CVE-2019-1851

CVE-2019-1851 concerns Cisco Identity Services Engine (ISE) where the External RESTful Services (ERS) API contains an RBAC flaw that lets an authenticated attacker craft requests with admin credentials to generate arbitrary certificates signed by the Internal CA. The root cause is improper RBAC i...

Cisco Identity Services Engine Arbitrary Client Certificate Creation Vulnerability

A vulnerability in the External RESTful Services ERS API of the Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to generate arbitrary certificates signed by the Internal Certificate Authority CA Services on ISE. This vulnerability is due to an incorrect...

Microsoft Windows PowerShell ISE - Remote Code Execution

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WINDOWS-POWERSHELL-ISE-FILENAME-PARSING-FLAW-RCE-0DAY.txt + ISR: ApparitionSec + Zero Day Initiative Program Vendor www.microsoft.com Product Windows PowerShell ISE The...

Windows PowerShell ISE / Filename Parsing Flaw Remote Code Execution Exploit

Microsoft Windows PowerShell ISE will execute wrongly supplied code when debugging specially crafted PowerShell scripts that contain array brackets as part of the filename. This can result in ISE executing attacker supplied scripts pointed to by the filename and not the "trusted" PS file currentl...

CVE-2019-1719 Cisco Identity Services Engine Cross-Site Scripting Vulnerability

A vulnerability in the web-based guest portal of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface. The vulnerability is due to insufficient validation of user-supplied...

CVE-2019-1719

CVE-2019-1719 concerns a cross-site scripting vulnerability in the Cisco Identity Services Engine (ISE) web-based guest portal. The issue arises from insufficient validation of user-supplied input in the web interface, allowing an authenticated, remote attacker to lure a user into clicking a craf...

CVE-2019-1718

A vulnerability in the web interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to trigger high CPU usage, resulting in a denial of service DoS condition. The vulnerability is due to improper handling of Secure Sockets Layer SSL renegotiation requests. A...

CVE-2019-1718

A vulnerability in the web interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to trigger high CPU usage, resulting in a denial of service DoS condition. The vulnerability is due to improper handling of Secure Sockets Layer SSL renegotiation requests. A...

CVE-2019-1718 Cisco Identity Services Engine SSL Renegotiation Denial of Service Vulnerability

A vulnerability in the web interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to trigger high CPU usage, resulting in a denial of service DoS condition. The vulnerability is due to improper handling of Secure Sockets Layer SSL renegotiation requests. A...

CVE-2019-1718

CVE-2019-1718 relates to Cisco Identity Services Engine (ISE) and its web interface. The issue allows an unauthenticated, remote attacker to trigger high CPU usage, causing a denial of service, due to improper handling of SSL renegotiation requests. Exploitation involves sending renegotiation req...

CVE-2019-1659

A vulnerability in the Identity Services Engine ISE integration feature of Cisco Prime Infrastructure PI could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack against the Secure Sockets Layer SSL tunnel established between ISE and PI. The vulnerability is due to...

CVE-2019-1659

CVE-2019-1659 describes a certificate-validation flaw in the Cisco Prime Infrastructure (PI) SSL tunnel when the PI server is integrated with Identity Services Engine (ISE). The issue arises from improper validation of the server SSL certificate, enabling an unauthenticated, remote attacker to pe...

CVE-2019-1673

Cisco Identity Services Engine (ISE) web-based management interface is affected by an XSS vulnerability due to insufficient input validation in certain parameters. An authenticated, remote attacker could lure a user to click a crafted link, enabling execution of arbitrary script code in the inter...

CVE-2019-1673 Cisco Identity Services Engine Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based interface. The vulnerability is due to insufficient input validation of some...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based interface. The vulnerability is due to insufficient input validation of some...

CVE-2019-1673

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based interface. The vulnerability is due to insufficient input validation of some...

Cisco ISE 2.4.0 XSS / Remote Code Execution Exploit

Cisco Identity Services Engine ISE version 2.4.0 suffers from cross site scripting, java deserialization, and in conjunction can lead to remote code execution. Full exploit provided. Multiple vulnerabilities in Cisco Identity Services Engine Unauth XSS to RCE as root Discovered by Pedro Ribeiro...

Cisco ISE Virtual Appliance Cross Site Scripting (CVE-2018-15440)

A cross site scripting vulnerability exists in Cisco ISE virtual appliance. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary commands on the affected system...

Cisco ISE 2.4.0 XSS / Remote Code Execution

Multiple vulnerabilities in Cisco Identity Services Engine Unauth XSS to RCE as root Discovered by Pedro Ribeiro [email protected], Agile Information Security and Dominik Czarnota [email protected] =================================================================================...

Input validation

A vulnerability in the Admin portal of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to obtain confidential information for privileged accounts. The vulnerability is due to the improper handling of confidential information. An attacker could exploit this...