Xxe

A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to collect customer files via an out-of-band XML External Entity XXE injection. An attacker could exploit this vulnerability to gain information to conduct additional reconnaissance attacks. The...

CVE-2017-12308

A vulnerability in the web framework of Cisco Small Business Managed Switches software could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation ...

CVE-2018-0097

A vulnerability in the web interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to redirect a user to a malicious web page, aka an Open Redirect. The vulnerability is due to improper input validation of the parameters in the HTTP request. An attacker could explo...

CVE-2018-0091

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a Document Object Model DOM cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The...

CVE-2017-12308

A vulnerability in the web framework of Cisco Small Business Managed Switches software could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation ...

CVE-2018-0094

A vulnerability in IPv6 ingress packet processing for Cisco UCS Central Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition due to high CPU utilization on the targeted device. The vulnerability is due to insufficient rate limiting protection for IPv...

CVE-2018-0098

A vulnerability in the web-based management interface of Cisco WAP150 Wireless-AC/N Dual Radio Access Point with Power over Ethernet PoE and WAP361 Wireless-AC/N Dual Radio Wall Plate Access Point with PoE could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attac...

CVE-2018-0107

A vulnerability in the web framework of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to execute unwanted actions on an affected device. The vulnerability is due to a lack of cross-site request forgery CSRF protection. An attacker could exploit this vulnerability by...

CVE-2018-0105

The CVE-2018-0105 entry describes an information-disclosure flaw in the web framework of Cisco Unified Communications Manager (CUCM). The root cause is insufficient protection of database tables, allowing an unauthenticated, remote attacker to view data by visiting a specific URL. Affected compon...

CVE-2018-0111

A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to access sensitive data about the application. An attacker could exploit this vulnerability to gain information to conduct additional reconnaissance attacks. The vulnerability is due to a design flaw i...

CVE-2018-0088

The CVE-2018-0088 issue affects Cisco Industrial Ethernet 4010 Series Switches running Cisco IOS Software. It stems from a diagnostic test CLI command that allows writing to device memory, enabling an authenticated local attacker (privilege level 15) to cause arbitrary code execution or a denial ...

CVE-2018-0091

Cisco ISE DOM-based XSS (CVE-2018-0091) affects the web-based management interface of Cisco Identity Services Engine. The vulnerability arises from insufficient validation of user-supplied input, allowing an unauthenticated, remote attacker to entice a user to click a malicious link and run arbit...

CVE-2018-0092

A vulnerability in the network-operator user role implementation for Cisco NX-OS System Software could allow an authenticated, local attacker to improperly delete valid user accounts. The network-operator role should not be able to delete other configured users on the device. The vulnerability is...

CVE-2017-12307

A vulnerability in the web framework of Cisco Small Business Managed Switches software could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input...

CVE-2018-0108

A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to collect customer files via an out-of-band XML External Entity XXE injection. An attacker could exploit this vulnerability to gain information to conduct additional reconnaissance attacks. The...

CVE-2017-12307

A vulnerability in the web framework of Cisco Small Business Managed Switches software could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input...

CVE-2018-0097

CVE-2018-0097 affects Cisco Prime Infrastructure web interface. An unauthenticated remote attacker could exploit improper input validation to cause the app to redirect users to a malicious URL (open redirect). Connected sources confirm the vulnerability in the web interface and cite the Cisco adv...

CVE-2018-0105

A vulnerability in the web framework of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to view sensitive data. The vulnerability is due to insufficient protection of database tables. An attacker could exploit this vulnerability by browsing to a specific URL. ...

CVE-2018-0106

CVE-2018-0106 affects the Cisco Elastic Services Controller (ESC) and its embedded ConfD server . The vulnerability is due to insufficient security restrictions in the ConfD directory/file structure, enabling an unauthenticated, local attacker to view sensitive information on the targeted system....

CVE-2018-0090

A vulnerability in management interface access control list ACL configuration of Cisco NX-OS System Software could allow an unauthenticated, remote attacker to bypass configured ACLs on the management interface. This could allow traffic to be forwarded to the NX-OS CPU for processing, leading to...