CVE-2018-9409

The CVE-2018-9409 entry affects Android’s Media framework, specifically the HWC (Hardware Composer) path: HWCSession::SetColorModeById in hwc_session.cpp. The root cause is a missing bounds check, leading to a possible out-of-bounds write. This could enable local elevation of privilege with no ad...

CVE-2018-9369

CVE-2018-9369 describes a local elevation-of-privilege in the bootloader where a fastboot command allows a user to pass kernel command line arguments. The root cause is the bootloader’s handling of user-supplied kernel parameters, enabling a local attacker to gain higher privileges without additi...

CVE-2023-21270

CVE-2023-21270 affects Android’s PermissionManagerServiceImpl.java, specifically in restorePermissionState, where a flaw can allow an app to retain permissions that should be revoked due to incorrect permission flag clearance during an update. This can lead to local elevation of privilege with Us...

CVE-2020-26066

Cisco SD-WAN vManage Software Web UI contains an XML External Entity (XXE) processing vulnerability in certain XML files parsed by the application. An authenticated remote attacker could exploit this flaw to gain read and write access to information stored on the system. Affected component is the...

CVE-2020-26071

CVE-2020-26071 affects Cisco SD-WAN Software CLI. The issue is caused by insufficient input validation for specific commands, allowing an authenticated, local attacker to create or overwrite arbitrary files on an affected device, potentially leading to a DoS. Cisco has released software updates a...

CVE-2020-3431

Cisco Small Business RV042 and RV042G Dual WAN Router series are affected by an unauthenticated XSS vulnerability in the web-based management interface due to insufficient input validation. An attacker can lure a user to click a crafted link, potentially executing arbitrary script code in the use...

CVE-2020-26073

Cisco SD-WAN vManage Software is affected by a directory traversal/local file inclusion issue in the application data endpoints (APIs). It enables an unauthenticated attacker to read sensitive files and tokens via crafted API requests. The core issue is improper validation of directory traversal ...

CVE-2021-1234

Affected product/edition: Cisco SD-WAN vManage Software (cluster mode)\nVulnerability summary: In the cluster management interface, there is an absence of authentication for sensitive information, allowing an unauthenticated, remote attacker to view sensitive data by sending a crafted request.\nR...

CVE-2021-1440

Cisco IOS XR Software contains a DoS vulnerability in the RPKI feature due to incorrect handling of RTR header packets. An unauthenticated attacker can trigger BGP process crashes by sending specially crafted RTR packets (or via MITM impersonation of the RPKI validator) over RTR TCP, causing the ...

CVE-2021-1462

CVE-2021-1462 affects Cisco SD-WAN vManage Software CLI. The issue arises from an incorrect privilege assignment that lets an authenticated local attacker with a valid Administrator account create a malicious file that the system later parses, potentially granting the attacker root privileges on ...

CVE-2017-13312

CVE-2017-13312 affects Android’s Media framework (MediaCas.java) where a parcel read/write mismatch in createFromParcel, due to improper input validation, can enable local elevation of privilege on Android 8.0 (Oreo). An app could start an activity with system privileges without extra execution p...

CVE-2021-1482

CVE-2021-1482 concerns Cisco SD-WAN vManage Software, where the web-based management interface contains insufficient authorization checks. An authenticated, remote attacker could send crafted HTTP requests to bypass authorization and access sensitive information on the affected system. The CVSS 3...

CVE-2021-1483

Cisco SD-WAN vManage Software contains an XXE handling flaw in its web UI that could allow an authenticated remote attacker to read and write files within the affected application by convincing a user to import a crafted XML file. The issue stems from improper XML External Entity processing durin...

CVE-2021-1484

Cisco SD-WAN vManage Software has a web UI vulnerability (CVE-2021-1484) allowing an authenticated, remote attacker to inject arbitrary commands via crafted device template configuration input, leading to DoS. Root cause: improper input validation of user-supplied device template inputs. Affected...

CVE-2021-1494

CVE-2021-1494 affects the Snort detection engine used by multiple Cisco products. The vulnerability arises from incorrect handling of specific HTTP header parameters, allowing an unauthenticated remote attacker to bypass a configured file policy for HTTP packets and deliver a malicious payload. I...

CVE-2022-20632

Cisco Enterprise Chat and Email (ECE) web-based management interface vulnerability (CVE-2022-20632) allows an unauthenticated, remote attacker to perform a reflected XSS by enticing a user to click a crafted link. The issue arises from inadequate validation of user-supplied input in the interface...

CVE-2022-20654

CVE-2022-20654 affects Cisco Webex Meetings: an unauthenticated remote attacker can exploit insufficient input validation in the web-based interface to trigger cross-site scripting (XSS) by enticing a user to click a crafted link. Impact per sources includes execution of arbitrary script code in ...

CVE-2022-20634

Cisco Enterprise Chat and Email (ECE) Web-based management interface vulnerability (CVE-2022-20634) allows an unauthenticated, remote attacker to cause user redirection to a malicious URL via crafted links. Root cause: improper input validation of URL parameters in HTTP requests. Affects Cisco EC...

CVE-2022-20652

Cisco Tetration contains a command-injection vulnerability in the web-based management interface and API subsystem. An authenticated remote attacker with administrator credentials can submit crafted HTTP messages to execute commands with root privileges due to insufficient input validation. Impac...

CVE-2022-20793

CVE-2022-20793 affects Cisco TelePresence CE Software and RoomOS Software for Cisco Touch 10 devices. The root cause is insufficient identity verification in the pairing process, allowing an unauthenticated, remote attacker to impersonate a legitimate device and pair with an affected device. A su...