CVE-2017-13311

The provided connected documents confirm CVE-2017-13311 affects the Android Framework, specifically the read() function in ProcessStats.java, causing a read/write serialization issue that enables a permissions bypass. This can lead to local escalation of privilege, allowing an app to start an act...

CVE-2017-13309

CVE-2017-13309 affects ConscryptEngine.java in Android's Conscrypt implementation. In readEncryptedData, there is a plaintext leak due to improper crypto usage, enabling local information disclosure without extra privileges or user interaction. The Android security bulletin (2018-05-01) associate...

CVE-2021-1470

Cisco SD-WAN vManage Software is affected by CVE-2021-1470, an SQL injection vulnerability in the web-based management interface. The issue arises from improper input validation of SQL queries, allowing an authenticated, remote attacker to send malicious queries and potentially modify values on t...

CVE-2021-1481

Cisco SD-WAN vManage Software is affected by CVE-2021-1481, a Cypher Query Language injection via the web-based management interface caused by insufficient input validation. An authenticated attacker could exploit this by sending crafted HTTP requests to the interface to obtain sensitive informat...

CVE-2021-1482

CVE-2021-1482 concerns Cisco SD-WAN vManage Software, where the web-based management interface contains insufficient authorization checks. An authenticated, remote attacker could send crafted HTTP requests to bypass authorization and access sensitive information on the affected system. The CVSS 3...

CVE-2021-1483

Cisco SD-WAN vManage Software contains an XXE handling flaw in its web UI that could allow an authenticated remote attacker to read and write files within the affected application by convincing a user to import a crafted XML file. The issue stems from improper XML External Entity processing durin...

CVE-2021-1484

Cisco SD-WAN vManage Software has a web UI vulnerability (CVE-2021-1484) allowing an authenticated, remote attacker to inject arbitrary commands via crafted device template configuration input, leading to DoS. Root cause: improper input validation of user-supplied device template inputs. Affected...

CVE-2021-1491

CVE-2021-1491 affects Cisco SD-WAN vManage Software. The issue is information disclosure via the web-based management interface caused by insufficient file scope limiting, enabling an authenticated remote attacker to read arbitrary files from the device’s underlying OS by crafting a specific file...

CVE-2021-1494

CVE-2021-1494 affects the Snort detection engine used by multiple Cisco products. The vulnerability arises from incorrect handling of specific HTTP header parameters, allowing an unauthenticated remote attacker to bypass a configured file policy for HTTP packets and deliver a malicious payload. I...

CVE-2022-20633

Cisco ECE (Enterprise Chat and Email) web-based management interface is affected by CVE-2022-20633. The issue arises from differences in authentication responses during login, enabling unauthenticated remote attackers to perform username enumeration and confirm existing user accounts. The vulnera...

CVE-2022-20632

Cisco Enterprise Chat and Email (ECE) web-based management interface vulnerability (CVE-2022-20632) allows an unauthenticated, remote attacker to perform a reflected XSS by enticing a user to click a crafted link. The issue arises from inadequate validation of user-supplied input in the interface...

CVE-2021-34753

Cisco Firepower Threat Defense (FTD) Software is affected by CVE-2021-34753 due to incomplete deep packet inspection in ENIP traffic processing, enabling unauthenticated remote bypass of configured ENIP access control and intrusion policies. The vulnerability concerns the payload inspection compo...

CVE-2021-34752

CVE-2021-34752 : A vulnerability in the Cisco Firepower Threat Defense (FTD) CLI allows an authenticated, local attacker with administrative privileges to execute arbitrary commands with root privileges on the underlying OS due to insufficient validation of user-supplied command arguments. Affect...

CVE-2021-34751

CVE-2021-34751 affects Cisco Firepower Management Center (FMC) software. The vulnerability stems from improper encryption of sensitive information stored in the FMC GUI configuration manager, allowing an authenticated, low-privilege, remote attacker to view sensitive configuration parameters in c...

CVE-2021-34750

Cisco Firepower Management Center Software contains an information-disclosure vulnerability in its web-based GUI configuration manager. An authenticated, low-privilege attacker could access sensitive configuration parameters in clear text due to improper encryption of stored data. Impact is limit...

CVE-2022-20626

Cisco Prime Access Registrar Appliance exposes a Cross-Site Scripting vulnerability in its web-based management interface. The issue stems from insufficient validation of user-supplied input, allowing an authenticated attacker with device credentials to persuade a user to click a crafted link, po...

CVE-2022-20631

Cisco Enterprise Chat and Email (ECE) exposes a cross-site scripting (XSS) vulnerability in its web-based management interface. An unauthenticated, remote attacker could inject malicious script via the chat window due to improper input validation, potentially executing code in the interface conte...

CVE-2022-20654

CVE-2022-20654 affects Cisco Webex Meetings: an unauthenticated remote attacker can exploit insufficient input validation in the web-based interface to trigger cross-site scripting (XSS) by enticing a user to click a crafted link. Impact per sources includes execution of arbitrary script code in ...

CVE-2022-20634

Cisco Enterprise Chat and Email (ECE) Web-based management interface vulnerability (CVE-2022-20634) allows an unauthenticated, remote attacker to cause user redirection to a malicious URL via crafted links. Root cause: improper input validation of URL parameters in HTTP requests. Affects Cisco EC...

CVE-2022-20648

CVE-2022-20648 affects Cisco StarOS Software’s Redundancy Configuration Manager (RCM). A debug service incorrectly listens to/accepts incoming connections, enabling an unauthenticated, remote attacker to connect to the debug port, execute commands, and view confidential debugging information. Cis...