CVE-2018-0123: Improper Limitation of a Pathname to a Restricted Directory

A Path Traversal vulnerability in the diagnostic shell for Cisco IOS and IOS XE Software could allow an authenticated, local attacker to use certain diagnostic shell commands that can overwrite system files. These system files may be sensitive and should not be able to be overwritten by a user of...

Cisco IOS XE Software Diagnostic Shell Path Traversal Vulnerability

A vulnerability in the diagnostic shell for Cisco IOS XE Software could allow an authenticated, local attacker to use certain diagnostic shell commands that can overwrite system files. These system files may be sensitive and should not be able to be overwritten by a user of the diagnostic shell...

PT-2018-8628

Name of the Vulnerable Software and Affected Versions: Cisco IOS and IOS XE Software affected versions not specified Description: A Path Traversal issue in the diagnostic shell could allow an authenticated, local attacker to overwrite system files by using certain diagnostic shell commands with...

How to set customized BIOS strings to HVM VMs

This article describes the method to set customized BIOS strings to HVM VMs through xe CLI of XenServer 7.3 and later, as well as how to get customized BIOS strings on these VMs...

Cross site scripting

A vulnerability in the IOS daemon IOSd web-based management interface of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface on an affected device. The vulnerability is due ...

CVE-2017-12304

CVE-2017-12304 affects Cisco IOS and IOS XE Software via the IOSd web-based management interface. The root cause is insufficient validation of user-supplied input, enabling an unauthenticated, remote attacker to craft a link that a user must click, potentially allowing arbitrary script execution ...

PT-2017-12479

Name of the Vulnerable Software and Affected Versions Cisco IOS and IOS XE Software affected versions not specified Description A cross-site scripting XSS issue exists due to insufficient validation of user-supplied input by the web-based management interface. This could allow an unauthenticated,...

CVE-2017-12304: Improper Neutralization of Input During Web Page Generation

A vulnerability in the IOS daemon IOSd web-based management interface of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface on an affected device. The vulnerability is due ...

Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial of Service Vulnerability

According to its self-reported version, the Cisco IOS XE Software is affected by a vulnerability in the Border Gateway Protocol BGP over an Ethernet Virtual Private Network EVPN for Cisco IOS XE Software that could allow an unauthenticated, remote attacker to cause the device to reload, resulting...

Cisco Patches DoS Flaw in BGP over Ethernet VPN Implementation

Cisco said that changes to its implementation of the Border Gateway Protocol BGP over an Ethernet VPN has created a vulnerability in its IOE XE software. The networking giant has released software updates for IOS XE that patches the issue, which could be exploited remotely without authentication,...

Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial of Service Vulnerability

A vulnerability in the Border Gateway Protocol BGP over an Ethernet Virtual Private Network EVPN for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service DoS condition, or potentially corrupt the BGP routing table,...

PT-2017-4193

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software versions prior to 16.3 Description A vulnerability in the Border Gateway Protocol BGP over an Ethernet Virtual Private Network EVPN for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the...

Cisco Releases Security Update for IOS XE Software

Cisco has released a security update to address a vulnerability in its IOS XE software. A remote attacker could exploit this vulnerability to cause a denial-of-service condition. US-CERT encourages users and administrators to review the Cisco Security Advisory and apply the necessary update. This...

The vulnerability of the REST API interface of the Cisco IOS XE operating system allows a perpetrator to bypass authentication procedures and gain access to the web interface.

The vulnerability of the REST API interface of the Cisco IOS XE operating system exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to bypass authentication procedures and gain access to the web interface by sending a specially crafted API...

Cisco IOS XE Software Information Disclosure Vulnerability

Cisco IOS XE Software is an operating system developed by Cisco for its network devices. A local information disclosure vulnerability exists in the IPsec feature of Cisco IOS XE Software. An attacker could exploit the vulnerability to obtain sensitive information...

Cross site scripting

A vulnerability in the web framework code of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of the affected software. The vulnerability is due to insufficient input validation of some parameter...

CVE-2017-12272

A vulnerability in the web framework code of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of the affected software. The vulnerability is due to insufficient input validation of some parameter...

CVE-2017-12289

A vulnerability in conditional, verbose debug logging for the IPsec feature of Cisco IOS XE Software could allow an authenticated, local attacker to display sensitive IPsec information in the system log file. The vulnerability is due to incorrect implementation of IPsec conditional, verbose debug...

CVE-2017-12289

A vulnerability in conditional, verbose debug logging for the IPsec feature of Cisco IOS XE Software could allow an authenticated, local attacker to display sensitive IPsec information in the system log file. The vulnerability is due to incorrect implementation of IPsec conditional, verbose debug...

CVE-2017-12272

CVE-2017-12272 affects Cisco IOS XE Software Web Framework, where insufficient input validation in the web server enables unauthenticated, remote attackers to perform a cross-site scripting (XSS) attack. The exploit requires the victim to visit a malicious link or for an attacker to intercept a u...