Directory traversal

A vulnerability in the web management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct directory traversal attacks and obtain read and write access to sensitive files on a targeted system. The vulnerability is due to a lack of proper validation o...

CVE-2020-3468 Cisco SD-WAN vManage Software SQL Injection Vulnerability

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web-based management interface improperly validates values within SQL...

CVE-2020-3468

CVE-2020-3468 — Cisco SD-WAN vManage SQL Injection Affected product: Cisco SD-WAN vManage Software (web-based management interface). What’s vulnerable: The web interface improperly validates values within SQL queries, enabling an authenticated, remote attacker to inject SQL. Impact (as stated): A...

CVE-2020-3437

Cisco SD-WAN vManage Software information-disclosure vulnerability (CVE-2020-3437) enables an authenticated, remote attacker to read arbitrary files on the device filesystem via the web management interface due to insufficient file scope. Impact: partial confidentiality loss; CVSS vectors in publ...

CVE-2020-3406 Cisco SD-WAN vManage Software Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of the Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. The vulnerability exists because the web-based management interface does not...

CVE-2020-3401

CVE-2020-3401 — Cisco SD-WAN vManage path traversal : A vulnerability in the web-based management interface could allow an authenticated, remote attacker to perform path traversal and read arbitrary files due to insufficient validation of HTTP requests. Some sources (CNVD) reference affected vers...

CVE-2020-3387 Cisco SD-WAN vManage Software Remote Code Execution Vulnerability

A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to execute code with root privileges on an affected system. The vulnerability is due to insufficient input sanitization during user authentication processing. An attacker could exploit this vulnerabilit...

CVE-2020-3381

CVE-2020-3381 affects Cisco SD-WAN vManage Software via the web management interface. The root cause is improper validation of uploaded files, enabling an authenticated, remote attacker to perform directory traversal and read/write arbitrary files. Documents indicate this vulnerability (CVE-2020-...

CVE-2020-3378

CVE-2020-3378 affects Cisco SD-WAN vManage Software. The root cause is an SQL injection in the web-based management interface caused by insufficient validation of user-supplied input. An authenticated, remote attacker could send crafted input that includes SQL statements to the affected system, e...

CVE-2020-3388: Improper Authentication

A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating t...

CVE-2020-3372: Uncontrolled Resource Consumption

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to consume excessive system memory and cause a denial of service DoS condition on an affected system. The vulnerability is due to inefficient memory management. An...

CVE-2020-3405: Improper Restriction of XML External Entity Reference

A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity XXE entries when parsing certain XML...

CVE-2020-3468: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web-based management interface improperly validates values within SQL...

CVE-2020-3437: Improper Link Resolution Before File Access

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to read arbitrary files on the underlying filesystem of the device. The vulnerability is due to insufficient file scope limiting. An attacker could exploit this...

CVE-2020-3378: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the web-based management interface for Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to impact the integrity of an affected system by executing arbitrary SQL queries. The vulnerability is due to insufficient validation of user-supplied input. An...

CVE-2020-3381: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in the web management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct directory traversal attacks and obtain read and write access to sensitive files on a targeted system. The vulnerability is due to a lack of proper validation o...

CVE-2020-3387: Improper Input Validation

A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to execute code with root privileges on an affected system. The vulnerability is due to insufficient input sanitization during user authentication processing. An attacker could exploit this vulnerabilit...

CVE-2020-3401: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct path traversal attacks and obtain read access to sensitive files on an affected system. The vulnerability is due to insufficient validation of HTTP...

CVE-2020-3406: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of the Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. The vulnerability exists because the web-based management interface does not...

Cisco SD-WAN vManage Software Denial of Service Vulnerability

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to consume excessive system memory and cause a denial of service DoS condition on an affected system. The vulnerability is due to inefficient memory management. An...