CVE-2022-20631

Cisco Enterprise Chat and Email (ECE) exposes a cross-site scripting (XSS) vulnerability in its web-based management interface. An unauthenticated, remote attacker could inject malicious script via the chat window due to improper input validation, potentially executing code in the interface conte...

CVE-2022-20654

CVE-2022-20654 affects Cisco Webex Meetings: an unauthenticated remote attacker can exploit insufficient input validation in the web-based interface to trigger cross-site scripting (XSS) by enticing a user to click a crafted link. Impact per sources includes execution of arbitrary script code in ...

CVE-2022-20634

Cisco Enterprise Chat and Email (ECE) Web-based management interface vulnerability (CVE-2022-20634) allows an unauthenticated, remote attacker to cause user redirection to a malicious URL via crafted links. Root cause: improper input validation of URL parameters in HTTP requests. Affects Cisco EC...

CVE-2022-20648

CVE-2022-20648 affects Cisco StarOS Software’s Redundancy Configuration Manager (RCM). A debug service incorrectly listens to/accepts incoming connections, enabling an unauthenticated, remote attacker to connect to the debug port, execute commands, and view confidential debugging information. Cis...

CVE-2022-20649

CVE-2022-20649 is a Cisco StarOS/RCM vulnerability where an incorrectly enabled debug mode on specific services allows an unauthenticated remote attacker to execute arbitrary commands as root inside the configured container. The issue stems from debug mode listening/enabled for certain services, ...

CVE-2022-20652

Cisco Tetration contains a command-injection vulnerability in the web-based management interface and API subsystem. An authenticated remote attacker with administrator credentials can submit crafted HTTP messages to execute commands with root privileges due to insufficient input validation. Impac...

CVE-2022-20655

CVE-2022-20655 describes a CLI command-injection vulnerability in ConfD on Cisco devices. It results from insufficient validation of a process argument in the CLI, enabling an authenticated, local attacker to inject commands during execution and potentially run arbitrary commands with the privile...

CVE-2022-20657

The CVE-2022-20657 issue affects Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network Manager (EPNM) where the web-based management interface does not adequately validate user input, enabling an unauthenticated, remote attacker to perform a cross-site scripting (XSS) attack. An ...

CVE-2022-20663

CVE-2022-20663 affects Cisco Secure Network Analytics (formerly Stealthwatch Enterprise). The issue is a cross-site scripting (XSS) vulnerability in the web-based management interface caused by insufficient validation of user-supplied input, exploitable when a user clicks a crafted link. An unaut...

CVE-2022-20685

CVE-2022-20685 is a DoS vulnerability in the Snort Modbus preprocessor caused by an integer overflow when processing Modbus traffic. An unauthenticated, remote attacker could craft traffic to cause the Snort process to hang and halt traffic inspection. Cisco has released software updates addressi...

CVE-2022-20656

CVE-2022-20656 affects Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network Manager (EPNM). The issue is in the web-based management interface where insufficient input validation of the HTTPS URL allows an authenticated, remote attacker to perform a path traversal attack, potent...

CVE-2022-20766

CVE-2022-20766 affects the Cisco ATA 190 Series Analog Telephone Adapter firmware, where a vulnerability in the Cisco Discovery Protocol handling can be triggered by unauthenticated remote Craft packets, leading to a DoS via service restart. The root cause is an out-of-bounds read when processing...

CVE-2022-20814

CVE-2022-20814 affects Cisco Expressway-C and Cisco TelePresence VCS. The root cause is improper validation of the SSL server certificate during connections to a Cisco Unified Communications Manager device, enabling a man-in-the-middle that could intercept traffic, view it in clear text, or modif...

CVE-2022-20846

CVE-2022-20846 describes a heap buffer overflow in Cisco IOS XR’s Cisco Discovery Protocol (CDP) messages that allows an unauthenticated, network-adjacent attacker to cause the CDP process to reload on an affected device. The flaw is triggered by specially crafted CDP packets sent within the same...

CVE-2022-20948

CVE-2022-20948 affects the Cisco BroadWorks Hosted Thin Receptionist web management interface. The issue is a cross-site scripting (XSS) vulnerability caused by insufficient input validation in the web UI. An authenticated, remote attacker could lure a user to click a crafted link, triggering exe...

CVE-2022-20853

CVE-2022-20853 concerns Cisco Expressway Series and Cisco TelePresence VCS. The issue is a CSRF vulnerability in the REST API/web-based management interface caused by insufficient CSRF protections, allowing an unauthenticated, remote attacker to persuade a logged-in user to follow a crafted link,...

CVE-2023-20090

The CVE-2023-20090 entry concerns Cisco TelePresence CE and RoomOS. Affected software suffers from improper access control on certain CLI commands, allowing an authenticated, local attacker to elevate privileges to root on an affected device. The impact is local privilege escalation with root acc...

CVE-2023-20092

Cisco TelePresence CE and RoomOS CLI have three local arbitrary file-write vulnerabilities (CVE-2023-20092) due to improper local file access controls. An authenticated, local attacker could place a symbolic link to overwrite arbitrary files; exploitation requires a remote support user account. A...

CVE-2023-20093

CVE-2023-20093 : Three vulnerabilities in the Cisco TelePresence CE and RoomOS CLI could allow an authenticated, local attacker to overwrite arbitrary files on the local file system by placing a symbolic link in a specific location. Root cause: improper access controls on local files. Preconditio...

CVE-2023-20125

Cisco BroadWorks Network Server TCP Denial of Service vulnerability (CVE-2023-20125) arises from missing rate limiting for certain inbound TCP connections, allowing unauthenticated remote attackers to exhaust server resources and render the system unusable. Affected component is the local interfa...