Cisco IOS XE Software SM-1T3/E3 Service Module DoS (cisco-sa-20180926-sm1t3e3)

According to its self-reported version, Cisco IOS XE Software is affected by a denial of service DoS vulnerability in the SM-1T3/E3 firmware due to improper handling of user input. A remote, unauthenticated attacker can exploit this, by first connecting to the SM-1T3/E3 module console and enterin...

CVE-2020-6960

The following versions of MAXPRO VMS and NVR, MAXPRO VMS:HNMSWVMS prior to Version VMS560 Build 595 T2-Patch, HNMSWVMSLT prior to Version VMS560 Build 595 T2-Patch, MAXPRO NVR: MAXPRO NVR XE prior to Version NVR 5.6 Build 595 T2-Patch, MAXPRO NVR SE prior to Version NVR 5.6 Build 595 T2-Patch,...

Cisco IOS XE Software Web UI Cross-Site Request Forgery (cisco-sa-20200108-ios-csrf)

According to its self-reported version, Cisco IOS XE Software is affected by a cross-site request forgery CSRF vulnerability in the web UI due to insufficient CSRF protections. An unauthenticated, remote attacker can exploit this, by persuading a user of the interface to follow a malicious link, ...

Cisco Releases Security Updates for Multiple Products

Cisco has released security updates to address vulnerabilities in Cisco Webex Video Mesh, Cisco IOS, and Cisco IOS XE Software. A remote attacker could exploit these vulnerabilities to take control of an affected system. For updates addressing lower severity vulnerabilities, see the Cisco Securit...

Cisco IOS and Cisco IOS XE Software Web UI Cross-Site Request Forgery Vulnerability

A vulnerability in the web UI of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on an affected device. An attack...

Cisco IOS and IOS XE Software CVE-2019-16009 Cross Site Request Forgery Vulnerability

Description Cisco IOS and IOS XE Software are prone to a cross-site request-forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible. This issue is being tracked by...

Cisco IOS XE Software Forwarding Information Base DoS (cisco-sa-20180328-FIB-dos)

According to its self-reported version, Cisco IOS XE Software is affected by a denial of service DoS vulnerability in the Forwarding Information Base code due to a limitation in the way the FIB is internally representing recursive routes. An unauthenticated, network attacker can exploit this, by...

Cisco IOS XE Software Arbitrary File Write (cisco-sa-20180328-wfw)

According to its self-reported version, Cisco IOS XE Software is affected by an arbitrary file write vulnerability in the web-based user interface web UI due to insufficient input validation of HTTP requests that are sent to the web UI of the affected software. An authenticated, remote attacker c...

Cisco IOS XE Software CLI Command Injection Multiple Vulnerabilities (cisco-sa-20180328-cmdinj)

According to its self-reported version, Cisco IOS XE Software is affected by multiple vulnerabilities in the CLI parser because the affected software does not sufficiently sanitize command arguments before passing commands to the Linux shell for execution. An authenticated, local attacker can...

Cisco IOS XE Software Software Plug and Play Agent Memory Leak(cisco-sa-20180926-pnp-memleak)

According to its self-reported version, Cisco IOS XE Software is affected by a memory leak vulnerability in the Cisco Network Plug and Play agent due to insufficient input validation. An unauthenticated, remote attacker can exploit this, by sending invalid data to the Cisco Network Plug and Play...

Cisco IOS XE Software Simple Network Management Protocol Double-Free DoS (cisco-sa-20180328-snmp-dos)

According to its self-reported version, Cisco IOS XE Software is affected by a denial of service DoS vulnerability in the Simple Network Management Protocol SNMP subsystem due to improper management of memory resources, referred to as a double free. An authenticated, remote attacker can exploit...

Cisco IOS XE Software Digital Signature Verification Bypass (cisco-sa-20180926-digsig)

According to its self-reported version, Cisco IOS XE Software is affected by a digital signature verification bypass vulnerability in the Image Verification feature. An authenticated, local attacker can exploit this, by uploading a malicious software image or file to an affected device, in order ...

Cisco IOS XE Software Privileged EXEC Mode Root Shell Access (cisco-sa-20180926-privesc)

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability in the CLI parser due to the affected software improperly sanitizing command arguments to prevent modifications to the underlying Linux file system on a device. An authenticated, local attacker who has...

Cisco IOS XE Software Secure Shell Connection on VRF (cisco-sa-20190109-ios-ssh-vrf)

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability in the access control logic of the Secure Shell SSH server due to a missing check in the SSH server. An authenticated, remote attacker can exploit this, by providing valid credentials to access a device i...

Cisco IOS XE Software REST API Authorization Bypass (cisco-sa-20180328-rest)

According to its self-reported version, Cisco IOS XE Software is affected by an authorization bypass vulnerability in the REST API due to insufficient authorization checks for requests that are sent to the REST API of the affected software. An authenticated, remote attacker can exploit this, by...

Cisco IOS XE Software Authentication, Authorization, and Accounting Login Authentication RCE (cisco-sa-20180606-aaa)

According to its self-reported version, Cisco IOS XE Software is affected by a remote code execution vulnerability in the authentication, authorization, and accounting AAA security services due to incorrect memory operations that the affected software performs when the software parses a username...

Cisco IOS XE NGWC Legacy Wireless Device Manager GUI CSRF Vulnerability (cisco-sa-20190821-iosxe-ngwc-csrf)

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability in the web-based management interface of Cisco IOS XE New Generation Wireless Controller NGWC which allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perfor...

Cisco IOS XE Software Internet Group Management Protocol Memory Leak (cisco-sa-20180328-igmp)

According to its self-reported version, Cisco IOS XE Software is affected by a denial of service DoS vulnerability in the Internet Group Management Protocol IGMP packet-processing functionality. An unauthenticated, adjacent attacker can exploit this, by sending a large number of IGMP Membership...

Cisco IOS XE Software User EXEC Mode Root Shell Access Multiple Vulnerabilities (cisco-sa-20180328-privesc1)

According to its self-reported version, Cisco IOS XE Software is affected by multiple vulnerabilities in the CLI parser due to improper sanitization of command arguments to prevent access to internal data structures on a device. An authenticated, local attacker with user EXEC mode access to an...

Cisco IOS XE Software with Cisco Umbrella Integration DoS (cisco-sa-20180328-opendns-dos)

According to its self-reported version, Cisco IOS XE Software is affected by a denial of service DoS vulnerability in the Cisco Umbrella Integration feature due to a logic error that exists when handling a malformed incoming packet, leading to access to an internal data structure after it has bee...