CVE-2024-20436

A vulnerability in the HTTP Server feature of Cisco IOS XE Software when the Telephony Service feature is enabled could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to a null pointer dereference when accessin...

CVE-2024-20467

A vulnerability in the implementation of the IPv4 fragmentation reassembly code in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper management of resources during fragment...

CVE-2024-20313

A vulnerability in the OSPF version 2 OSPFv2 feature of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a denial of service DoS condition. This vulnerability is due to improper validation of OSPF updates that...

CVE-2024-20480

A vulnerability in the DHCP Snooping feature of Cisco IOS XE Software on Software-Defined Access SD-Access fabric edge nodes could allow an unauthenticated, remote attacker to cause high CPU utilization on an affected device, resulting in a denial of service DoS condition that requires a manual...

CVE-2024-20259

A vulnerability in the DHCP snooping feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service DoS condition. This vulnerability is due to a crafted IPv4 DHCP request packet being mishandle...

CVE-2024-20314

A vulnerability in the IPv4 Software-Defined Access SD-Access fabric edge node feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause high CPU utilization and stop all traffic processing, resulting in a denial of service DoS condition on an affected device. This...

CVE-2024-20455

A vulnerability in the process that classifies traffic that is going to the Unified Threat Defense UTD component of Cisco IOS XE Software in controller mode could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability exists...

CVE-2024-20437

A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to perform a cross-site request forgery CSRF attack and execute commands on the CLI of an affected device. This vulnerability is due to insufficient CSRF protections for...

CVE-2024-20464

A vulnerability in the Protocol Independent Multicast PIM feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to insufficient validation of received IPv4 PIMv2 packets. An...

PT-2025-5720 · Cisco · Cisco Ios Xe +1

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE versions affected versions not specified Cisco IOS Software versions affected versions not specified Description: A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated,...

CVE-2024-57074

CVE-2024-57074 concerns xe-utils v3.5.31, where a prototype pollution in the lib.merge function enables DoS via a crafted payload. Affected component: xe-utils (lib.merge). Root cause: unsafe recursive merge/parsing allowing proto or path-based pollution. Impact: Denial of Service; remote code ex...

PT-2025-5715 · Cisco · Cisco Ios Xe +1

Name of the Vulnerable Software and Affected Versions: Cisco IOS Software and Cisco IOS XE Software affected versions not specified Description: A vulnerability in the SNMP subsystem could allow an authenticated, remote attacker to cause a denial of service DoS condition on an affected device. Th...

PT-2025-5719 · Cisco · Cisco Ios Xe +1

Name of the Vulnerable Software and Affected Versions: Cisco IOS Software versions prior to the fixed version Cisco IOS XE Software versions prior to the fixed version Description: A vulnerability in the SNMP subsystem could allow an authenticated, remote attacker to cause a denial of service DoS...

CVE-2024-57074

A prototype pollution in the lib.merge function of xe-utils v3.5.31 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

PT-2025-5751 · Xe-Utils · Xe-Utils

Name of the Vulnerable Software and Affected Versions: xe-utils version 3.5.31 Description: A prototype pollution in the lib.merge function allows attackers to cause a Denial of Service DoS via supplying a crafted payload. Recommendations: For version 3.5.31, consider disabling the lib.merge...

xe-utils 安全漏洞

xe-utils is an open source javascript library, toolkit from XE. A security vulnerability exists in xe-utils version v3.5.31, which stems from the lib.merge function containing a prototype contamination vulnerability...

Cisco IOS、Cisco IOS XE和Cisco IOS XR 安全漏洞

Cisco IOS and others are products of Cisco Corporation USA.Cisco IOS is a set of operating systems developed for its network devices.Cisco IOS XR is a set of operating systems developed for its network devices.Cisco IOS XE is an operating system. A security vulnerability exists in Cisco IOS, Cisc...

CVE-2024-57074

A prototype pollution in the lib.merge function of xe-utils v3.5.31 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

PT-2025-5714 · Cisco · Cisco Ios Xe +1

Name of the Vulnerable Software and Affected Versions: Cisco IOS Software versions prior to the fixed version Cisco IOS XE Software versions prior to the fixed version Description: A vulnerability in the SNMP subsystem could allow an authenticated, remote attacker to cause a DoS condition on an...

CVE-2023-39943

In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build 1204.200, the affected application lacks proper validation of user-supplied data when parsing XE files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the...