CVE-2022-43933

CVE-2022-43933 affects Brocade SANnav prior to version 2.2.2. The vulnerability is an information exposure through log files: the supportsave/log data may contain configuration secrets such as usernames, passwords, and secret keys. Affects SANnav deployments where a log file generated by an admin...

CVE-2018-9485

CVE-2018-9485 affects the Android Bluetooth stack: in l2cble_process_sig_cmd of l2c_ble.cc there is an out-of-bounds read caused by a missing bounds check. This could lead to remote information disclosure over Bluetooth with no user interaction or extra privileges required. Attack vector is adjac...

CVE-2018-9475

The CVE-2018-9475 issue affects Android’s Bluetooth stack (HeadsetInterface::ClccResponse in btif_hf.cc), causing an out-of-bounds stack write that could enable remote elevation of privilege via Bluetooth when SIP calls are enabled, with no user interaction required. Exploitation details are not ...

CVE-2018-9466

CVE-2018-9466 : A vulnerability in libxml2’s valid.c xmlSnprintfElementContent can cause an out-of-bounds write, enabling remote escalation of privilege in an unprivileged process with user interaction required. Public details across sources confirm the issue’s presence in libxml2 and describe th...

CVE-2018-9409

The CVE-2018-9409 entry affects Android’s Media framework, specifically the HWC (Hardware Composer) path: HWCSession::SetColorModeById in hwc_session.cpp. The root cause is a missing bounds check, leading to a possible out-of-bounds write. This could enable local elevation of privilege with no ad...

CVE-2018-9369

CVE-2018-9369 describes a local elevation-of-privilege in the bootloader where a fastboot command allows a user to pass kernel command line arguments. The root cause is the bootloader’s handling of user-supplied kernel parameters, enabling a local attacker to gain higher privileges without additi...

CVE-2023-21270

CVE-2023-21270 affects Android’s PermissionManagerServiceImpl.java, specifically in restorePermissionState, where a flaw can allow an app to retain permissions that should be revoked due to incorrect permission flag clearance during an update. This can lead to local elevation of privilege with Us...

CVE-2020-26066

Cisco SD-WAN vManage Software Web UI contains an XML External Entity (XXE) processing vulnerability in certain XML files parsed by the application. An authenticated remote attacker could exploit this flaw to gain read and write access to information stored on the system. Affected component is the...

CVE-2020-26071

CVE-2020-26071 affects Cisco SD-WAN Software CLI. The issue is caused by insufficient input validation for specific commands, allowing an authenticated, local attacker to create or overwrite arbitrary files on an affected device, potentially leading to a DoS. Cisco has released software updates a...

CVE-2020-3431

Cisco Small Business RV042 and RV042G Dual WAN Router series are affected by an unauthenticated XSS vulnerability in the web-based management interface due to insufficient input validation. An attacker can lure a user to click a crafted link, potentially executing arbitrary script code in the use...

CVE-2020-26073

Cisco SD-WAN vManage Software is affected by a directory traversal/local file inclusion issue in the application data endpoints (APIs). It enables an unauthenticated attacker to read sensitive files and tokens via crafted API requests. The core issue is improper validation of directory traversal ...

CVE-2021-1234

Affected product/edition: Cisco SD-WAN vManage Software (cluster mode)\nVulnerability summary: In the cluster management interface, there is an absence of authentication for sensitive information, allowing an unauthenticated, remote attacker to view sensitive data by sending a crafted request.\nR...

CVE-2021-1440

Cisco IOS XR Software contains a DoS vulnerability in the RPKI feature due to incorrect handling of RTR header packets. An unauthenticated attacker can trigger BGP process crashes by sending specially crafted RTR packets (or via MITM impersonation of the RPKI validator) over RTR TCP, causing the ...

CVE-2021-1462

CVE-2021-1462 affects Cisco SD-WAN vManage Software CLI. The issue arises from an incorrect privilege assignment that lets an authenticated local attacker with a valid Administrator account create a malicious file that the system later parses, potentially granting the attacker root privileges on ...

CVE-2017-13312

CVE-2017-13312 affects Android’s Media framework (MediaCas.java) where a parcel read/write mismatch in createFromParcel, due to improper input validation, can enable local elevation of privilege on Android 8.0 (Oreo). An app could start an activity with system privileges without extra execution p...

CVE-2021-1482

CVE-2021-1482 concerns Cisco SD-WAN vManage Software, where the web-based management interface contains insufficient authorization checks. An authenticated, remote attacker could send crafted HTTP requests to bypass authorization and access sensitive information on the affected system. The CVSS 3...

CVE-2021-1483

Cisco SD-WAN vManage Software contains an XXE handling flaw in its web UI that could allow an authenticated remote attacker to read and write files within the affected application by convincing a user to import a crafted XML file. The issue stems from improper XML External Entity processing durin...

CVE-2021-1484

Cisco SD-WAN vManage Software has a web UI vulnerability (CVE-2021-1484) allowing an authenticated, remote attacker to inject arbitrary commands via crafted device template configuration input, leading to DoS. Root cause: improper input validation of user-supplied device template inputs. Affected...

CVE-2021-1494

CVE-2021-1494 affects the Snort detection engine used by multiple Cisco products. The vulnerability arises from incorrect handling of specific HTTP header parameters, allowing an unauthenticated remote attacker to bypass a configured file policy for HTTP packets and deliver a malicious payload. I...

CVE-2022-20632

Cisco Enterprise Chat and Email (ECE) web-based management interface vulnerability (CVE-2022-20632) allows an unauthenticated, remote attacker to perform a reflected XSS by enticing a user to click a crafted link. The issue arises from inadequate validation of user-supplied input in the interface...