CVE-2018-0140

A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance could allow an authenticated, remote attacker to download any message from the spam quarantine by modifying browser string information. The vulnerability is due to a lack of...

CVE-2018-0125

A vulnerability in the web interface of the Cisco RV132W ADSL2+ Wireless-N VPN and RV134W VDSL2 Wireless-AC VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system, including issuing commands with root privileges. The...

CVE-2018-0120

CVE-2018-0120 affects Cisco Unified Communications Manager (CUCM) web framework. The vulnerability arises from inadequate validation of user-supplied input in certain SQL queries, enabling an authenticated, remote attacker to perform SQL injection via crafted HTTP requests. Successful exploitatio...

CVE-2018-0125

CVE-2018-0125 affects Cisco RV132W/RV134W routers. The web interface suffers from incomplete input validation in HTTP requests, allowing an unauthenticated attacker to execute arbitrary code with root privileges or trigger a device reload (DoS). Affected products: RV132W ADSL2+ Wireless-N VPN Rou...

CVE-2018-0129

CVE-2018-0129 is a reflected cross-site scripting (XSS) vulnerability in Cisco Data Center Analytics Framework (DCAF) web-based management interface. Unauthenticated, remote attacker could lure a user to click a crafted link, triggering arbitrary script execution in the user’s browser context or ...

CVE-2018-0132

Cisco IOS XR Software is affected by CVE-2018-0132 due to a flaw in the FIB code where extremely long routing updates can cause inconsistency between the FIB and RIB. This unauthenticated, remote-triggered condition could lead to a DoS. The root cause is incorrect processing of large routing upda...

CVE-2018-0122

A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series Aggregation Services Routers could allow an authenticated, local attacker to overwrite system files that are stored in the flash memory of an affected system. The vulnerability is due to insufficient...

CVE-2018-0134

A vulnerability in the RADIUS authentication module of Cisco Policy Suite could allow an unauthenticated, remote attacker to determine whether a subscriber username is valid. The vulnerability occurs because the Cisco Policy Suite RADIUS server component returns different authentication failure...

CVE-2018-0134

The CVE-2018-0134 issue affects Cisco Policy Suite’s RADIUS authentication module, where an unauthenticated, remote attacker can deduce whether a subscriber username is valid by observing distinct authentication failure messages. This information disclosure vulnerability originates from the RADIU...

CVE-2018-0127

A vulnerability in the web interface of Cisco RV132W ADSL2+ Wireless-N VPN Routers and Cisco RV134W VDSL2 Wireless-AC VPN Routers could allow an unauthenticated, remote attacker to view configuration parameters for an affected device, which could lead to the disclosure of confidential information...

CVE-2018-0119

A vulnerability in certain authentication controls in the account services of Cisco Spark could allow an authenticated, remote attacker to interact with and view information on an affected device that would normally be prohibited. The vulnerability is due to the improper display of user-account...

CVE-2018-0135

CVE-2018-0135 describes an information-disclosure vulnerability in Cisco Unified Communications Manager (CUCM). The issue arises because the affected software improperly validates user-supplied search input, allowing an authenticated, remote attacker to send malicious requests and potentially ret...

CVE-2018-0135

A vulnerability in Cisco Unified Communications Manager could allow an authenticated, remote attacker to access sensitive information on an affected system. The vulnerability exists because the affected software improperly validates user-supplied search input. An attacker could exploit this...

CVE-2018-0137

CVE-2018-0137 affects Cisco Prime Network. The flaw is in the TCP throttling process due to insufficient rate limiting on TCP listening ports, enabling an unauthenticated, remote attacker to send high-rate TCP SYN packets to the device and cause memory exhaustion or to stop accepting new TCP conn...

CVE-2018-0123

CVE-2018-0123 describes a Path Traversal in Cisco IOS/IOS-XE diagnostic shell due to insufficient input validation, allowing an authenticated, local attacker to craft diagnostic shell input that could overwrite restricted system files. The vulnerability affects the diagnostic shell component and ...

CVE-2018-0119

CVE-2018-0119 describes an information-disclosure flaw in Cisco Spark’s account-service authentication controls. The issue stems from the improper display of user-account tokens, which could let an authenticated remote attacker log in with a token from another account and interact with or view re...

CVE-2018-0138

A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass file policies that are configured to block files transmitted to an affected device via the BitTorrent protocol. The vulnerability exists because the affected softwa...

CVE-2018-0127

Cisco RV132W/RV134W routers suffer an unauthenticated information-disclosure via the web interface due to missing authentication on confidential pages. An attacker can send crafted HTTP requests to view configuration data, including the administrator password. Affected devices: Cisco RV132W ADSL2...

CVE-2018-0116

CVE-2018-0116 describes an authentication bypass in Cisco Policy Suite’s RADIUS module. An unauthenticated, remote attacker could be authorized as a subscriber without a valid password, provided a valid username is used, due to incorrect RADIUS user credential validation. Affected are Cisco Polic...

CVE-2018-0136

CVE-2018-0136 affects Cisco IOS XR Software Release 5.3.4 on ASR 9000 Series with Trident-based line cards configured for IPv6. The issue is a DoS caused by improper handling of IPv6 packets with a fragment header extension, allowing an unauthenticated remote attacker to trigger a reload of one o...