CVE-2019-15282

Cisco Identity Services Engine (ISE) exposes an information-disclosure flaw in its web-based management interface. An unauthenticated, remote attacker can read tcpdump files generated on an affected device by sending a crafted request due to an issue in the authentication logic. The CVE describes...

CVE-2018-15440

Cisco Identity Services Engine (ISE) contains a vulnerability in its web-based management interface that allows an unauthenticated, remote attacker to perform a stored cross-site scripting (XSS) attack. The issue arises from insufficient sanitization of user-supplied data written to log files and...

CVE-2018-0327

CVE-2018-0327 relates to Cisco Identity Services Engine (ISE) Web Framework. The vulnerability arises from insufficient input validation of parameters sent via HTTP GET/POST, enabling an unauthenticated, remote attacker to trigger a cross-site scripting (XSS) attack against a logged-in user of th...

CVE-2018-0413

CVE-2018-0413 affects the web-based management interface of Cisco Identity Services Engine (ISE). The root cause is insufficient CSRF protections, enabling an unauthenticated, remote attacker to trick a user into clicking a crafted link and perform arbitrary actions in the device’s browser sessio...

CVE-2011-3290

Cisco Identity Services Engine (ISE) prior to 1.0.4.MR2 is affected by CVE-2011-3290 due to default Oracle database credentials. The underlying cause is hard-coded/default credentials in the ISE database, enabling a remote attacker to modify configuration and perform administrative actions withou...

CVE-2015-4219

The CVE-2015-4219 issue affects Cisco Secure Access Control System and Cisco Identity Services Engine. The root cause is improper access control for support bundles, allowing an authenticated remote attacker to brute-force credentials and download the bundle contents, potentially leading to infor...

CVE-2013-1196

The CVE-2013-1196 entry involves multiple Cisco products (ACS, Identity Services Engine, ANM, LMS, Prime NSM/DCNM, Quad, etc.) where the command-line interface does not properly validate input, allowing local users to obtain root privileges via unspecified vectors. Connected documents corroborate...

CVE-2013-1125

Summary: CVE-2013-1125 affects Cisco Identity Services Engine Software, Secure Access Control System (ACS), Application Networking Manager (ANM), Prime LAN Management Solution (LMS), Prime Network Control System, Quad, Context Directory Agent, Prime Collaboration, Unified Provisioning Manager, an...

CVE-2015-4268

Cisco Identity Services Engine (ISE) Infra Admin UI is affected by CVE-2015-4268, with XSS vulnerabilities in ISE versions 1.2(1.198) and 1.3(0.876). The root cause is insufficient input validation of certain HTTP GET/POST parameters, enabling remote attackers to inject arbitrary web script or HT...

CVE-2015-6323

CVE-2015-6323 affects Cisco Identity Services Engine (ISE) Admin Portal. The vulnerability is described as an unauthorized access flaw in the Admin Portal that could allow an unauthenticated, remote attacker to obtain administrative access to affected devices. Affected releases include ISE 1.1.x ...

CVE-2012-3908

Cisco advisory CISCO-SA-20120920-CVE-2012-3908 describes CSRF vulnerabilities in the ISE Administrator UI (Tomcat-based) on Cisco Identity Services Engine 3300-series appliances prior to 1.1.0.665 Patch 1. An unauthenticated, remote attacker could trick an authorized user into following a malicio...

CVE-2013-5530

Cisco Identity Services Engine (ISE) web framework vulnerability affects ISE releases 1.0 and 1.1.x up to 1.1.4.x and 1.2 up to 1.2.0.x: specifically 1.0, 1.1.0 before 1.1.0.665-5; 1.1.1 before 1.1.1.268-7; 1.1.2 before 1.1.2.145-10; 1.1.3 before 1.1.3.124-7; 1.1.4 before 1.1.4.218-7; 1.2 before ...

CVE-2014-8017

Cisco Identity Services Engine (ISE) periodic-backup password disclosure vulnerability (CVE-2014-8017) arises from improper processing of certain client requests. An unauthenticated, remote attacker can trigger a crafted request that causes the backup password to be included in a reply, enabling ...

CVE-2018-0289

The CVE-2018-0289 issue affects Cisco Identity Services Engine (ISE) specifically the logs component . The root cause is improper validation of requests stored in logs in the application management interface, enabling an unauthenticated, remote attacker to perform cross-site scripting (XSS) when ...

CVE-2013-5521

Cisco Identity Services Engine (ISE) is affected by CVE-2013-5521, where the guest-account creation page can be used to exhaust the system’s guest account capacity. The root cause is an insufficient restriction on creating guest accounts, allowing an attacker to generate a large number of account...

CVE-2018-15463

CVE-2018-15463 describes multiple cross-site scripting vulnerabilities in Cisco Identity Services Engine (ISE) — specifically in the web-based management interface due to insufficient input validation. An unauthenticated, remote attacker could trick a user into clicking a link to trigger a reflec...

CVE-2014-3275

Cisco Identity Services Engine (ISE) is affected by CVE-2014-3275, a SQL injection in the web framework that allows an authenticated, remote attacker to execute arbitrary SQL via a crafted URL. The root cause is a failure to validate user-supplied input in SQL queries, potentially impacting integ...

CVE-2018-0339

CVE-2018-0339 describes a cross-site scripting (XSS) vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE). The issue arises from insufficient input validation of certain parameters, enabling an unauthenticated, remote attacker to lure a user into clicking a ...

CVE-2019-15281

The CVE-2019-15281 issue affects Cisco Identity Services Engine (ISE) web-based management interface. It is a stored XSS vulnerability caused by insufficient validation of user-supplied input, exploitable by injecting malicious code into a troubleshooting file. An attacker must have valid adminis...

CVE-2013-5523

CVE-2013-5523 concerns the Sponsor Portal of Cisco Identity Services Engine (ISE) 1.2 and earlier, where insufficient protection of IFRAME elements allows cross-frame scripting (XFS) and clickjacking via a user‑directed attacker page. The root cause is inadequate HTML iframe protection in the Spo...

CVE-2015-4266

CVE-2015-4266 affects Cisco Identity Services Engine (ISE) web interface: ISE 1.1(4.1), 1.3(106.146), and 1.3(120.135) are vulnerable due to insufficient iframe protection, enabling cross-frame scripting (XFS)/clickjacking via a crafted site. Impact is remote, unauthenticated browser attacks (cli...

CVE-2016-1485

CVE-2016-1485 refers to a Cross-Site Scripting (XSS) vulnerability in Cisco Identity Services Engine (ISE) 1.3(0.876). The issue stems from insufficient input validation in the web framework code for the Admin Dashboard, allowing remote attackers to craft parameters that trigger script execution ...

CVE-2014-0665

Summary of CVE-2014-0665 (Cisco ISE): A flaw in the RBAC code allows an authenticated, unprivileged user to download the support bundle and access sensitive data (e.g., user database) because privileges are not properly checked. An attacker, with valid credentials, could exploit this to obtain in...

CVE-2014-8022

Cisco Identity Services Engine (ISE) contains cross-site scripting (XSS) vulnerabilities in its web framework due to insufficient input validation on multiple web pages. An unauthenticated, remote attacker could lure a user to a malicious link to execute script in the user’s browser. Cisco’s advi...

CVE-2015-4267

Cisco Identity Services Engine (ISE) 1.2(0.793), 1.3(0.876), 1.4(0.109), 2.0(0.147), and 2.0(0.169) are affected by a CSRF vulnerability in the web framework due to insufficient CSRF protections. The CVE describes that remote attackers could hijack the authentication of arbitrary users, with an u...

CVE-2017-3835

CVE-2017-3835 affects Cisco Identity Services Engine (ISE) sponsor portal. The issue is an SQL Injection due to insufficient input validation, enabling an authenticated, remote attacker to access notices owned by other users. Affected release: ISE 1.4(0.908). Exploitation details in the linked Ci...

CVE-2013-3420

Cisco Identity Services Engine (ISE) is affected by CVE-2013-3420 via a CSRF flaw in the ISE web framework. The issue allows remote attackers to hijack the authentication of arbitrary users by exploiting insufficient CSRF protections, potentially executing arbitrary requests in the context of aut...

CVE-2013-3471

CVE-2013-3471 concerns Cisco Identity Services Engine (ISE) – captive portal. The issue arises from improper use of hidden HTML form fields in the portal, enabling an attacker to discover cleartext usernames and passwords. The vulnerability can be exploited remotely by unauthenticated or minimall...

CVE-2016-1402

CVE-2016-1402 describes a denial-of-service vulnerability in the Active Directory integration component of Cisco Identity Services Engine (ISE) for versions prior to 1.2.0.899 patch 7, when AD group-membership authorization is enabled. A remote attacker can trigger an outage by sending a crafted ...

CVE-2013-5504

The CVE-2013-5504 entry concerns Cisco Identity Services Engine (ISE) – specifically the Mobile Device Management (MDM) portal. Affected component: MDM portal input handling with insufficient input validation on an unspecified parameter, leading to cross-site scripting (XSS). Impact: remote attac...

CVE-2013-5531

Cisco Identity Services Engine (ISE) 1.x before 1.1.1 contains an authentication bypass vulnerability that allows remote attackers to bypass authentication and read the support-bundle configuration and credentials data via a crafted session on TCP port 443 (Bug CSCty20405). This is documented in ...

CVE-2015-6266

CVE-2015-6266 affects Cisco Identity Services Engine (ISE) guest portal, where the portal does not restrict access to uploaded HTML documents. The underlying issue is lack of access control for customized HTML files, allowing remote attackers to retrieve sensitive information by requesting the fi...

CVE-2013-5525

The available sources confirm CVE-2013-5525 affects Cisco Identity Services Engine (ISE) 1.2 and earlier, via a SQL injection in the web framework. A remote, authenticated attacker can execute arbitrary SQL through unspecified vectors by submitting crafted requests (e.g., crafted URLs). The root ...

CVE-2013-3413

Cisco Identity Services Engine (ISE) suffers a Cross-Site Scripting (XSS) vulnerability in the admin/monitoring panel search form (CVE-2013-3413). The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The advisory notes improper input validation and tha...

CVE-2014-3276

Cisco's advisory and CVE records describe a denial-of-service vulnerability in Cisco Identity Services Engine (ISE) prior to or including 1.2(.1 patch 2). The issue stems from improper handling of deadlock conditions when receiving crafted RADIUS accounting packets from two different NAS devices,...

CVE-2015-6317

Cisco Identity Services Engine (ISE) versions prior to 2.0 are vulnerable to an unauthorized access flaw where a low-privileged, authenticated user can bypass web-resource access restrictions by requesting resources directly. The root cause is improper filtering of web resources for administrativ...

CVE-2017-12316

CVE-2017-12316 relates to Cisco Identity Services Engine (ISE) Guest Portal. The issue is insufficient server-side enforcement of login attempt limits on the Guest Portal login page, enabling unauthenticated, remote attackers to perform multiple login attempts and potentially conduct brute-force ...

CVE-2012-5744

The CVE-2012-5744 issue concerns multiple XSS vulnerabilities in the Cisco Identity Services Engine (ISE) guest portal. Connected sources specify that the flaw stems from improper input validation in the guest portal, enabling an unauthenticated or remote attacker to lure a user to a link and cau...

CVE-2013-5524

Cisco acknowledges CVE-2013-5524: an XSS vulnerability in the Cisco Identity Services Engine (ISE) troubleshooting page (ISE 1.2 and earlier). The issue allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter. Impact is cross-site scripting on the web interface...

CVE-2015-4182

Cisco Identity Services Engine (ISE) administrative web interface before 1.3 contains a vulnerability in the web page access controls that allows an authenticated remote attacker to bypass access restrictions and either read sensitive information or change settings via unspecified vectors (Bug ID...

CVE-2013-5539

The CVE-2013-5539 entry concerns Cisco Identity Services Engine (ISE). The vulnerability is located in the upload-dialog component, where remote authenticated users can upload files of arbitrary types due to insufficient validation/filtering. This could enable attackers to plant files that may be...

CVE-2013-5538

CVE-2013-5538 affects Cisco Identity Services Engine (ISE) Sponsor Portal. The root cause is weak permissions on uploaded Sponsor Portal files, enabling an unauthenticated remote attacker to read arbitrary files via a direct URL. The Cisco advisory notes that updates are not available to fix this...

CVE-2013-5540

CVE-2013-5540 affects Cisco Identity Services Engine (ISE) file-upload management. The issue allows an authenticated remote attacker to upload multiple files, exhausting disk space and causing denial of service by making the administration interface unresponsive. Root cause is insufficient manage...

CVE-2013-5541

CVE-2013-5541 concerns Cisco Identity Services Engine (ISE) and its file-upload filename handling. The issue is a cross-site scripting (XSS) vulnerability triggered by crafting a filename uploaded via the ISE web interface. Root cause per Cisco advisory is insufficient validation of uploaded file...

CVE-2014-8015

Cisco Identity Services Engine (ISE) Sponsor Portal is affected by CVE-2014-8015. An authenticated remote attacker can manipulate an HTTP request to access or modify a guest account created by another sponsor due to a failure to enforce cross-sponsor guest-account isolation. The issue is exploita...

CVE-2016-9214

CVE-2016-9214 affects Cisco Identity Services Engine (ISE). The vulnerability is an unauthenticated, remote cross-site scripting (XSS) in the web interface, caused by insufficient input validation of parameters via HTTP GET/POST. Affected release: 2.0(101.130). Impact center on user sessions via ...

CVE-2015-0757

The CVE concerns Cisco Identity Services Engine (ISE) web framework versions 1.2(1.901) and 1.3(0.722), where improper session handler implementation allows an unauthenticated, remote attacker to read web pages and obtain sensitive information (e.g., MnT reports). This is a genuine information-di...

CVE-2013-5505

Cisco SA-20131001-CVE-2013-5505 documents an unauthenticated, remote XSS vulnerability in the Cisco Identity Services Engine (ISE) administration page. The issue stems from insufficient input validation of a parameter, allowing an attacker to inject arbitrary web script or HTML via a malicious li...

CVE-2014-0681

Cisco Identity Services Engine (ISE) 1.2 patch 2 and earlier is affected by a cross-site scripting (XSS) vulnerability in the report output pages. The root cause is insufficient input validation when generating reports, allowing an unauthenticated, remote attacker to inject arbitrary web script o...