CVE-2022-20631

Cisco Enterprise Chat and Email (ECE) exposes a cross-site scripting (XSS) vulnerability in its web-based management interface. An unauthenticated, remote attacker could inject malicious script via the chat window due to improper input validation, potentially executing code in the interface conte...

CVE-2022-20634

Cisco Enterprise Chat and Email (ECE) Web-based management interface vulnerability (CVE-2022-20634) allows an unauthenticated, remote attacker to cause user redirection to a malicious URL via crafted links. Root cause: improper input validation of URL parameters in HTTP requests. Affects Cisco EC...

CVE-2022-20814

CVE-2022-20814 affects Cisco Expressway-C and Cisco TelePresence VCS. The root cause is improper validation of the SSL server certificate during connections to a Cisco Unified Communications Manager device, enabling a man-in-the-middle that could intercept traffic, view it in clear text, or modif...

CVE-2022-20845

The CVE-2022-20845 issue affects Cisco Network Convergence System (NCS) 4000 Series TL1 function. Root cause: TL1 does not free memory under certain conditions, causing a memory leak in the TL1 process. Impact: memory growth can trigger Resource Monitor (Resmon) to restart or terminate the top me...

CVE-2022-20849

CVE-2022-20849 affects Cisco IOS XR Software PPPoE functionality. An unauthenticated, adjacent attacker can send a crafted PPPoE packet sequence that the PPPoE feature does not handle correctly, causing the PPPoE process to repeatedly crash and restart, resulting in denial of service. The issue i...

CVE-2022-20931

CVE-2022-20931 concerns Cisco TelePresence CE Software used on Cisco Touch 10 devices, where weak version control allows an unauthenticated, adjacent attacker to downgrade to an older software version. The root cause is insufficient version control in the software update flow, enabling installati...

CVE-2022-20853

CVE-2022-20853 concerns Cisco Expressway Series and Cisco TelePresence VCS. The issue is a CSRF vulnerability in the REST API/web-based management interface caused by insufficient CSRF protections, allowing an unauthenticated, remote attacker to persuade a logged-in user to follow a crafted link,...

CVE-2022-20871

Cisco Secure Web Appliance (AsyncOS) web management interface is affected by a privilege-escalation vulnerability (CVE-2022-20871) due to insufficient validation of user-supplied input. An authenticated, remote attacker could exploit it via crafted HTTP packets to the web interface, potentially e...

CVE-2022-20939

CVE-2022-20939 refers to a privilege-escalation vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) via the web-based management interface. The root cause is inadequate protection of sensitive user information, enabling an authenticated, remote attacker to access certain logs and ...

CVE-2023-20004

Three Cisco CVEs (CVE-2023-20004, CVE-2023-20092, CVE-2023-20093) affect the CLI of Cisco TelePresence CE and RoomOS. The root cause is improper access controls on local filesystem files, enabling an authenticated, local attacker to overwrite arbitrary files by placing a symbolic link in a specif...

CVE-2023-20036

CVE-2023-20036 affects Cisco Industrial Network Director (IND). The issue is in the web UI and arises from improper input validation during Device Pack uploads, allowing an authenticated, remote attacker to inject commands and execute arbitrary code with NT AUTHORITY\SYSTEM privileges on the devi...

CVE-2023-20039

CVE-2023-20039 – Cisco IND : A vulnerability in Cisco Industrial Network Director (IND) allows an authenticated, local attacker to read files in the application data directory due to insufficient default file permissions. This could enable viewing sensitive information. Cisco states software upda...

CVE-2023-20060

CVE-2023-20060 relates to Cisco Prime Collaboration Deployment’s web-based management interface. The issue arises from improper validation of user-supplied input, enabling an unauthenticated, remote attacker to lure a user into clicking a crafted link and execute arbitrary script code in the inte...

CVE-2023-20090

The CVE-2023-20090 entry concerns Cisco TelePresence CE and RoomOS. Affected software suffers from improper access control on certain CLI commands, allowing an authenticated, local attacker to elevate privileges to root on an affected device. The impact is local privilege escalation with root acc...

CVE-2023-20091

CVE-2023-20091 affects Cisco TelePresence CE and RoomOS. A vulnerability in the CLI allows an authenticated, local attacker to overwrite arbitrary files on the device’s local filesystem by placing a symbolic link in a specific location, due to improper access controls on local files. Impact is lo...

CVE-2023-20092

Cisco TelePresence CE and RoomOS CLI have three local arbitrary file-write vulnerabilities (CVE-2023-20092) due to improper local file access controls. An authenticated, local attacker could place a symbolic link to overwrite arbitrary files; exploitation requires a remote support user account. A...

CVE-2023-20094

This CVE (CVE-2023-20094) affects Cisco TelePresence CE and Cisco RoomOS. The issue is caused by improper bounds checks in the affected software, enabling an unauthenticated, adjacent attacker to send a crafted request that can trigger an out-of-bounds read, potentially disclosing sensitive infor...

CVE-2023-20154

CVE-2023-20154 affects Cisco Modeling Labs external authentication. An unauthenticated, remote attacker could log in to the web interface with administrative privileges by exploiting improper handling of messages from the external authentication server. The attack requires valid credentials store...

CVE-2023-2332

CVE-2023-2332 is a stored XSS in pimcore/pimcore 10.5.19, located in the Conditions tab of Pricing Rules (Date Range From/To fields). The underlying issue allows injection of arbitrary JavaScript, potentially compromising user cookies or redirecting users. The vulnerability is mitigated by upgrad...

CVE-2017-13227

The CVE-2017-13227 issue affects the Android Autofill framework specifically stating that the package name provided by the app process is trusted inappropriately, leading to potential information disclosure with no additional privileges required. The description indicates a local attack vector wi...