CVE-2018-0092

CVE-2018-0092 affects Cisco NX-OS System Software on Nexus platforms (Nexus 3000/3600/9000 standalone NX-OS and Nexus 9500 R-series line cards/fabric modules). The root cause is insufficient RBAC checks for the network-operator role, allowing an authenticated, local attacker to delete other confi...

CVE-2018-0086

A vulnerability in the application server of the Cisco Unified Customer Voice Portal CVP could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on the affected device. The vulnerability is due to malformed SIP INVITE traffic received on the CVP during...

CVE-2018-0086

CVE-2018-0086 affects Cisco Unified CVP (Cisco Unified Customer Voice Portal). The issue is triggered by malformed SIP INVITE traffic during CVP communications with the Cisco Virtualized Voice Browser (VVB), allowing an unauthenticated remote attacker to cause a denial of service on the affected ...

CVE-2018-0108

Cisco WebEx Meetings Server is affected by an XML External Entity (XXE) injection allowing an unauthenticated, remote attacker to perform out-of-band data exfiltration. The vulnerability enables disclosure of customer files and can be leveraged to gather information for reconnaissance, with the a...

CVE-2018-0092

A vulnerability in the network-operator user role implementation for Cisco NX-OS System Software could allow an authenticated, local attacker to improperly delete valid user accounts. The network-operator role should not be able to delete other configured users on the device. The vulnerability is...

CVE-2018-0099

The CVE-2018-0099 entry concerns Cisco D9800 Network Transport Receiver, where the web management GUI is vulnerable to a command injection due to insufficient validation of GUI command arguments. An authenticated remote attacker could inject crafted GUI parameters to execute commands on the under...

CVE-2018-0107

Cisco Prime Service Catalog’s web framework contains a CSRF vulnerability (CVE-2018-0107) that could allow an unauthenticated, remote attacker to perform unwanted actions due to missing CSRF protection. The issue is documented across multiple sources (NVD/CVE entry, CNVD, CNVD CISCO advisory), wi...

CVE-2018-0095

A vulnerability in the administrative shell of Cisco AsyncOS on Cisco Email Security Appliance ESA and Content Security Management Appliance SMA could allow an authenticated, local attacker to escalate their privilege level and gain root access. The attacker has to have a valid user credential wi...

CVE-2018-0097

A vulnerability in the web interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to redirect a user to a malicious web page, aka an Open Redirect. The vulnerability is due to improper input validation of the parameters in the HTTP request. An attacker could explo...

CVE-2018-0099

A vulnerability in the web management GUI of the Cisco D9800 Network Transport Receiver could allow an authenticated, remote attacker to perform a command injection attack. The vulnerability is due to insufficient input validation of GUI command arguments. An attacker could exploit this...

CVE-2018-0098

CVE-2018-0098 affects Cisco WAP150 and WAP361 devices, where the web-based management interface is vulnerable to cross-site scripting due to insufficient validation of user input. An unauthenticated, remote attacker can lure a user into clicking a crafted link, enabling arbitrary script execution...

CVE-2018-0107

A vulnerability in the web framework of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to execute unwanted actions on an affected device. The vulnerability is due to a lack of cross-site request forgery CSRF protection. An attacker could exploit this vulnerability by...

CVE-2018-0095

A vulnerability in the administrative shell of Cisco AsyncOS on Cisco Email Security Appliance ESA and Content Security Management Appliance SMA could allow an authenticated, local attacker to escalate their privilege level and gain root access. The attacker has to have a valid user credential wi...

CVE-2018-0096

A vulnerability in the role-based access control RBAC functionality of Cisco Prime Infrastructure could allow an authenticated, remote attacker to perform a privilege escalation in which one virtual domain user can view and modify another virtual domain configuration. The vulnerability is due to ...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to perform a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due to...

CVE-2018-0104

A vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format ARF files could allow a remote attacker to execute arbitrary code on the system of a targeted user. The attacker could exploit this vulnerability by sending the user a link or email attachment with a malicious A...

CVE-2018-0103

A Buffer Overflow vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format ARF files could allow a local attacker to execute arbitrary code on the system of a user. The attacker could exploit this vulnerability by sending the user a link or email attachment with a...

CVE-2018-0103

CVE-2018-0103 describes a buffer overflow in Cisco WebEx Network Recording Player when parsing ARF files, permitting arbitrary code execution with local access (per NVD) and potentially remote exploitation via crafted ARF content (per ZDI). Affected: Cisco WebEx Network Recording Player and relat...

CVE-2018-0103

A Buffer Overflow vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format ARF files could allow a local attacker to execute arbitrary code on the system of a user. The attacker could exploit this vulnerability by sending the user a link or email attachment with a...

CVE-2018-0103

A Buffer Overflow vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format ARF files could allow a local attacker to execute arbitrary code on the system of a user. The attacker could exploit this vulnerability by sending the user a link or email attachment with a...