa-20180328-ike)

According to its self-reported version, Cisco IOS XE Software is affected by a denial of service DoS vulnerability in the Internet Key Exchange Version 2 IKEv2 module due to incorrect processing of certain IKEv2 packets. An unauthenticated, remote attacker can exploit this, by sending crafted IKE...

Cisco NX-OS Software OSPF LSA Manipulation (cisco-sa-20170727-ospf)

According to its self-reported version, Cisco NX-OS Software is affected by a vulnerability involving the Open Shortest Path First OSPF Routing Protocol Link State Advertisement LSA database. An unauthenticated, remote attacker can exploit this, by injecting crafted OSPF LSA type 1 packets, to...

Cisco IOS OSPF LSA Manipulation (cisco-sa-20170727-ospf)

According to its self-reported version, Cisco IOS is affected by a vulnerability involving the Open Shortest Path First OSPF Routing Protocol Link State Advertisement LSA database. An unauthenticated, remote attacker can exploit this, by injecting crafted OSPF LSA type 1 packets, to cause the...

Cisco Adaptive Security Appliance Software OSPF LSA Manipulation (cisco-sa-20170727-ospf)

According to its self-reported version, Cisco Adaptive Security Appliance ASA Software is affected by a vulnerability involving the Open Shortest Path First OSPF Routing Protocol Link State Advertisement LSA database. An unauthenticated, remote attacker can exploit this, by injecting crafted OSPF...

Cisco IOS Software Smart Install DoS (cisco-sa-20180328-smi)

According to its self-reported version, Cisco IOS is affected by a denial of service DoS vulnerability in the Smart Install feature due to improper validation of packet data. An unauthenticated, remote attacker can exploit this by sending a crafted packet to an affected device on TCP port 4786 in...

Cisco Firepower Threat Defense RCE (cisco-sa-20191112-asa-ftd-lua-rce)

A remote code execution vulnerability exists in the Lua interpreter of Cisco Firepower Threat Defense FTD software due to insufficient restrictions on the allowed Lua function calls within the context of user-supplied Lua scripts. An authenticated, remote attacker can exploit this to bypass...

Cisco IOS XE Wireless Controller Manager DoS (cisco-sa-20170927-ios-xe)

According to its self-reported version, Cisco IOS XE Software is affected by a denial of service DoS vulnerability due to insufficient input validation in the wireless controller manager. An unauthenticated, adjacent attacker can exploit this, by submitting a crated association request, to cause...

Cisco Adaptive Security Appliance RCE (cisco-sa-20191112-asa-ftd-lua-rce)

A remote code execution vulnerability exists in the Lua interpreter of Cisco Adaptive Security Appliance ASA software due to insufficient restrictions on the allowed Lua function calls within the context of user-supplied Lua scripts. An authenticated, remote attacker can exploit this to bypass...

Cisco IOS XE Software Autonomic Networking Infrastructure DoS (cisco-sa-20170726-anidos)

According to its self-reported version, Cisco IOS XE Software is affected by a denial of service DoS vulnerability in the Autonomic Networking feature. An unauthenticated, adjacent attacker can exploit this by replaying captured packets to reset the Autonomic Control Plane ACP channel of an...