PAN-OS: A format string vulnerability in PAN-OS log daemon (logd) on Panorama allows local privilege escalation

A format string vulnerability in the PAN-OS log daemon logd on Panorama allows a network based attacker with knowledge of registered firewall devices and access to Panorama management interfaces to execute arbitrary code, bypassing the restricted shell and escalating privileges. This issue affect...

PAN-OS: Predictable temporary filename vulnerability allows local privilege escalation

A predictable temporary filename vulnerability in PAN-OS allows local privilege escalation. This issue allows a local attacker who bypassed the restricted shell to execute commands as a low privileged user and gain root access on the PAN-OS hardware or virtual appliance. This issue affects only...

PAN-OS: Shell injection vulnerability in PAN-OS CLI allows execution of shell commands

A shell command injection vulnerability in the PAN-OS CLI allows a local authenticated user to escape the restricted shell and escalate privileges. This issue affects only PAN-OS 8.1 versions earlier than PAN-OS 8.1.13. This issue does not affect PAN-OS 7.1, PAN-OS 9.0, or later PAN-OS versions...

AsyncOS Input Validation Error Vulnerability in Multiple Cisco Products

Cisco Content Security Management Appliance SMA and so on are the products of the American Cisco Cisco company.Cisco Content Security Management Appliance is a set of content security management equipment. The appliance is mainly used to manage all the policies, reports, audit information, etc. o...

Cisco MDS 9000 Series Multilayer Switches Denial of Service Vulnerability

A denial of service DoS vulnerability exists in Cisco MDS 9000 Series Multilayer Switch due to improper resource usage control. An unauthenticated, remote attacker can exploit this issue, via sending traffic to the management interface mgmt0, to cause the system to stop responding. Please see the...

CVE-2020-3164

Summary: CVE-2020-3164 is a GUI Denial of Service vulnerability in Cisco AsyncOS web interfaces for the Cisco Email Security Appliance (ESA), Web Security Appliance (WSA), and Content Security Management Appliance (SMA). It stems from improper validation of specific HTTP request headers, allowing...

CVE-2020-3157 Cisco Identity Services Engine Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based interface. The vulnerability is due to insufficient validation of user-supplied...

CVE-2020-3157

Cisco ISE (Identity Services Engine) web-based management interface is vulnerable to Cross-Site Scripting (XSS) due to insufficient validation of user-supplied input. An authenticated attacker with write permissions can craft and save a malicious configuration, enabling script execution in the ad...

CVE-2020-3193

CVE-2020-3193 concerns Cisco Prime Collaboration Provisioning; the web-based management interface reveals unnecessary server information in responses, allowing unauthenticated remote attackers to obtain details about the OS and web server version. Root cause: information disclosure via standard i...

CVE-2020-3193 Cisco Prime Collaboration Provisioning Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to obtain sensitive information about an affected device. The vulnerability exists because replies from the web-based management interface include...

CVE-2020-3193 Cisco Prime Collaboration Provisioning Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to obtain sensitive information about an affected device. The vulnerability exists because replies from the web-based management interface include...

CVE-2020-3192 Cisco Prime Collaboration Provisioning Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface. The vulnerability is due to insufficient validation of...

CVE-2020-3192

CVE-2020-3192 affects Cisco Prime Collaboration Provisioning web-based management interface. Root cause: insufficient validation of user-supplied input enabling cross-site scripting (XSS). An unauthenticated, remote attacker could entice a user to click a crafted link to execute arbitrary script ...

Cisco Identity Services Engine Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based interface. The vulnerability is due to insufficient validation of user-supplied...

Cisco Application Policy Infrastructure Controller Web-Based Management Interface Cross-Site Scripting Vulnerability (cisco-sa-20190501-apic-xss)

According to its self-reported version, Cisco Application Policy Infrastructure Controller APIC is affected by following vulnerability - A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller APIC could allow an authenticated, remote attacker t...

CVE-2019-20488

An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the web management interface setup.cgi are vulnerable to command injection, allowing remote attackers to execute arbitrary commands, as demonstrated by shell metacharacters in the sysDNSHost parameter...

CVE-2019-20488

The CVE-2019-20488 entry affects NETGEAR WNR1000V4 devices (firmware 1.1.0.54). The web management interface (setup.cgi) is vulnerable to command injection via shell metacharacters in the sysDNSHost parameter, enabling remote execution of arbitrary commands. The current sources confirm the vulner...

Cisco UCS Manager Software Operating System Command Injection Vulnerability

The Cisco UCS 6400 Series Fabric Interconnects is a 6400 series switching matrix device from Cisco USA. An operating system command injection vulnerability exists in the local management CLI in Cisco UCS Manager Software, which stems from the program's failure to perform sufficient input validati...

CVE-2020-3175

A vulnerability in the resource handling system of Cisco NX-OS Software for Cisco MDS 9000 Series Multilayer Switches could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper resource usage control. An...

CVE-2020-3175

A vulnerability in the resource handling system of Cisco NX-OS Software for Cisco MDS 9000 Series Multilayer Switches could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper resource usage control. An...