CVE-2024-20466 Cisco Identity Services Engine Sensitive Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due to improper enforcement of administrative privilege levels for high-value...

Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. This vulnerability is due to insufficient CSRF...

Cisco Identity Services Engine Sensitive Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due to improper enforcement of administrative privilege levels for high-value...

CVE-2024-20466: Incorrect Privilege Assignment

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due to improper enforcement of administrative privilege levels for high-value...

CVE-2024-20486: Cross-Site Request Forgery (CSRF)

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. This vulnerability is due to insufficient CSRF...

PT-2024-5846

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Description A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a cross-site...

CVE-2024-20488: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user o...

CVE-2024-20454

Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system with root privileges...

CVE-2024-20443: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affect...

PT-2024-5607

Name of the Vulnerable Software and Affected Versions Cisco Small Business SPA300 Series IP Phones affected versions not specified Cisco Small Business SPA500 Series IP Phones affected versions not specified Description The issue is related to the web-based management interface of the affected...

PT-2024-5449

Name of the Vulnerable Software and Affected Versions Cisco Small Business SPA300 Series IP Phones affected versions not specified Cisco Small Business SPA500 Series IP Phones affected versions not specified Description The issue is related to a buffer overflow vulnerability in the web-based...

PT-2024-5721

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Description A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface. This issue is due ...

PT-2024-5605

Name of the Vulnerable Software and Affected Versions Cisco Small Business SPA300 Series IP Phones affected versions not specified Cisco Small Business SPA500 Series IP Phones affected versions not specified Description The issue is related to a buffer overflow vulnerability in the web-based...

CVE-2024-20479: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affect...

CVE-2024-41915: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit this vulnerability to obtain and modify sensitive information in...

CVE-2024-22444: Improper Neutralization of Input During Web Page Generation

A vulnerability within the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow a remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a...

CVE-2024-41914: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting XSS attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary...

CVE-2024-33519: Improperly Controlled Modification of Object Prototype Attributes

A vulnerability in the web-based management interface of HPE Aruba Networking EdgeConnect SD-WAN gateway could allow an authenticated remote attacker to conduct a server-side prototype pollution attack. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary...

CVE-2024-22443: Improperly Controlled Modification of Object Prototype Attributes

A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a server-side prototype pollution attack. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the...

Cisco Identity Services Engine Arbitrary File Upload (cisco-sa-ise-file-upload-krW2TxA9)

According to its self-reported version, Cisco Identity Services Engine Arbitrary File Upload is affected by a vulnerability. - A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to upload arbitrary files to an...