CVE-2024-20538 Cisco Identity Services Engine Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco ISE could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability exists because the web-based management interface does not sufficiently validate user-supplied input. An...

CVE-2024-20538

CVE-2024-20538 concerns Cisco Identity Services Engine (ISE) web-based management interface. Documents confirm a cross-site scripting (XSS) vulnerability in the ISE web UI caused by insufficient input validation, enabling an unauthenticated, remote attacker to entice a user to click a crafted lin...

CVE-2024-20537 Cisco Identity Services Engine Authorization Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for specific administrative functions. This vulnerability is due to a lack of server-side validation of Administrator permissions. An attacker...

CVE-2024-20537 Cisco Identity Services Engine Authorization Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for specific administrative functions. This vulnerability is due to a lack of server-side validation of Administrator permissions. An attacker...

CVE-2024-20537

CVE-2024-20537 concerns Cisco Identity Services Engine (ISE) and affects the web-based management interface. The issue arises from a lack of server-side validation of administrator permissions, enabling an authenticated, remote attacker to bypass authorization for specific administrative function...

CVE-2024-20532

Cisco ISE exposes an API vulnerability that allows an authenticated, remote attacker with Super Admin credentials to read and delete arbitrary files on the device due to insufficient parameter validation. The issue affects the ISE API layer and stems from weak input validation in API requests, en...

CVE-2024-20532 Cisco Identity Services Engine Arbitrary File Read and Delete Vulnerability

A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. To exploit this vulnerability, the attacker would need valid Super Admin credentials. This vulnerability is due to insufficient validation of user-suppli...

CVE-2024-20531 Cisco Identity Services Engine XML External Entity Injection Vulnerability

A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device and conduct a server-side request forgery SSRF attack through an affected device. To exploit this vulnerability, the attacker woul...

CVE-2024-20531 Cisco Identity Services Engine XML External Entity Injection Vulnerability

A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device and conduct a server-side request forgery SSRF attack through an affected device. To exploit this vulnerability, the attacker woul...

CVE-2024-20531

Cisco Identity Services Engine (ISE) API is affected by an XXE-based vulnerability in XML input handling, allowing an authenticated remote attacker with Super Admin credentials to read arbitrary OS files and perform SSRF. Root cause: improper XML External Entity processing in the API. Exploitatio...

CVE-2024-20530

Cisco ISE contains a web-based management interface XSS vulnerability (CVE-2024-20530). The issue arises from improper input validation in the interface, enabling an unauthenticated, remote attacker to lure a user via a crafted link to execute arbitrary script code in the user’s browser or access...

CVE-2024-20530 Cisco Identity Services Engine Reflected Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco ISE could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An...

CVE-2024-20529

Cisco Identity Services Engine (ISE) API vulnerability could allow an authenticated remote attacker with Super Admin credentials to read or delete arbitrary files due to insufficient validation of user-supplied API parameters. PT-2024-18676 notes affected software prior to 3.3.0 and recommends up...

CVE-2024-20529 Cisco Identity Services Engine Arbitrary File Read and Delete Vulnerability

A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. To exploit this vulnerability, the attacker would need valid Super Admin credentials. This vulnerability is due to insufficient validation of user-suppli...

CVE-2024-20529 Cisco Identity Services Engine Arbitrary File Read and Delete Vulnerability

A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. To exploit this vulnerability, the attacker would need valid Super Admin credentials. This vulnerability is due to insufficient validation of user-suppli...

CVE-2024-20528

CVE-2024-20528 is an authenticated API path traversal vulnerability in Cisco Identity Services Engine (ISE). The issue stems from insufficient validation of user-supplied parameters in API requests, enabling a remote attacker with valid Super Admin credentials to upload files to arbitrary locatio...

CVE-2024-20528 Cisco Identity Services Engine Path Traversal Vulnerability

A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to upload files to arbitrary locations on the underlying operating system of an affected device. To exploit this vulnerability, an attacker would need valid Super Admin credentials. This vulnerability is due to...

CVE-2024-20528 Cisco Identity Services Engine Path Traversal Vulnerability

A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to upload files to arbitrary locations on the underlying operating system of an affected device. To exploit this vulnerability, an attacker would need valid Super Admin credentials. This vulnerability is due to...

CVE-2024-20527

CVE-2024-20527 affects Cisco Identity Services Engine (ISE). The vulnerability is in the ISE API where insufficient validation of user-supplied parameters in API requests could allow an authenticated remote attacker with Super Admin credentials to read or delete arbitrary files on the device’s un...

CVE-2024-20525 Cisco Identity Services Engine Reflected Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco ISE could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An...