CVE-2019-1931

Cisco Firepower Management Center (FMC) RSS dashboard suffers cross-site scripting (XSS) due to insufficient input validation in the web-based management interface. The flaws allow an unauthenticated, remote attacker to lure a user into clicking a crafted link, enabling arbitrary script execution...

CVE-2019-1930

Cisco Firepower Management Center (FMC) RSS dashboard web interface is affected by multiple cross-site scripting (XSS) vulnerabilities due to insufficient validation of user input. An unauthenticated, remote attacker could lure a user into clicking a crafted link, potentially executing arbitrary ...

CVE-2021-1223

CVE-2021-1223 affects Cisco products with the Snort detection engine, where incorrect handling of HTTP range header (per Cisco/NVD wording) could allow an unauthenticated, remote attacker to bypass a configured HTTP file policy and deliver a malicious payload by sending crafted HTTP packets throu...

CVE-2025-20265

CVE-2025-20265 affects Cisco Secure Firewall Management Center (FMC) Software, via the RADIUS subsystem; unauthenticated, remote attackers can inject and execute arbitrary shell commands with high privileges when FMC is configured for RADIUS authentication on the web interface or SSH. Root cause:...

CVE-2023-20048

CVE-2023-20048 describes a command-injection vulnerability in Cisco Firepower Management Center (FMC) web services. An authenticated attacker with FMC credentials can send crafted HTTP requests to an affected Firepower Threat Defense (FTD) device managed by FMC to execute unauthorized configurati...

CVE-2022-20743

CVE-2022-20743 affects Cisco Firepower Management Center (FMC) Web UI. The issue stems from improper validation when uploading files via the FMC web management interface, allowing an authenticated, remote attacker to upload malicious files, store them on the device, and potentially execute arbitr...

CVE-2021-1224

CVE-2021-1224 affects Cisco products via a TCP Fast Open (TFO) related bypass of HTTP file policies when used with Snort. The vulnerability arises from incorrect detection of HTTP payloads that are partially contained in the TFO handshake, enabling an unauthenticated, remote attacker to deliver a...

CVE-2021-40114

CVE-2021-40114 affects multiple Cisco products via the Snort detection engine’s ICMP processing, causing DoS from improper memory/resource management when handling ICMP packets. Root cause: memory/resource management flaw in ICMP packet processing. Impact: unauthenticated remote DoS, potentially ...

CVE-2022-20918

The CVE-2022-20918 issue affects Cisco FirePOWER Software for ASA FirePOWER module, Firepower Management Center (FMC) Software, and NGIPS Software. Root cause: SNMP access controls rely on a default credential for SNMPv1/v2, enabling an unauthenticated, remote attacker to perform SNMP GET request...

CVE-2026-20131

CVE-2026-20131 affects Cisco Secure Firewall Management Center (FMC) Software via the web-based management interface. The root cause is insecure deserialization of untrusted Java byte streams, enabling an unauthenticated, remote attacker to execute arbitrary Java code as root. Affected artifacts ...

CVE-2018-15397

The CVE is for Cisco ASA/FTD: a vulnerability in Traffic Flow Confidentiality (TFC) over IPsec could allow an unauthenticated, remote attacker to restart the device, causing a DoS. Root cause: an error during IPsec tunnel key renegotiation when TFC traffic is in flight may crash a daemon, leading...

CVE-2020-3558

Cisco Firepower Management Center (FMC) Open Redirect vulnerability (CVE-2020-3558) arises from improper input validation of HTTP request parameters in the web-based management interface. An unauthenticated, remote attacker could intercept a user’s HTTP request and modify it to redirect the user ...

CVE-2022-20629

Cisco Firepower Management Center (FMC) Web UI suffers cross-site scripting (XSS) vulnerabilities due to insufficient validation of user input in the web-based management interface. An authenticated remote attacker could lure a user to click a crafted link, potentially executing arbitrary script ...

CVE-2021-34749

CVE-2021-34749 affects Cisco WSA/FTD and the Snort detection engine. The issue stems from inadequate filtering of the SSL handshake in the SNI data path, allowing an unauthenticated remote attacker to bypass filters and exfiltrate data from a compromised host, potentially enabling command-and-con...

CVE-2022-20627

Cisco Firepower Management Center (FMC) web interface contains multiple cross-site scripting (XSS) vulnerabilities due to insufficient validation of user input. CVE-2022-20627 affects FMC and can be exploited by an authenticated, remote attacker who entices a user to click a crafted link, potenti...

CVE-2022-20744

CVE-2022-20744 affects Cisco Firepower Management Center (FMC). The issue is an input protection mechanism that relies on a specific input’s existence/value, allowing an authenticated, remote attacker to view data beyond their authorization by crafting requests to the affected device. Documented ...

CVE-2019-1981

The CVE-2019-1981 vulnerability affects Cisco Firepower Threat Defense Software (FTD), Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software. It stems from insufficient normalization of text-based payloads, enabling an unauthenticated, remote attacker to bypass...

CVE-2023-20219

CVE-2023-20219 affects Cisco Firepower Management Center (FMC) Software: multiple OS command injection vulnerabilities in the web-based management interface. An authenticated attacker with valid credentials (no admin privileges required) can craft input in the GUI to execute arbitrary commands on...

CVE-2017-12244

CVE-2017-12244 affects Cisco Firepower System Software 6.0+ where the detection engine’s IPv6 packet parsing allows an unauthenticated remote attacker to cause high CPU usage/DoS by sending crafted IPv6 extension header packets. Root cause is improper input validation in the IPv6 extension header...

CVE-2021-1236

CVE-2021-1236 affects multiple Cisco products via the Snort application detection engine. The vulnerability stems from a flaw in the detection algorithm, enabling an unauthenticated, remote attacker to bypass configured policies by sending crafted packets, potentially delivering a malicious paylo...

CVE-2022-20938

Cisco Firepower Management Center (FMC) Software is affected by a vulnerability in the module import function of the administrative interface, caused by insufficient validation of XML syntax when importing a module. An authenticated, remote attacker could exploit a specially crafted XML file to r...

CVE-2020-3315

CVE-2020-3315 affects multiple Cisco products via the Snort detection engine, where incorrect handling of certain HTTP responses lets unauthenticated remote attackers bypass configured file policies and deliver payloads. Public documentation in Debian/ Mageia advisories notes the vulnerability in...

CVE-2023-20155

Summary: CVE-2023-20155 affects Cisco Firepower Management Center (FMC). The issue is a lack of rate-limiting on a logging API used by FMC, which can be exploited by an unauthenticated remote attacker to cause a DoS (CPU spiking to 100% and potential reload) or, with valid credentials but not Adm...

CVE-2019-1978

The CVE-2019-1978 issue affects Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software. It stems from improper stream reassembly in the stream reassembly component, allowing an unauthenticated, remote attacker to bypass f...

CVE-2021-1239

CVE-2021-1239 refers to multiple stored XSS vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC). An authenticated, remote attacker could lure a user to click a crafted link, triggering arbitrary script execution or access to browser data due to inadequ...

CVE-2022-20628

Cisco Firepower Management Center (FMC) Software contains Cross-Site Scripting (XSS) vulnerabilities in its web-based management interface caused by insufficient input validation. An authenticated remote attacker could lure a user to click a crafted link, potentially executing arbitrary script co...

CVE-2019-15992

CVE-2019-15992 is a remote code execution vulnerability in the Lua interpreter used by Cisco ASA and Cisco FTD software. It arises from insufficient restrictions on Lua function calls in user-supplied scripts, which could allow an authenticated, remote attacker to trigger a heap overflow and exec...

CVE-2018-0278

Affected product/area: Cisco Firepower System Software management console. Vulnerability summary: An information-disclosure vulnerability due to improper cross-origin protections for WebSocket in the management console could allow an unauthenticated, remote attacker to retrieve policy or configur...

CVE-2020-3320

CVE-2020-3320 affects Cisco Firepower Management Center (web-based management interface). Root cause: insufficient validation of user-supplied input in the FMC web UI, enabling a cross-site scripting (XSS) attack. Exploitation requires an authenticated user to input crafted data and then persuade...

CVE-2022-20832

CVE-2022-20832 describes multiple stored XSS vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software. The flaws stem from insufficient validation of user-supplied input in the FMC web UI, enabling an authenticated remote attacker to inject crafted...

CVE-2022-20905

CVE-2022-20905 concerns Cisco Firepower Management Center (FMC) web-based management interface. The issue is a set of stored cross-site scripting (XSS) vulnerabilities caused by insufficient validation of user-supplied input in the FMC web UI. An authenticated, remote attacker could inject crafte...

CVE-2023-20063

Cisco Firepower Threat Defense (FTD) and Cisco Firepower Management Center (FMC) inter-device communication contains a code-injection vulnerability due to insufficient input validation. An authenticated, local attacker who gains admin privileges on an associated device can use expert mode to subm...

CVE-2022-20740

Cisco Firepower Management Center (FMC) is affected by a cross-site scripting vulnerability in its web-based management interface due to improper validation of user-supplied input. An unauthenticated, remote attacker could entice a user to click a crafted link to inject malicious input, potential...

CVE-2019-1982

Cisco Firepower family components (FTD, FWS for ASA, and FMC) are affected by CVE-2019-1982, a vulnerability in the HTTP traffic filtering module where improper handling of HTTP requests with malicious headers (including HTTPS) can let an unauthenticated remote attacker bypass filtering protectio...

CVE-2016-6433

CVE-2016-6433 — Cisco Firepower Management Center (Threat Management Console) : The vulnerability affects Cisco Firepower Management Center 5.2.0–6.0.1, allowing remote authenticated users to execute arbitrary commands via crafted web-application parameters. Exploitation has been demonstrated in ...

CVE-2019-16028

Cisco Firepower Management Center (FMC) web-based management interface is affected by CVE-2019-16028. The issue stems from improper handling of LDAP authentication responses from an external server, allowing an unauthenticated, remote attacker to bypass authentication and gain administrative acce...

CVE-2019-1642

CVE-2019-1642 affects Cisco Firepower Management Center (FMC). The issue is a cross-site scripting (XSS) vulnerability in the web-based management interface caused by insufficient validation of user-supplied input. An unauthenticated, remote attacker could lure a user to click a crafted link, ena...

CVE-2022-20831

CVE-2022-20831 involves multiple stored XSS flaws in Cisco Firepower Management Center (FMC) web UI caused by insufficient validation of user input. An authenticated, remote attacker could craft input in FMC interface fields to execute script code in the user’s browser or access browser-based inf...

CVE-2022-20833

CVE-2022-20833 concerns multiple stored XSS flaws in the web-based management interface of Cisco Firepower Management Center (FMC). The root cause is inadequate validation of user-supplied input in the FMC web UI, enabling an authenticated, remote attacker to inject script code via various data f...

CVE-2022-20925

Summary (CVE-2022-20925) : The Cisco Firepower Management Center (FMC) web management interface is affected by an API input validation vulnerability. An authenticated attacker with Device-permission credentials could exploit crafted input to API endpoints to execute arbitrary OS commands with low...

CVE-2022-20935

CVE-2022-20935 affects Cisco Firepower Management Center (FMC) web-based management interface. The issue is a stored cross-site scripting (XSS) vulnerability caused by insufficient validation of user-supplied input in various FMC data fields. An authenticated, remote attacker could inject crafted...

CVE-2022-20836

CVE-2022-20836 corresponds to multiple stored XSS vulnerabilities in Cisco Firepower Management Center (FMC) web interface. Affected component: FMC’s web-based management UI; root cause: insufficient validation of user-supplied input, enabling an authenticated, remote attacker to inject arbitrary...

CVE-2022-20854

The CVE-2022-20854 issue affects Cisco Firepower Management Center (FMC) and Firepower Threat Defense (FTD) Software, caused by improper error handling during SSH session establishment. An unauthenticated, remote attacker sending a high rate of crafted SSH connections can exhaust resources, leadi...

CVE-2022-20932

CVE-2022-20932 involves multiple stored XSS vulnerabilities in the Cisco Firepower Management Center (FMC) web-based management interface. The issues arise from insufficient validation of user-supplied input in data fields, allowing an authenticated, remote attacker to inject script code that run...

CVE-2022-20936

Cisco Firepower Management Center (FMC) web UI is affected by multiple CVE-2022-20936 XSS vulnerabilities due to insufficient input validation in the web-based management interface. An authenticated, remote attacker could inject crafted input to trigger stored XSS in FMC and potentially access se...

CVE-2017-12245

CVE-2017-12245 describes a memory-consumption DoS vulnerability in Cisco Firepower Threat Defense (FTD) Software’s SSL traffic decryption. Root cause: an error in how the Firepower Detection Snort Engine handles SSL traffic decryption and communicates with the ASA handler, enabling an unauthentic...

CVE-2018-0385

CVE-2018-0385 affects Cisco Firepower System Software: the detection engine’s SSL packet parsing can be mishandled, allowing an unauthenticated remote attacker to cause a DoS via Snort process restart. The issue stems from improper input handling of SSL traffic, with exploitation by sending craft...

CVE-2022-20834

CVE-2022-20834 affects Cisco Firepower Management Center (FMC) web-based management interface. The issue is due to insufficient validation of user-supplied input in the FMC UI, enabling an authenticated, remote attacker to perform a stored XSS attack. Impact ranges from arbitrary script execution...

CVE-2022-20838

Cisco Firepower Management Center (FMC) web UI contains stored XSS vulnerabilities due to insufficient input validation. An authenticated, remote attacker could inject crafted input into UI fields to execute arbitrary script in the FMC interface context or access browser-based information, with p...

CVE-2022-20843

CVE-2022-20843 pertains to multiple stored XSS flaws in the Cisco Firepower Management Center (FMC) web-based management interface. The issues arise from insufficient validation of user-supplied input in the FMC UI, allowing an authenticated, remote attacker to inject crafted input that executes ...