4247 matches found
CVE-2019-12624
CVE-2019-12624 affects Cisco IOS XE NGWC (Legacy Wireless Device Manager GUI). The web-based management interface lacks CSRF protections, enabling an unauthenticated, remote attacker to coerce actions in a victim’s browser with the user’s privileges via a crafted link. Documented impact is arbitr...
CVE-2019-12624 Cisco IOS XE NGWC Legacy Wireless Device Manager GUI Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Cisco IOS XE New Generation Wireless Controller NGWC could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. The vulnerability is due to...
CVE-2019-12624 Cisco IOS XE NGWC Legacy Wireless Device Manager GUI Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Cisco IOS XE New Generation Wireless Controller NGWC could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. The vulnerability is due to...
Cisco IOS XE Software Command Injection Vulnerability
According to its self-reported version, the Cisco IOS XE Software is affected by a vulnerability that allows an authenticated, local attacker to inject arbitrary commands that are executed with elevated privileges. The vulnerability is due to insufficient input validation of commands supplied by...
Cisco IOS XE Software Privilege Escalation Vulnerability
According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability in the web UI of Cisco IOS XE Software, which could allow an authenticated but unprivileged level 1, remote attacker to run privileged Cisco IOS commands by using the web UI.The vulnerability is due to a...
Cisco IOS XE Software Privilege Escalation Vulnerability
According to its self-reported version, Cisco IOS XE Software is affected by following vulnerability - A vulnerability in the authorization subsystem of Cisco IOS XE Software could allow an authenticated but unprivileged level 1, remote attacker to run privileged Cisco IOS commands by using the w...
Cisco IOS XE Software Catalyst 4500 Cisco Discovery Protocol Denial of Service Vulnerability
According to its self-reported version, Cisco IOS XE Software is affected by following vulnerability - A vulnerability in the Easy Virtual Switching System VSS of Cisco IOS XE Software on Catalyst 4500 Series Switches could allow an unauthenticated, adjacent attacker to cause the switches to...
Cisco IOS XE Software Information Disclosure Vulnerability (cisco-sa-20190327-info)
According to its self-reported version, Cisco IOS XE Software is affected by an unspecified vulnerability in the Secure Storage feature of Cisco IOS XE that allows an authenticated, local attacker to access sensitive system information on an affected device. The vulnerability is due to improper...
Cisco IOS XE Software Network Plug-and-Play Agent Certificate Validation Vulnerability
According to its self-reported version, the installed Cisco IOS XE software is affected by a vulnerability in the Cisco Network Plug-and-Play PnP agent. This vulnerability allows an unauthenticated, remote attacker to gain unauthorized access to sensitive data. The vulnerability exists because th...
Cisco IOS XE Software Web UI Cross-Site Request Forgery Vulnerability
According to its self-reported version, Cisco IOS XE Software is affected by a cross-site request forgery CSRF, which exists in the web UI of the affected device. A remote attacker can exploit this to perform arbitrary actions with the privilege level of the affected user. Please see the included...
Cisco IOS XE Software Hot Standby Router Protocol Information Leak Vulnerability
According to its self-reported version, Cisco IOS XE Software is affected by following vulnerability - A vulnerability in the Hot Standby Router Protocol HSRP subsystem of Cisco IOS and IOS XE Software could allow an unauthenticated, adjacent attacker to receive potentially sensitive information...
The vulnerability in the web interface of the Cisco IOS XE operating system allows a hacker to perform arbitrary actions in the context of the current user.
The vulnerability of the Cisco IOS XE operating system’s web interface is related to the lack of authentication for the requests being executed. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions on behalf of the current user, using a specially crafted link...
CVE-2019-1904
A vulnerability in the web-based UI web UI of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on an affected device. An attacke...
CVE-2019-1904
A vulnerability in the web-based UI web UI of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on an affected device. An attacke...
CVE-2019-1904
CVE-2019-1904 involves Cisco IOS XE Software’s web-based UI CSRF vulnerability. The issue stems from insufficient CSRF protections in the web UI when the HTTP Server feature is enabled, allowing an unauthenticated, remote attacker to coerce a logged-in user into performing arbitrary actions. If t...
The vulnerability in the web interface of the Cisco IOS XE operating system allows a hacker to execute arbitrary commands with root privileges.
The vulnerability of the Cisco IOS XE operating system’s Web UI is related to deficiencies in data validation during user input. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands in the Linux shell with root privileges...
High-Severity Cisco Flaw in IOS XE Enables Device Takeover
Cisco has patched a high-severity vulnerability in its software for routers and switches, which could enable a remote attacker to reconfigure or execute commands on impacted devices. IOS XE, a Linux-based version of Cisco’s Internetworking Operating System IOS, is software for Cisco routers and...
Cisco Releases Security Update for Cisco IOS XE
Cisco has released a security update to address a vulnerability in Cisco IOS XE. A remote attacker could exploit this vulnerability to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to review the Cisco Security...
Cisco Trust Anchor module (TAm) improperly checks code and Cisco IOS XE web UI does not sanitize user input
Overview Cisco's Trust Anchor module TAm can be bypassed through manipulating the bitstream of the Field Programmable Gate Array FPGA. This component handles access control to a hardware component within Cisco's Secure Boot implementations, which affects multiple products that support this...