CVE-2019-1742

Cisco IOS XE Software Information Disclosure (CVE-2019-1742) affects the web UI component. An unauthenticated, remote attacker can access sensitive configuration information due to improper access control to web UI files. Exploitation involves sending a crafted request to an affected device. Docu...

CVE-2019-1741

CVE-2019-1741 affects Cisco IOS XE Software ETA (Encrypted Traffic Analytics). The flaw is a logic error in handling malformed incoming IP packets that can lead to access to a freed internal data structure, enabling an unauthenticated, remote attacker to cause a device reload and a DoS. Exploitat...

CVE-2019-1738

The CVE-2019-1738 issue affects Cisco IOS Software and Cisco IOS XE Software with the Network-Based Application Recognition (NBAR) feature enabled. A parsing issue in DNS packets can be exploited by an unauthenticated, remote attacker to cause an affected device to reload, resulting in a DoS cond...

PT-2019-1705

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with elevated privileges. The vulnerability ...

PT-2019-1711

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated but unprivileged remote attacker to run privileged Cisco IOS commands by using the web UI. Th...

PT-2019-15173

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software on Catalyst 4500 Series Switches affected versions not specified Description The issue is due to incomplete error handling when processing Cisco Discovery Protocol CDP packets used with the Easy Virtual Switching System. ...

PT-2019-1888

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description The issue is related to improper access control to files within the web UI of Cisco IOS XE Software, allowing an unauthenticated, remote attacker to access sensitive configurati...

PT-2019-1748

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software versions 16.1.1 and later Description A logic error in the access control list ACL functionality of the Gigabit Ethernet Management interface could allow an unauthenticated, remote attacker to reach the configured IP...

PT-2019-1710

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description A vulnerability in the authorization subsystem of Cisco IOS XE Software could allow an authenticated but unprivileged remote attacker to run privileged Cisco IOS commands by usi...

PT-2019-1712

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description A vulnerability in the web UI framework of Cisco IOS XE Software could allow an authenticated, remote attacker to make unauthorized changes to the filesystem of the affected...

CVE-2019-1749: Improper Input Validation

A vulnerability in the ingress traffic validation of Cisco IOS XE Software for Cisco Aggregation Services Router ASR 900 Route Switch Processor 3 RSP3 could allow an unauthenticated, adjacent attacker to trigger a reload of an affected device, resulting in a denial of service DoS condition. The...

CVE-2019-1750: Improper Input Validation

A vulnerability in the Easy Virtual Switching System VSS of Cisco IOS XE Software on Catalyst 4500 Series Switches could allow an unauthenticated, adjacent attacker to cause the switches to reload. The vulnerability is due to incomplete error handling when processing Cisco Discovery Protocol CDP...

CVE-2019-1747: Improper Input Validation

A vulnerability in the implementation of the Short Message Service SMS handling functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a denial of service DoS condition on an affected device. The vulnerability is due to improper...

CVE-2019-1748: Improper Certificate Validation

A vulnerability in the Cisco Network Plug-and-Play PnP agent of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data. The vulnerability exists because the affected software insufficiently validates certificates...

CVE-2019-1746: Improper Input Validation

A vulnerability in the Cluster Management Protocol CMP processing code in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to trigger a denial of service DoS condition on an affected device. The vulnerability is due to insufficient input validation wh...

CVE-2019-1745: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with elevated privileges. The vulnerability is due to insufficient input validation of commands supplied by the user. An attacker could exploit this vulnerability b...

CVE-2019-1742: Undefined Security Weakness

A vulnerability in the web UI of Cisco IOS XE Software could allow an unauthenticated, remote attacker to access sensitive configuration information. The vulnerability is due to improper access control to files within the web UI. An attacker could exploit this vulnerability by sending a malicious...

CVE-2019-1743: Improper Input Validation

A vulnerability in the web UI framework of Cisco IOS XE Software could allow an authenticated, remote attacker to make unauthorized changes to the filesystem of the affected device. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by crafting a...

CVE-2019-1740: Improper Input Validation

A vulnerability in the Network-Based Application Recognition NBAR feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. This vulnerability are due to a parsing issue on DNS packets. An attacker could exploit...

CVE-2019-1741: Improper Input Validation

A vulnerability in the Cisco Encrypted Traffic Analytics ETA feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to a logic error that exists when handling a malformed incoming packet, leading to...