CVE-2020-3431

Cisco Small Business RV042 and RV042G Dual WAN Router series are affected by an unauthenticated XSS vulnerability in the web-based management interface due to insufficient input validation. An attacker can lure a user to click a crafted link, potentially executing arbitrary script code in the use...

CVE-2020-26073

Cisco SD-WAN vManage Software is affected by a directory traversal/local file inclusion issue in the application data endpoints (APIs). It enables an unauthenticated attacker to read sensitive files and tokens via crafted API requests. The core issue is improper validation of directory traversal ...

CVE-2020-26074

CVE-2020-26074 affects Cisco SD-WAN vManage, where the vulnerability lies in the System File Transfer feature due to improper validation of path input. An authenticated, local attacker could exploit specially crafted path variables to overwrite arbitrary files, potentially gaining escalated privi...

CVE-2020-3525

The CVE-2020-3525 issue affects Cisco Identity Services Engine (ISE) Admin portal. It stems from incorrect inclusion of saved passwords when loading configuration pages, allowing an authenticated, remote attacker with read/write Admin portal access to browse pages containing sensitive data and re...

CVE-2020-3532

CVE-2020-3532 affects Cisco Unified Communications Manager and related components (CUCM, CUCM Session Management Edition, IM&P, Unity Connection). The web-based management interface fails to properly validate input, enabling unauthenticated, remote attackers to persuade users to click crafted lin...

CVE-2020-3538

Cisco DCNM (Data Center Network Manager) contains a path traversal vulnerability in a REST API endpoint that allows an authenticated, remote attacker to overwrite or list arbitrary files on affected devices. The issue stems from insufficient path restrictions, exploitable by sending crafted HTTP ...

CVE-2020-3539

CVE-2020-3539 concerns Cisco Data Center Network Manager (DCNM). The issue arises in the web-based management interface where a failure to restrict resources intended for Administrator users allows an authenticated, remote attacker to list, view, create, edit, and delete templates, effectively by...

CVE-2021-1234

Affected product/edition: Cisco SD-WAN vManage Software (cluster mode)\nVulnerability summary: In the cluster management interface, there is an absence of authentication for sensitive information, allowing an unauthenticated, remote attacker to view sensitive data by sending a crafted request.\nR...

CVE-2021-1285

CVE-2021-1285 affects multiple Cisco products via the Snort Ethernet Frame Decoder. The flaw arises from improper error handling when processing Ethernet frames, enabling an unauthenticated, adjacent attacker to trigger a denial-of-service by exhausting disk space, potentially denying admin login...

CVE-2021-1232

Summary: CVE-2021-1232 describes an information-disclosure flaw in the web-based management interface of Cisco SD-WAN vManage Software. The issue stems from insufficient access control for sensitive information stored on the system, enabling an authenticated, remote attacker to read arbitrary fil...

CVE-2021-1410

CVE-2021-1410 affects Cisco Webex Meetings. The vulnerability stems from insufficient authorization enforcement for requests to update distribution lists, allowing an authenticated, remote attacker to modify a distribution list belonging to another user within the same organization. The issue is ...

CVE-2021-1425

The CVE-2021-1425 issue affects Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA)/Email Security Appliance (ESA). It enables an authenticated, remote attacker to view confidential information by inspecting raw HTTP requests exchanged with the web-based management interf...

CVE-2021-1440

Cisco IOS XR Software contains a DoS vulnerability in the RPKI feature due to incorrect handling of RTR header packets. An unauthenticated attacker can trigger BGP process crashes by sending specially crafted RTR packets (or via MITM impersonation of the RPKI validator) over RTR TCP, causing the ...

CVE-2021-1462

CVE-2021-1462 affects Cisco SD-WAN vManage Software CLI. The issue arises from an incorrect privilege assignment that lets an authenticated local attacker with a valid Administrator account create a malicious file that the system later parses, potentially granting the attacker root privileges on ...

CVE-2021-1465

The CVE-2021-1465 entry concerns Cisco SD-WAN vManage Software. The issue is in the web-based management interface caused by insufficient validation of HTTP requests, enabling a directory traversal attack. An authenticated, remote attacker could read sensitive files and, per the description, coul...

CVE-2023-43091

GNOME Maps (GNOME Maps) is affected by CVE-2023-43091 due to a code injection flaw in its service.json configuration file. A malicious configuration can cause arbitrary code execution, as documented across multiple sources in the connected data. The issue is confirmed by CVE descriptions and rela...

CVE-2023-6110

OpenStack CVE-2023-6110 describes a flaw where deleting a non-existent access rule within a scope can cause other existing access rules (not linked to any application credentials) to be deleted. The vulnerability is linked to the OpenStack component handling access rule deletion. The documented i...

CVE-2023-4639

Undertow contains a flaw in how cookies with certain value-delimiting characters are parsed from incoming requests. The issue can allow an attacker to construct a cookie value to exfiltrate HttpOnly cookies or spoof additional cookie values, leading to unauthorized data access or modification. Th...

CVE-2023-0657

The CVE-2023-0657 entries concern Keycloak, where a flaw is described as improper enforcement of token types when validating signatures locally. This could let an authenticated attacker exchange a logout token for an access token, potentially accessing data outside of enforced permissions. The co...

CVE-2020-25720

A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator...