CVE-2020-3113: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface. The vulnerability is due to insufficient validation of...

CVE-2020-3159: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of the affected software. The vulnerability is due to insufficient validation of...

Missing XML Validation in PAN-OS Web Interface

Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that results in privilege escalation. This issue affects PAN-OS 8.1 versions earlier than PAN-OS 8.1.12 and PAN-OS 9.0 versions earlier than...

CVE-2019-15253 Cisco Digital Network Architecture Center Stored Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Digital Network Architecture DNA Center could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is...

PT-2020-1956

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE Software versions prior to 2.7.0 Description A vulnerability in the web-based management interface could allow an authenticated, remote attacker to perform a stored cross-site scripting XSS attack on an...

CVE-2019-15253: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of Cisco Digital Network Architecture DNA Center could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is...

CVE-2020-3149: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE Software could allow an authenticated, remote attacker to perform a stored cross-site scripting XSS attack on an affected device. The vulnerability is due to insufficient input validation by the web-based...

Cisco Firepower Management Center Lightweight Directory Access Protocol Authentication Bypass (cisco-sa-20200122-fmc-auth)

According to its self-reported version, Cisco Firepower Management Center is affected by an authentication bypass vulnerability in the web-based management interface. This is due to improper handling of Lightweight Directory Access Protocol LDAP authentication responses from an external...

Authentication flaw

A vulnerability in the web-based management interface of Cisco UCS Director could allow an unauthenticated, remote attacker to download system log files from an affected device. The vulnerability is due to an issue in the authentication logic of the web-based management interface. An attacker cou...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Unity Connection Software could allow an authenticated, remote attacker to perform a stored cross-site scripting XSS attack. The vulnerability is due to insufficient input validation by the web-based management interface. An attacker...

CVE-2019-16003

CVE-2019-16003 affects Cisco UCS Director Web-based management interface. A flaw in the authentication logic could allow an unauthenticated, remote attacker to download system log files generated by an administrator by sending a crafted request to the web interface. The vulnerability stems from h...

CVE-2019-16024 Cisco Crosswork Change Automation Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Crosswork Change Automation could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected system. The vulnerability is due to...

CVE-2019-16024

Cisco Crosswork Change Automation web-based management interface is vulnerable to cross-site scripting (XSS) due to insufficient input validation. An unauthenticated, remote attacker could entice a user to click a crafted link, potentially executing arbitrary script in the user’s browser or acces...

CVE-2019-16015

The CVE-2019-16015 affects Cisco Data Center Analytics Framework (DCAF) — specifically the web-based management interface. The issue is a reflected cross-site scripting (XSS) vulnerability caused by insufficient validation of user-supplied input. An unauthenticated, remote attacker could lure a u...

CVE-2020-3129 Cisco Unity Connection Stored Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Unity Connection Software could allow an authenticated, remote attacker to perform a stored cross-site scripting XSS attack. The vulnerability is due to insufficient input validation by the web-based management interface. An attacker...

CVE-2020-3129

CVE-2020-3129 describes a stored cross-site scripting (XSS) vulnerability in the web-based management interface of Cisco Unity Connection Software. The issue arises from insufficient input validation in the interface, allowing an authenticated, remote attacker to supply crafted data that can be s...

CVE-2020-3136

CVE-2020-3136 refers to a cross-site scripting vulnerability in Cisco Jabber Guest’s web-based management interface. The issue arises from improper validation of user-supplied input, enabling an unauthenticated, remote attacker to persuade a user to click a malicious link and execute script code ...

CVE-2019-15255: Improper Access Control

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to bypass authorization and access sensitive information related to the device. The vulnerability exists because the software fails to sanitize URLs before it...

CVE-2020-3136: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of Cisco Jabber Guest could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability exists because the web-based...

CVE-2019-15278: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to bypass authorization and access sensitive information related to the device. The vulnerability exists because the software fails to sanitize URLs before it handles requests. A...