Cisco IOS XE Software Command Injection Vulnerability (cisco-sa-iosxe-cmdinj-2MzhjM6K)

According to its self-reported version, Cisco IOS XE Software is affected by a command injection vulnerability. The vulnerability is due to insufficient protection of values passed to a script that executes during device startup. An attacker could exploit this vulnerability by writing values to a...

Cisco IOS XE Software Web Management Framework Multiple Vulnerabilities (cisco-sa-ios-xe-webui-multi-vfTkk7yr)

Multiple vulnerabilities in the web management framework of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to gain unauthorized read access to sensitive data or cause the web management software to hang or crash, resulting in a denial of service DoS...

Cisco IOS XE Software Arbitrary Code Execution Vulnerability (cisco-sa-xbace-OnCEbyS)

According to its self-reported version, Cisco IOS XE Software is affected by a arbitrary code execution vulnerability, due to incorrect validations by boot scripts when specific ROM monitor ROMMON variables are set. An authenticated, local attacker could exploit this vulnerability by installing...

Cisco IOS XE Software Privilege Escalation Multiple Vulnerabilities (cisco-sa-ios-webui-priv-esc-K8zvEWM)

A vulnerability in the web-based user interface web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate their privileges on an affected device. Please see the included Cisco BIDs and Cisco Security Advisory for more information. TRUSTED...

CVE-2020-3416

Cisco IOS XE Software for Cisco ASR 900 Series Route Switch Processor 3 (RSP3) consoles a set of boot-time vulnerabilities in the initialization routines. The issues stem from incorrect validations in boot scripts when specific ROMMON variables are defined, enabling an authenticated, local attack...

CVE-2019-15992

A vulnerability in the implementation of the Lua interpreter integrated in Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, remote attacker to execute arbitrary code with root privileges on the underlying Linux operating...

Cisco Data Center Network Manager Cross-Site Request Forgery (cisco-sa-20200219-dcnm-csrf)

According to its self-reported version, Cisco Data Center Network Manager is prior to version 11.31 and is, therefore, affected by a cross-site request forgery vulnerability in the web-based management interface. An unauthenticated, remote attacker could exploit this vulnerability by persuading a...

Cisco Data Center Network Manager Stored Cross-Site Scripting (cisco-sa-20200219-dcnm-xss)

According to its self-reported version, Cisco Data Center Network Manager is prior to version 11.31 and is, therefore, affected by a cross-site scripting vulnerability in the web-based management interface due to insufficient validation of user-supplied input. An attacker could exploit this...

Cisco Email Security Appliance (ESA) Information Disclosure (cisco-sa-sma-wsa-esa-info-dis-vsvPzOHP)

According to its self-reported version, the Cisco Email Security Appliance ESA is affected by an information disclosure vulnerability in the web-based management interface of Cisco AsyncOS software due to the use of an insecure method to mask certain passwords on the web-based management interfac...

Cisco NX-OS Software Call Home Command Injection (cisco-sa-callhome-cmdinj-zkxzSCY)

According to its self-reported version, Cisco NX-OS Software is affected by a command injection vulnerability due to insufficient input validation of specific Call Home configuration parameters when configured for transport method HTTP. An authenticated, remote attacker could modify parameters...

Better email classification, courtesy of you

Cisco customers with Email Security Appliances ESA or Cloud Email Security CES accounts already know the benefits of Cisco’s email filtering. Every day, millions of malicious emails are automatically sent to the trash bin. Cisco encourages customers to participate in honing those filters by...

Cisco NX-OS Software (UCS) Data Management Engine Remote Code Execution (cisco-sa-nxos-dme-rce-cbE3nhZS)

According to its self-reported version, Cisco NX-OS Software UCS is affected by a remote code execution vulnerability. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted Cisco Discovery Protocol packet to a Layer 2-adjacent...

Cisco NX-OS Software Data Management Engine Remote Code Execution (cisco-sa-nxos-dme-rce-cbE3nhZS)

According to its self-reported version, Cisco NX-OS Software is affected by a remote code execution vulnerability. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted Cisco Discovery Protocol packet to a Layer 2-adjacent...

Cisco Data Center Network Manager Information Disclosure (cisco-sa-dcnm-infordisc-DOAXVvFV)

According to its self-reported version, Cisco Data Center Network Manager is affected by a vulnerability due to insufficient protection of confidential information. An authenticated, local attacker of any privilege level can exploit this, by accessing local filesystems and extracting sensitive da...

Cisco Data Center Network Manager XSS (cisco-sa-dcnm-xss-JnHSWG5C)

According to its self-reported version, Cisco Data Center Network Manager is affected by a vulnerability in the web-based management interface due to a failure to properly validate user-supplied input. An authenticated, remote attacker can exploit this, by persuading a user of the interface to...

Cisco Patches 'High-Severity' Bugs Impacting Switches, Fibre Storage

Cisco Systems disclosed eight high-severity bugs impacting a range of its networking gear, including its switches and fiber storage solutions. Cisco’s NX-OS was hardest hit, with six security alerts tied to the network operating system that underpins the networking giant’s Nexus-series Ethernet...

Cisco NX-OS Directory Traversal (cisco-sa-20190501-fabric-traversal)

The version of Cisco NX-OS installed on the remote host is affected by a directory traversal vulnerability in its system shell due to incorrect symbolic link verification of directory paths. An authenticated, local attacker can exploit this, to overwrite system files whose access should be...

Cisco Hyperflex HX-Series Software Weak Storage (cisco-sa-HYP-WSV-yT3j5hSB)

According to its self-reported version, Cisco HyperFlex HX Data Platform is affected by a vulnerability in the installation component because sensitive information is stored as clear text. An authenticated, local attacker can exploit this, by authenticating to an affected device and navigating to...

Cisco Unified Communications Manager XSS (cisco-sa-cucm-cuc-imp-xss-XtpzfM5e)

According to its self-reported version, Cisco Unified Communications Manager is affected by a cross-site scripting XSS vulnerability in its web interface component due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this,...

Cisco Data Center Network Manager Multiple Vulnerabilities (Aug 2020)

According to its self-reported version, Cisco Data Center Network Manager is affected by multiple vulnerabilities. - A vulnerability in a specific REST API of Cisco Data Center Network Manager DCNM Software could allow an authenticated, remote attacker to conduct directory traversal attacks on an...