CVE-2021-1238

Cisco Firepower Management Center (FMC) web-based management interface is affected by multiple stored XSS vulnerabilities. The issue arises from insufficient input validation, allowing an authenticated, remote attacker to lure a user into clicking a crafted link to execute arbitrary script code o...

CVE-2021-1238 Cisco Firepower Management Center Stored Cross-Site Scripting Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center FMC could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface of an affected system. The vulnerabilities exist because the...

Cisco Firepower Management Center XML Entity Expansion Vulnerability

A vulnerability in the dashboard widget of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper restrictions on XML entities. An attacker could exploit th...

CVE-2020-3549

A vulnerability in the sftunnel functionality of Cisco Firepower Management Center FMC Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to obtain the device registration hash. The vulnerability is due to insufficient sftunnel negotiation...

Design/Logic Flaw

A vulnerability in the licensing service of Cisco Firepower Management Center FMC Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition.The vulnerability is due to improper handling of system resource values by the affected system. An attacker could...

Design/Logic Flaw

A vulnerability in the host input API daemon of Cisco Firepower Management Center FMC Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper certificate validation. An attacker could exploit...

Cross site scripting

Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center FMC Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. These vulnerabilities are due to insufficient validation o...

Directory traversal

A vulnerability in the sfmgr daemon of Cisco Firepower Management Center FMC Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, remote attacker to perform directory traversal and access directories outside the restricted path. The vulnerability is due to...

CVE-2020-3557

CVE-2020-3557–Cisco Firepower Management Center: The host input API daemon is vulnerable due to improper certificate validation. An unauthenticated remote attacker can send a crafted data stream to restart the daemon, causing a DoS via repeated reloads. Supported by multiple connected sources (Ci...

CVE-2020-3558

Cisco Firepower Management Center (FMC) Open Redirect vulnerability (CVE-2020-3558) arises from improper input validation of HTTP request parameters in the web-based management interface. An unauthenticated, remote attacker could intercept a user’s HTTP request and modify it to redirect the user ...

CVE-2020-3410

CVE-2020-3410 affects Cisco Firepower Management Center (FMC) Software CAC authentication: vulnerability in session invalidation that allows an unauthenticated, remote attacker with a valid CAC to bypass authentication and access FMC with the privileges of a CAC-authenticated user currently logge...

CVE-2020-3499

CVE-2020-3499 affects Cisco Firepower Management Center (FMC) Software in the licensing service. The issue allows an unauthenticated, remote attacker to cause a DoS by sending malicious requests that mishandle system resource values, rendering the FMC unresponsive and hindering management of depe...

CVE-2020-3515

Summary (CVE-2020-3515) : Cisco Firepower Management Center (FMC) software is affected by multiple cross-site scripting (XSS) vulnerabilities in its web-based management interface. The issues arise from insufficient validation of user-supplied input in the interface, enabling an unauthenticated, ...

CVE-2020-3550

Cisco Firepower Management Center (FMC) and Cisco Firepower Threat Defense (FTD) sfmgr daemon suffers directory-traversal due to insufficient input validation, allowing an authenticated, remote attacker to use relative paths in sfmgr commands to read/write arbitrary files on an sftunnel-connected...

CVE-2020-3550 Cisco Firepower Management Center Software and Firepower Threat Defense Software Directory Traversal Vulnerability

A vulnerability in the sfmgr daemon of Cisco Firepower Management Center FMC Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, remote attacker to perform directory traversal and access directories outside the restricted path. The vulnerability is due to...

CVE-2020-3553

CVE-2020-3553 affects Cisco Firepower Management Center (FMC) Web UI. Multiple XSS vulnerabilities arise from insufficient validation in the web-based management interface, allowing an unauthenticated, remote attacker to lure a user via a crafted link and execute arbitrary script code or view sen...

Authentication flaw

A vulnerability in the web-based management interface of Cisco Firepower Management Center FMC could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. The vulnerability is due to improper handling...

CVE-2019-16028

Cisco Firepower Management Center (FMC) web-based management interface is affected by CVE-2019-16028. The issue stems from improper handling of LDAP authentication responses from an external server, allowing an unauthenticated, remote attacker to bypass authentication and gain administrative acce...

CVE-2020-3307

A vulnerability in the web UI of Cisco Firepower Management Center FMC Software could allow an unauthenticated, remote attacker to write arbitrary entries to the log file on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability...

Cross site scripting

A vulnerability in the web UI of Cisco Firepower Management Center FMC Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of the FMC Software. The vulnerability is due to insufficient validatio...