CVE-2018-0384

A vulnerability in the detection engine of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass a URL-based access control policy that is configured to block traffic for an affected system. The vulnerability exists because the affected software incorrectly...

CVE-2018-0385

CVE-2018-0385 affects Cisco Firepower System Software: the detection engine’s SSL packet parsing can be mishandled, allowing an unauthenticated remote attacker to cause a DoS via Snort process restart. The issue stems from improper input handling of SSL traffic, with exploitation by sending craft...

CVE-2018-0341

CVE-2018-0341 affects Cisco IP Phone 6800/7800/8800 Series with Multiplatform Firmware prior to 11.2(1). The web UI allows authenticated, remote command injection due to insufficient input validation, enabling execution of arbitrary shell commands with web server privileges. Cisco Security Adviso...

CVE-2018-0373

A vulnerability in vpnva-6.sys for 32-bit Windows and vpnva64-6.sys for 64-bit Windows of Cisco AnyConnect Secure Mobility Client for Windows Desktop could allow an authenticated, local attacker to cause a denial of service DoS condition on an affected system. The vulnerability is due to improper...

CVE-2018-0313

CVE-2018-0313 involves a vulnerability in Cisco NX-OS NX-API where improper input validation allows an authenticated, remote attacker to send malicious HTTP/HTTPS packets to the management interface and execute arbitrary root commands. Affected are multiple Cisco platforms running NX-OS in standa...

CVE-2018-0300

Cisco FXOS on the Firepower 4100 Series NGFW and Firepower 9300 Security Appliance is affected by a path traversal vulnerability in the application image upload flow. Insufficient validation during image upload allows an authenticated, remote attacker to create or overwrite arbitrary files on the...

CVE-2018-0335

Cisco Prime Collaboration Provisioning is affected by an information-disclosure vulnerability in its Web portal authentication. The issue stems from improper logging of authentication data, allowing a local, unauthenticated attacker to monitor a world-readable file to obtain plaintext passwords a...

CVE-2018-0340

CVE-2018-0340 describes a cross-site scripting vulnerability in Cisco Unified Communications Manager (CUCM) web framework. The issue stems from insufficient input validation of web server parameters, enabling an authenticated, remote attacker to craft a malicious link or intercept user requests t...

CVE-2018-0355

Cisco CUCM Web UI is affected by a Cross-Frame Scripting (XFS) vulnerability due to insufficient iframe protections. An unauthenticated, remote attacker could lure a user to an attacker-controlled page containing a malicious iframe, enabling clickjacking or other client-side browser attacks on th...

CVE-2018-0336

The CVE-2018-0336 issue affects Cisco Prime Collaboration Provisioning’s batch provisioning feature. The root cause is insufficient authorization enforcement on batch processing, allowing an authenticated, remote attacker to upload a batch file and have it processed, which could escalate privileg...

CVE-2018-0149

A vulnerability in the web-based management interface of Cisco Integrated Management Controller Supervisor Software and Cisco UCS Director Software could allow an authenticated, remote attacker to conduct a Document Object Model-based DOM-based, stored cross-site scripting XSS attack against a us...

CVE-2018-0149

The CVE-2018-0149 entry affects Cisco Integrated Management Controller (IMC) Supervisor Software and Cisco UCS Director Software. The web-based management interface is vulnerable to DOM-based stored XSS caused by insufficient input validation. An authenticated, remote attacker can trick a user in...

Directory traversal

A vulnerability in the web interface of the Cisco Adaptive Security Appliance ASA could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service DoS condition. It is also possible on certain software releases that the ASA will...

Design/Logic Flaw

A vulnerability in the web interface of Cisco Prime Collaboration Provisioning PCP could allow an authenticated, remote attacker to escalate their privileges. The vulnerability is due to insufficient web portal access control checks. An attacker could exploit this vulnerability by modifying an...

CVE-2018-0263

A vulnerability in Cisco Meeting Server CMS could allow an unauthenticated, adjacent attacker to access services running on internal device interfaces of an affected system. The vulnerability is due to incorrect default configuration of the device, which can expose internal interfaces and ports o...

CVE-2018-0321

CVE-2018-0321 describes an unauthenticated remote access vulnerability in Cisco Prime Collaboration Provisioning (PCP) caused by an open port in the Network Interface and Configuration Engine (NICE) that exposes the Java RMI system. A remote attacker could access the RMI interface on affected PCP...

CVE-2018-0319

A vulnerability in the password recovery function of Cisco Prime Collaboration Provisioning PCP could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device. The vulnerability is due to insufficient validation of a password recovery request. An attacker could...

CVE-2018-0317

A vulnerability in the web interface of Cisco Prime Collaboration Provisioning PCP could allow an authenticated, remote attacker to escalate their privileges. The vulnerability is due to insufficient web portal access control checks. An attacker could exploit this vulnerability by modifying an...

CVE-2018-0320

A vulnerability in the web framework code of Cisco Prime Collaboration Provisioning PCP could allow an unauthenticated, remote attacker to execute arbitrary SQL queries. The vulnerability is due to a lack of proper validation on user-supplied input in SQL queries. An attacker could exploit this...

CVE-2018-0316

Cisco IP Phone 6800/7800/8800 Series with Multiplatform Firmware are affected by CVE-2018-0316, where improper handling of errors during incoming SIP calls can cause the device to reload and trigger a temporary DoS. Affected releases are Multiplatform Firmware prior to 11.1(2). Exploitation invol...