CVE-2018-0189

A vulnerability in the Forwarding Information Base FIB code of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, network attacker to cause a denial of service DoS condition. The vulnerability is due to a limitation in the way the FIB is internally representing recursive...

CVE-2018-0188

Multiple vulnerabilities in the web-based user interface web UI of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web UI of the affected software. The vulnerabilities are due to insufficient input validation...

CVE-2018-0188

Cisco IOS XE Software Web UI suffers multiple cross-site scripting (XSS) vulnerabilities due to insufficient input validation in the web UI parameters. An unauthenticated, remote attacker could lure a user to a malicious link or intercept a user request to inject code, potentially executing scrip...

CVE-2018-0173

A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 DHCPv4 packets could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a Relay Reply denial of service DoS...

CVE-2018-0151

A vulnerability in the quality of service QoS subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition or execute arbitrary code with elevated privileges. The vulnerability is due to incorrect bounds...

CVE-2018-0173

CVE-2018-0173 affects Cisco IOS Software and Cisco IOS XE Software. The issue is incomplete input validation of encapsulated DHCPv4 option 82 information, processed when handling DHCPOFFER responses forwarded to DHCP servers. A crafted DHCPv4 packet can trigger an error in processing the option 8...

CVE-2018-0185

CVE-2018-0185 relates to multiple vulnerabilities in the Cisco IOS XE Software CLI parser . The issues arise because the affected CLI parser does not sufficiently sanitize command arguments before passing them to the Linux shell, allowing an authenticated, local attacker to submit a malicious CLI...

CVE-2018-0190

Multiple vulnerabilities in the web-based user interface web UI of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web UI of the affected software. The vulnerabilities are due to insufficient input validation...

CVE-2018-0171

CVE-2018-0171 is a Cisco Smart Install remote code execution vulnerability in Cisco IOS/IOS XE where improper validation of packet data allows an unauthenticated, remote attacker to trigger a device reload (DoS) or execute arbitrary code by sending a crafted Smart Install message to TCP port 4786...

CVE-2018-0182

Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary commands into the CLI of the affected software, which could allow the attacker to gain access to the underlying Linux shell of an affected device and execute comman...

CVE-2018-0172

CVE-2018-0172 affects Cisco IOS/IOS XE. The issue lies in the DHCP option 82 encapsulation in DHCPv4, where incomplete input validation can lead to a heap overflow and device reload, causing DoS. An unauthenticated, remote attacker could trigger this by sending crafted DHCPv4 packets. Documents n...

CVE-2018-0152

Summary (CVE-2018-0152) Cisco IOS XE Software web UI privilege escalation arises because the web UI session does not reset the privilege level. An authenticated remote attacker could remotely access a device via a VTY line and assume the privileges of the previously logged-in user. Affected relea...

CVE-2018-0160

CVE-2018-0160 affects Cisco IOS XE Software SNMP subsystem. The issue is a memory-management fault (double free) that can let an authenticated, remote attacker trigger a reload and DoS by sending crafted SNMP packets. Exploitation requires SNMP read-only community string (v2c/v1) or user credenti...

CVE-2018-0196

A vulnerability in the web-based user interface web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to write arbitrary files to the operating system of an affected device. The vulnerability is due to insufficient input validation of HTTP requests that are sent to the web...

CVE-2018-0195

A vulnerability in the Cisco IOS XE Software REST API could allow an authenticated, remote attacker to bypass API authorization checks and use the API to perform privileged actions on an affected device. The vulnerability is due to insufficient authorization checks for requests that are sent to t...

CVE-2018-0160

A vulnerability in Simple Network Management Protocol SNMP subsystem of Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to improper management of memory resources, referred to as a double free. An attacker...

Cisco IOS XE Software with Cisco Umbrella Integration Denial of Service Vulnerability

A vulnerability in the Cisco Umbrella Integration feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to a logic error that exists when handling a malformed incoming packet, leading to access to an...

Cisco IOS XE Software Privileged EXEC Mode Root Shell Access Vulnerability

A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the underlying Linux shell of an affected device and execute arbitrary commands with root privileges on the device. The vulnerability is due to the affected software improperl...

Cisco IOS XE Software Switch Integrated Security Features IPv6 Denial of Service Vulnerability

A vulnerability in the Switch Integrated Security Features of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an interface queue wedge. The vulnerability is due to incorrect handling of crafted IPv6 packets. An attacker could exploit this vulnerability by sending...

Cisco IOS XE Software REST API Authorization Bypass Vulnerability

A vulnerability in the Cisco IOS XE Software REST API could allow an authenticated, remote attacker to bypass API authorization checks and use the API to perform privileged actions on an affected device. The vulnerability is due to insufficient authorization checks for requests that are sent to t...