CVE-2021-1482: Improper Input Validation

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization checking and gain access to sensitive information on an affected system. This vulnerability is due to insufficient authorization checks. An...

CVE-2021-1491: Improper Link Resolution Before File Access

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to read arbitrary files on the underlying file system of the device. This vulnerability is due to insufficient file scope limiting. An attacker could exploit this...

Cisco Expressway Series and Cisco TelePresence Video Communication Server have vulnerabilities related to cross-site request forgery attacks.

Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS are both products of Cisco, Inc.Cisco Expressway Series is software for accessing devices outside the firewall. The software provides simple, highly secure access for users outside the firewall, helping telecommuters wo...

CVE-2022-20652: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the web-based management interface and in the API subsystem of Cisco Tetration could allow an authenticated, remote attacker to inject arbitrary commands to be executed with root-level privileges on the underlying operating system. This vulnerability is due to insufficient inpu...

CVE-2024-5919

A blind XML External Entities XXE injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to exfiltrate arbitrary files from firewalls to an attacker controlled server. This attack requires network access to the firewall management interface...

CVE-2024-5919

CVE-2024-5919 is a blind XML External Entities (XXE) injection in Palo Alto Networks PAN-OS. An authenticated attacker with network access to the firewall management interface can exfiltrate arbitrary files to a remote server. Affected: PAN-OS software (details on affected versions are not consis...

CVE-2024-5919: Improper Restriction of XML External Entity Reference

A blind XML External Entities XXE injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to exfiltrate arbitrary files from firewalls to an attacker controlled server. This attack requires network access to the firewall management interface...

PAN-OS: Arbitrary File Delete Vulnerability in the Command Line Interface (CLI)

A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions in the management plane and delete files on the firewall. Work around: We strongly recommend customers to ensure access to your management interface is...

PT-2024-37241 · Palo Alto Networks · Pan-Os

Name of the Vulnerable Software and Affected Versions: PAN-OS affected versions not specified Description: A blind XML External Entities XXE injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to exfiltrate arbitrary files from firewalls to an...

Palo Alto Advises Securing PAN-OS Interface Amid Potential RCE Threat Concerns

Palo Alto Networks on Friday issued an informational advisory urging customers to ensure that access to the PAN-OS management interface is secured because of a potential remote code execution vulnerability. "Palo Alto Networks is aware of a claim of a remote code execution vulnerability via the...

Cisco Unified Industrial Wireless Software Command Injection Vulnerability

Cisco Unified Industrial Wireless Software is a software provided by Cisco for industrial wireless networks. A command injection vulnerability exists in Cisco Unified Industrial Wireless Software. The vulnerability is caused due to improper validation of inputs to the web management interface of...

Cisco Secure Email and Web Manager XSS (cisco-sa-esa-wsa-sma-xss-zYm3f49n)

According to its self-reported version, Cisco Secure Email and Web Manager is affected by a vulnerability. - A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance could allow an...

Cisco Prime Infrastructure XSS (cisco-sa-epnmpi-sxss-yyf2zkXs)

The version of Cisco Prime Infrastructure installed on the remote host is 3.10.x prior to 3.10.6. It is, therefore, affected by multiple vulnerabilities: - A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, low-privileged, remote...

Cisco Evolved Programmable Network Manager XSS (cisco-sa-epnmpi-sxss-yyf2zkXs)

The version of Cisco Evolved Programmable Network Manager installed on the remote host is prior to 8.0.0. It is, therefore, affected by the following: - A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager EPNM could allow an authenticated,...

Cisco Identity Services Engine XSS (cisco-sa-ise-auth-bypass-BBRf7mkE)

According to its self-reported version, Cisco Identity Services Engine is affected by a vulnerability in the web-based management interface of Cisco ISE which could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface. Note that Nessus has not tested...

Cisco Unified Communications Manager XSS (cisco-sa-cucm-xss-SVCkMMW)

According to its self-reported version, Cisco Unified Communications Manager running on the report host is affected by a cross-site scripting vulnerability that could allow an unauthenticated, remote attacker to conduct an attack against a user of the interface. This vulnerability exists because...

Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-auth-bypass-BBRf7mkE)

According to its self-reported version, Cisco Identity Services Engine is affected by multiple vulnerabilities: - A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for specific administrative...

Cisco Releases Patch for Critical URWB Vulnerability in Industrial Wireless Systems

Cisco has released security updates to address a maximum severity security flaw impacting Ultra-Reliable Wireless Backhaul URWB Access Points that could permit unauthenticated, remote attackers to run commands with elevated privileges. Tracked as CVE-2024-20418 CVS score: 10.0, the vulnerability...

Vulnerabilities fixed in Cisco Identity Services Engine

Cisco fixed vulnerabilities in Identity Services Engine ISE The vulnerabilities are located in the management interface and allow a malicious person to perform a Cross-Site Scripting attack. Such an attack could lead to execution of arbitrary code in the victim's browser, or access to sensitive...

Vulnerabilities fixed in Aruba Networks ArubaOS

Aruba Networks has fixed vulnerabilities in ArubaOS. A malicious party could exploit the vulnerabilities to execute arbitrary commands on the underlying operating system. For successful abuse, the malicious party must have access to the management interface, or command-line. It is good practice n...