Lucene search

K

47 matches found

CVE
CVE
added 2019/06/21 3:15 a.m.332 views

CVE-2019-1904

A vulnerability in the web-based UI (web UI) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on an affected device. An attac...

8.8CVSS9.1AI score0.00594EPSS
CVE
CVE
added 2019/05/13 7:29 p.m.124 views

CVE-2019-1649

A vulnerability in the logic that handles access control to one of the hardware components in Cisco's proprietary Secure Boot implementation could allow an authenticated, local attacker to write a modified firmware image to the component. This vulnerability affects multiple Cisco products that supp...

7.2CVSS6.4AI score0.00281EPSS
CVE
CVE
added 2019/03/28 1:29 a.m.112 views

CVE-2019-1761

A vulnerability in the Hot Standby Router Protocol (HSRP) subsystem of Cisco IOS and IOS XE Software could allow an unauthenticated, adjacent attacker to receive potentially sensitive information from an affected device. The vulnerability is due to insufficient memory initialization. An attacker co...

4.3CVSS4.3AI score0.00074EPSS
CVE
CVE
added 2019/09/25 8:15 p.m.111 views

CVE-2019-12650

Multiple vulnerabilities in the web-based user interface (Web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands with elevated privileges on the affected device. For more information about these vulnerabilities, see the Details section of this advisory.

9CVSS8.4AI score0.10821EPSS
CVE
CVE
added 2019/03/27 11:29 p.m.98 views

CVE-2019-1737

A vulnerability in the processing of IP Service Level Agreement (SLA) packets by Cisco IOS Software and Cisco IOS XE software could allow an unauthenticated, remote attacker to cause an interface wedge and an eventual denial of service (DoS) condition on the affected device. The vulnerability is du...

8.6CVSS8.4AI score0.01156EPSS
CVE
CVE
added 2019/03/28 12:29 a.m.95 views

CVE-2019-1746

A vulnerability in the Cluster Management Protocol (CMP) processing code in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation ...

7.4CVSS6.9AI score0.00145EPSS
CVE
CVE
added 2019/08/28 7:15 p.m.92 views

CVE-2019-12643

A vulnerability in the Cisco REST API virtual service container for Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass authentication on the managed Cisco IOS XE device. The vulnerability is due to an improper check performed by the area of code that manages the REST AP...

10CVSS9.6AI score0.19631EPSS
CVE
CVE
added 2019/03/28 12:29 a.m.89 views

CVE-2019-1748

A vulnerability in the Cisco Network Plug-and-Play (PnP) agent of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data. The vulnerability exists because the affected software insufficiently validates certificates....

7.4CVSS7.4AI score0.00421EPSS
CVE
CVE
added 2019/05/13 8:29 p.m.85 views

CVE-2019-1862

A vulnerability in the web-based user interface (Web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability occurs because the affected software improperly sanitizes u...

9CVSS7.1AI score0.00965EPSS
CVE
CVE
added 2019/03/28 1:29 a.m.84 views

CVE-2019-1756

A vulnerability in Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability occurs because the affected software improperly sanitizes user-supplied input. An attacker who has v...

9CVSS7.1AI score0.00631EPSS
CVE
CVE
added 2019/09/25 9:15 p.m.83 views

CVE-2019-12664

A vulnerability in the Dialer interface feature for ISDN connections in Cisco IOS XE Software for Cisco 4000 Series Integrated Services Routers (ISRs) could allow an unauthenticated, adjacent attacker to pass IPv4 traffic through an ISDN channel prior to successful PPP authentication. The vulnerabi...

7.5CVSS6.5AI score0.00682EPSS
CVE
CVE
added 2019/03/28 12:29 a.m.83 views

CVE-2019-1745

A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with elevated privileges. The vulnerability is due to insufficient input validation of commands supplied by the user. An attacker could exploit this vulnerability by ...

8.8CVSS7.9AI score0.0009EPSS
CVE
CVE
added 2019/09/25 9:15 p.m.80 views

CVE-2019-12668

A vulnerability in the web framework code of Cisco IOS and Cisco IOS XE Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface of the affected software using the banner parameter. The vulnerability is due to i...

4.8CVSS5AI score0.00182EPSS
CVE
CVE
added 2019/03/28 12:29 a.m.78 views

CVE-2019-1747

A vulnerability in the implementation of the Short Message Service (SMS) handling functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to improper ...

8.6CVSS8.3AI score0.01516EPSS
CVE
CVE
added 2019/03/28 12:29 a.m.77 views

CVE-2019-1752

A vulnerability in the ISDN functions of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload. The vulnerability is due to incorrect processing of specific values in the Q.931 information elements. An attacker could exploit this ...

8.6CVSS7.6AI score0.01587EPSS
CVE
CVE
added 2019/03/28 12:29 a.m.77 views

CVE-2019-1753

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated but unprivileged (level 1), remote attacker to run privileged Cisco IOS commands by using the web UI. The vulnerability is due to a failure to validate and sanitize input in Web Services Management Agent (WSMA) func...

9CVSS8.9AI score0.01162EPSS
CVE
CVE
added 2019/09/25 8:15 p.m.75 views

CVE-2019-12647

A vulnerability in the Ident protocol handler of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability exists because the affected software incorrectly handles memory structures, leading to a NULL pointer dereference. ...

8.6CVSS7.5AI score0.0116EPSS
CVE
CVE
added 2019/09/25 9:15 p.m.74 views

CVE-2019-12662

A vulnerability in Cisco NX-OS Software and Cisco IOS XE Software could allow an authenticated, local attacker with valid administrator or privilege level 15 credentials to load a virtual service image and bypass signature verification on an affected device. The vulnerability is due to improper sig...

7.2CVSS6.7AI score0.00043EPSS
CVE
CVE
added 2019/03/28 1:29 a.m.74 views

CVE-2019-1757

A vulnerability in the Cisco Smart Call Home feature of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data using an invalid certificate. The vulnerability is due to insufficient certificate validation by the affected soft...

5.9CVSS5.9AI score0.00339EPSS
CVE
CVE
added 2019/03/28 1:29 a.m.74 views

CVE-2019-1762

A vulnerability in the Secure Storage feature of Cisco IOS and IOS XE Software could allow an authenticated, local attacker to access sensitive system information on an affected device. The vulnerability is due to improper memory operations performed at encryption time, when affected software handl...

4.4CVSS4.3AI score0.00023EPSS
CVE
CVE
added 2019/03/28 12:29 a.m.72 views

CVE-2019-1740

A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. This vulnerability are due to a parsing issue on DNS packets. An attacker could exploit ...

8.6CVSS8.4AI score0.00776EPSS
CVE
CVE
added 2019/03/28 1:29 a.m.72 views

CVE-2019-1759

A vulnerability in access control list (ACL) functionality of the Gigabit Ethernet Management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to reach the configured IP addresses on the Gigabit Ethernet Management interface. The vulnerability is due to a logic err...

5.3CVSS5.2AI score0.37993EPSS
CVE
CVE
added 2019/09/25 9:15 p.m.71 views

CVE-2019-12654

A vulnerability in the common Session Initiation Protocol (SIP) library of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient sanity check...

8.6CVSS7.5AI score0.0116EPSS
CVE
CVE
added 2019/03/28 12:29 a.m.71 views

CVE-2019-1739

A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. This vulnerability is due to a parsing issue on DNS packets. An attacker could exploit t...

8.6CVSS7.9AI score0.02056EPSS
CVE
CVE
added 2019/03/28 1:29 a.m.69 views

CVE-2019-1755

A vulnerability in the Web Services Management Agent (WSMA) function of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary Cisco IOS commands as a privilege level 15 user. The vulnerability occurs because the affected software improperly sanitizes user-supplied...

9CVSS7AI score0.00308EPSS
CVE
CVE
added 2019/03/28 12:29 a.m.68 views

CVE-2019-1742

A vulnerability in the web UI of Cisco IOS XE Software could allow an unauthenticated, remote attacker to access sensitive configuration information. The vulnerability is due to improper access control to files within the web UI. An attacker could exploit this vulnerability by sending a malicious r...

7.5CVSS5.8AI score0.01145EPSS
CVE
CVE
added 2019/03/28 12:29 a.m.68 views

CVE-2019-1749

A vulnerability in the ingress traffic validation of Cisco IOS XE Software for Cisco Aggregation Services Router (ASR) 900 Route Switch Processor 3 (RSP3) could allow an unauthenticated, adjacent attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. T...

7.4CVSS7.4AI score0.00378EPSS
CVE
CVE
added 2019/09/25 9:15 p.m.67 views

CVE-2019-12660

A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to write values to the underlying memory of an affected device. The vulnerability is due to improper input validation and authorization of specific commands that a user can execute within the CLI. An at...

5.5CVSS5.5AI score0.00066EPSS
CVE
CVE
added 2019/03/28 12:29 a.m.67 views

CVE-2019-1738

A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. This vulnerability is due to a parsing issue on DNS packets. An attacker could exploit t...

8.6CVSS8.1AI score0.02056EPSS
CVE
CVE
added 2019/03/28 12:29 a.m.67 views

CVE-2019-1750

A vulnerability in the Easy Virtual Switching System (VSS) of Cisco IOS XE Software on Catalyst 4500 Series Switches could allow an unauthenticated, adjacent attacker to cause the switches to reload. The vulnerability is due to incomplete error handling when processing Cisco Discovery Protocol (CDP...

7.4CVSS7.4AI score0.00145EPSS
CVE
CVE
added 2019/03/28 12:29 a.m.66 views

CVE-2019-1741

A vulnerability in the Cisco Encrypted Traffic Analytics (ETA) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to a logic error that exists when handling a malformed incoming packet, leading to a...

8.6CVSS7.6AI score0.01156EPSS
CVE
CVE
added 2019/03/28 1:29 a.m.66 views

CVE-2019-1754

A vulnerability in the authorization subsystem of Cisco IOS XE Software could allow an authenticated but unprivileged (level 1), remote attacker to run privileged Cisco IOS commands by using the web UI. The vulnerability is due to improper validation of user privileges of web UI users. An attacker ...

9CVSS8.8AI score0.01003EPSS
CVE
CVE
added 2019/03/28 1:29 a.m.66 views

CVE-2019-1760

A vulnerability in Performance Routing Version 3 (PfRv3) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the affected device to reload. The vulnerability is due to the processing of malformed smart probe packets. An attacker could exploit this vulnerability by send...

7.1CVSS6.2AI score0.00443EPSS
CVE
CVE
added 2019/09/25 9:15 p.m.64 views

CVE-2019-12661

A vulnerability in a Virtualization Manager (VMAN) related CLI command of Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with a privilege level of root. The vulnerability is due to insufficient validation of ...

7.2CVSS6.8AI score0.00042EPSS
CVE
CVE
added 2019/09/25 9:15 p.m.62 views

CVE-2019-12658

A vulnerability in the filesystem resource management code of Cisco IOS XE Software could allow an unauthenticated, remote attacker to exhaust filesystem resources on an affected device and cause a denial of service (DoS) condition. The vulnerability is due to ineffective management of the underlyi...

8.6CVSS7.7AI score0.01033EPSS
CVE
CVE
added 2019/03/28 12:29 a.m.62 views

CVE-2019-1743

A vulnerability in the web UI framework of Cisco IOS XE Software could allow an authenticated, remote attacker to make unauthorized changes to the filesystem of the affected device. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by crafting a mal...

8.8CVSS7AI score0.00715EPSS
CVE
CVE
added 2019/09/25 9:15 p.m.61 views

CVE-2019-12666

A vulnerability in the Guest Shell of Cisco IOS XE Software could allow an authenticated, local attacker to perform directory traversal on the base Linux operating system of Cisco IOS XE Software. The vulnerability is due to incomplete validation of certain commands. An attacker could exploit this ...

7.2CVSS6.8AI score0.00014EPSS
CVE
CVE
added 2019/09/25 9:15 p.m.60 views

CVE-2019-12667

A vulnerability in the web framework code of Cisco IOS XE Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface of the affected software. The vulnerability is due to insufficient input validation of some para...

5.5CVSS5.1AI score0.00159EPSS
CVE
CVE
added 2019/08/21 7:15 p.m.59 views

CVE-2019-12624

A vulnerability in the web-based management interface of Cisco IOS XE New Generation Wireless Controller (NGWC) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insu...

8.8CVSS8.8AI score0.02811EPSS
CVE
CVE
added 2019/09/25 8:15 p.m.55 views

CVE-2019-12649

A vulnerability in the Image Verification feature of Cisco IOS XE Software could allow an authenticated, local attacker to install and boot a malicious software image or execute unsigned binaries on an affected device. The vulnerability exists because, under certain circumstances, an affected devic...

7.2CVSS6.3AI score0.00026EPSS
CVE
CVE
added 2019/01/10 12:29 a.m.53 views

CVE-2018-0282

A vulnerability in the TCP socket code of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to a state condition between the socket state and the transmission control block (TCB) state. While this vulnerabil...

7.1CVSS6.8AI score0.00426EPSS
CVE
CVE
added 2019/09/25 9:15 p.m.53 views

CVE-2019-12657

A vulnerability in Unified Threat Defense (UTD) in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to improper validation of IPv6 packets through the UTD feature. An attacker could exploit this vulnerability by se...

8.6CVSS7.6AI score0.01447EPSS
CVE
CVE
added 2019/09/25 9:15 p.m.53 views

CVE-2019-12659

A vulnerability in the HTTP server code of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the HTTP server to crash. The vulnerability is due to a logical error in the logging mechanism. An attacker could exploit this vulnerability by generating a high amount of long-...

7.5CVSS6.4AI score0.00521EPSS
CVE
CVE
added 2019/09/25 9:15 p.m.51 views

CVE-2019-12663

A vulnerability in the Cisco TrustSec (CTS) Protected Access Credential (PAC) provisioning module of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper ...

8.6CVSS7.4AI score0.00265EPSS
CVE
CVE
added 2019/09/25 9:15 p.m.48 views

CVE-2019-12653

A vulnerability in the Raw Socket Transport feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper parsing of Raw Socket Transport payloads. An...

8.6CVSS7.6AI score0.00806EPSS
CVE
CVE
added 2019/09/25 8:15 p.m.46 views

CVE-2019-12646

A vulnerability in the Network Address Translation (NAT) Session Initiation Protocol (SIP) Application Layer Gateway (ALG) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to improper processing of transient SIP...

8.6CVSS7.6AI score0.01033EPSS
CVE
CVE
added 2019/09/25 9:15 p.m.39 views

CVE-2019-12671

A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to gain shell access on an affected device and execute commands on the underlying operating system (OS). The vulnerability is due to insufficient enforcement of the consent token in authorizing shell ac...

7.8CVSS7.2AI score0.00071EPSS