CVE-2018-9346

CVE-2018-9346 affects the Android AudioPolicyService component: In BnAudioPolicyService::onTransact there is information disclosure due to uninitialized data, enabling local information disclosure without additional privileges. Exploitation context: local access, no user interaction required. Aff...

CVE-2023-21270

CVE-2023-21270 affects Android’s PermissionManagerServiceImpl.java, specifically in restorePermissionState, where a flaw can allow an app to retain permissions that should be revoked due to incorrect permission flag clearance during an update. This can lead to local elevation of privilege with Us...

CVE-2020-26066

Cisco SD-WAN vManage Software Web UI contains an XML External Entity (XXE) processing vulnerability in certain XML files parsed by the application. An authenticated remote attacker could exploit this flaw to gain read and write access to information stored on the system. Affected component is the...

CVE-2020-26071

CVE-2020-26071 affects Cisco SD-WAN Software CLI. The issue is caused by insufficient input validation for specific commands, allowing an authenticated, local attacker to create or overwrite arbitrary files on an affected device, potentially leading to a DoS. Cisco has released software updates a...

CVE-2020-3420

CVE-2020-3420 affects Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME). The issue is a cross-site scripting (XSS) vulnerability caused by insufficient validation of user-supplied input in the web-based management interface. An authentica...

CVE-2020-3431

Cisco Small Business RV042 and RV042G Dual WAN Router series are affected by an unauthenticated XSS vulnerability in the web-based management interface due to insufficient input validation. An attacker can lure a user to click a crafted link, potentially executing arbitrary script code in the use...

CVE-2020-26073

Cisco SD-WAN vManage Software is affected by a directory traversal/local file inclusion issue in the application data endpoints (APIs). It enables an unauthenticated attacker to read sensitive files and tokens via crafted API requests. The core issue is improper validation of directory traversal ...

CVE-2020-26074

CVE-2020-26074 affects Cisco SD-WAN vManage, where the vulnerability lies in the System File Transfer feature due to improper validation of path input. An authenticated, local attacker could exploit specially crafted path variables to overwrite arbitrary files, potentially gaining escalated privi...

CVE-2020-3525

The CVE-2020-3525 issue affects Cisco Identity Services Engine (ISE) Admin portal. It stems from incorrect inclusion of saved passwords when loading configuration pages, allowing an authenticated, remote attacker with read/write Admin portal access to browse pages containing sensitive data and re...

CVE-2020-3532

CVE-2020-3532 affects Cisco Unified Communications Manager and related components (CUCM, CUCM Session Management Edition, IM&P, Unity Connection). The web-based management interface fails to properly validate input, enabling unauthenticated, remote attackers to persuade users to click crafted lin...

CVE-2020-3538

Cisco DCNM (Data Center Network Manager) contains a path traversal vulnerability in a REST API endpoint that allows an authenticated, remote attacker to overwrite or list arbitrary files on affected devices. The issue stems from insufficient path restrictions, exploitable by sending crafted HTTP ...

CVE-2020-3539

CVE-2020-3539 concerns Cisco Data Center Network Manager (DCNM). The issue arises in the web-based management interface where a failure to restrict resources intended for Administrator users allows an authenticated, remote attacker to list, view, create, edit, and delete templates, effectively by...

CVE-2021-1234

Affected product/edition: Cisco SD-WAN vManage Software (cluster mode)\nVulnerability summary: In the cluster management interface, there is an absence of authentication for sensitive information, allowing an unauthenticated, remote attacker to view sensitive data by sending a crafted request.\nR...

CVE-2021-1285

CVE-2021-1285 affects multiple Cisco products via the Snort Ethernet Frame Decoder. The flaw arises from improper error handling when processing Ethernet frames, enabling an unauthenticated, adjacent attacker to trigger a denial-of-service by exhausting disk space, potentially denying admin login...

CVE-2021-1232

Summary: CVE-2021-1232 describes an information-disclosure flaw in the web-based management interface of Cisco SD-WAN vManage Software. The issue stems from insufficient access control for sensitive information stored on the system, enabling an authenticated, remote attacker to read arbitrary fil...

CVE-2021-1410

CVE-2021-1410 affects Cisco Webex Meetings. The vulnerability stems from insufficient authorization enforcement for requests to update distribution lists, allowing an authenticated, remote attacker to modify a distribution list belonging to another user within the same organization. The issue is ...

CVE-2021-1425

The CVE-2021-1425 issue affects Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA)/Email Security Appliance (ESA). It enables an authenticated, remote attacker to view confidential information by inspecting raw HTTP requests exchanged with the web-based management interf...

CVE-2021-1440

Cisco IOS XR Software contains a DoS vulnerability in the RPKI feature due to incorrect handling of RTR header packets. An unauthenticated attacker can trigger BGP process crashes by sending specially crafted RTR packets (or via MITM impersonation of the RPKI validator) over RTR TCP, causing the ...

CVE-2021-1462

CVE-2021-1462 affects Cisco SD-WAN vManage Software CLI. The issue arises from an incorrect privilege assignment that lets an authenticated local attacker with a valid Administrator account create a malicious file that the system later parses, potentially granting the attacker root privileges on ...

CVE-2021-1465

The CVE-2021-1465 entry concerns Cisco SD-WAN vManage Software. The issue is in the web-based management interface caused by insufficient validation of HTTP requests, enabling a directory traversal attack. An authenticated, remote attacker could read sensitive files and, per the description, coul...