CVE-2022-20836

CVE-2022-20836 corresponds to multiple stored XSS vulnerabilities in Cisco Firepower Management Center (FMC) web interface. Affected component: FMC’s web-based management UI; root cause: insufficient validation of user-supplied input, enabling an authenticated, remote attacker to inject arbitrary...

CVE-2022-20843

CVE-2022-20843 pertains to multiple stored XSS flaws in the Cisco Firepower Management Center (FMC) web-based management interface. The issues arise from insufficient validation of user-supplied input in the FMC UI, allowing an authenticated, remote attacker to inject crafted input that executes ...

CVE-2018-0385

CVE-2018-0385 affects Cisco Firepower System Software: the detection engine’s SSL packet parsing can be mishandled, allowing an unauthenticated remote attacker to cause a DoS via Snort process restart. The issue stems from improper input handling of SSL traffic, with exploitation by sending craft...

CVE-2022-20838

Cisco Firepower Management Center (FMC) web UI contains stored XSS vulnerabilities due to insufficient input validation. An authenticated, remote attacker could inject crafted input into UI fields to execute arbitrary script in the FMC interface context or access browser-based information, with p...

CVE-2022-20936

Cisco Firepower Management Center (FMC) web UI is affected by multiple CVE-2022-20936 XSS vulnerabilities due to insufficient input validation in the web-based management interface. An authenticated, remote attacker could inject crafted input to trigger stored XSS in FMC and potentially access se...

CVE-2021-1238

Cisco Firepower Management Center (FMC) web-based management interface is affected by multiple stored XSS vulnerabilities. The issue arises from insufficient input validation, allowing an authenticated, remote attacker to lure a user into clicking a crafted link to execute arbitrary script code o...

CVE-2022-20839

Cisco Firepower Management Center (FMC) web UI contains multiple stored XSS vulnerabilities due to insufficient input validation. An authenticated, remote attacker could inject crafted input via FMC interface fields to execute script code in the user’s browser or access browser-based data; availa...

CVE-2024-20360

Cisco Firepower Management Center (FMC) Software is affected by a SQL injection vulnerability in its web-based management interface. The issue arises from inadequate input validation in the FMC web UI, allowing an authenticated, remote attacker to send crafted SQL queries. Successful exploitation...

CVE-2020-3550

Cisco Firepower Management Center (FMC) and Cisco Firepower Threat Defense (FTD) sfmgr daemon suffers directory-traversal due to insufficient input validation, allowing an authenticated, remote attacker to use relative paths in sfmgr commands to read/write arbitrary files on an sftunnel-connected...

CVE-2021-1457

Cisco Firepower Management Center (FMC) Web-based management interface contains multiple cross-site scripting (XSS) vulnerabilities due to insufficient input validation. An unauthenticated, remote attacker can lure a user to click a crafted link, causing arbitrary script execution in the user’s b...

CVE-2022-20840

Cisco Firepower Management Center (FMC) is affected by CVE-2022-20840, a set of stored cross-site scripting (XSS) vulnerabilities in the FMC web-based management interface. The flaws arise from insufficient validation of user-supplied input in the interface, allowing an authenticated, remote atta...

CVE-2016-6435

CVE-2016-6435 affects Cisco Firepower Threat Management Console (Firepower Management Center) 6.0.1. The issue arises from improper validation of parameters sent to the web console, enabling an authenticated remote user to read arbitrary files on the server (local file inclusion/information discl...

CVE-2021-40116

CVE-2021-40116 affects Cisco products using Snort3 when a rule with Block with Reset or Interactive Block with Reset is configured without proper constraints. A crafted IP packet can cause a DoS by dropping through traffic; Snort2 configurations are not affected. Connected sources confirm the vul...

CVE-2022-20834

CVE-2022-20834 affects Cisco Firepower Management Center (FMC) web-based management interface. The issue is due to insufficient validation of user-supplied input in the FMC UI, enabling an authenticated, remote attacker to perform a stored XSS attack. Impact ranges from arbitrary script execution...

CVE-2022-20941

CVE-2022-20941 affects Cisco Firepower Management Center (FMC) and is due to missing authorization for certain web interface resources plus insufficient entropy in resource names. An unauthenticated, remote attacker could send HTTPS requests to enumerate resources on an affected FMC and potential...

CVE-2016-6434

Cisco Firepower Management Center 6.0.1 is affected by CVE-2016-6434 due to hard-coded MySQL credentials in the local database. The vulnerability enables an authenticated, local attacker with CLI access to obtain sensitive information, effectively bypassing authentication through a root MySQL acc...

CVE-2018-0283

Cisco Firepower System Software is affected by CVE-2018-0283. The vulnerability stems from improper handling of TLS TCP connection setup in the Snort detection engine, enabling an unauthenticated remote attacker to restart the Snort engine and cause a brief DoS. Affected product is Cisco Firepowe...

CVE-2018-0370

Cisco Firepower System Software contains a denial-of-service vulnerability in the detection engine when SSL inspection is enabled. An unauthenticated remote attacker can send crafted traffic to cause a single Snort detection engine process to consume excessive memory, degrading traffic processing...

CVE-2020-3514

CVE-2020-3514 describes a Cisco Firepower Threat Defense (FTD) Software multi-instance container escape. An authenticated, local attacker with valid device credentials could modify a startup container configuration file to escape the container and execute commands with root privileges in the host...

CVE-2020-3557

CVE-2020-3557–Cisco Firepower Management Center: The host input API daemon is vulnerable due to improper certificate validation. An unauthenticated remote attacker can send a crafted data stream to restart the daemon, causing a DoS via repeated reloads. Supported by multiple connected sources (Ci...

CVE-2023-20114

CVE-2023-20114 concerns Cisco Firepower Management Center (FMC) and stems from insufficient input sanitation in the FMC file-download feature. Affected component: FMC software’s file download endpoint; root cause: lack of input validation could let an authenticated, remote attacker craft an HTTPS...

CVE-2024-20424

CVE-2024-20424 affects Cisco Secure Firewall Management Center (FMC) Web UI. The flaw is insufficient input validation of HTTP requests in the FMC web-based management interface, enabling an authenticated remote attacker (with at least Security Analyst read-only credentials) to execute arbitrary ...

CVE-2019-12683

Cisco Firepower Management Center (FMC) web UI SQL injection vulnerabilities allow authenticated remote attackers to inject arbitrary SQL via improper input validation. Exploitation could disclose sensitive data, alter data, or execute commands on the underlying OS, potentially impacting availabi...

CVE-2020-3410

CVE-2020-3410 affects Cisco Firepower Management Center (FMC) Software CAC authentication: vulnerability in session invalidation that allows an unauthenticated, remote attacker with a valid CAC to bypass authentication and access FMC with the privileges of a CAC-authenticated user currently logge...

CVE-2017-6673

Cisco Firepower Management Center (FMC) is affected by CVE-2017-6673. The issue is an information-disclosure vulnerability where an authenticated, remote attacker could obtain user information due to verbose HTTP log output. Affected releases include FMC 6.1.0.2 and 6.2.0; 6.2.0 is listed as fixe...

CVE-2020-3515

Summary (CVE-2020-3515) : Cisco Firepower Management Center (FMC) software is affected by multiple cross-site scripting (XSS) vulnerabilities in its web-based management interface. The issues arise from insufficient validation of user-supplied input in the interface, enabling an unauthenticated, ...

CVE-2016-6439

CVE-2016-6439 affects Cisco Firepower System Software prior to 6.0.1. The denial-of-service arises in the detection engine’s HTTP packet stream reassembly, where an unauthenticated remote attacker can send crafted HTTP streams to trigger the Snort process to restart. If the Snort process restarts...

CVE-2018-0233

The CVE-2018-0233 issue affects Cisco Firepower System Software 6.0.0 and later, where the SSL packet reassembly in the detection engine can be exploited by sending crafted SSL connections to cause memory exhaustion and a DoS. Root cause is improper handling of changes to SSL connection states in...

CVE-2018-0333

Cisco FireSIGHT System Software contains a VPN configuration management vulnerability that allows an unauthenticated, remote attacker to bypass VPN policies. Root cause: incorrect handling of configured interface names and VPN parameters during dynamic CLI configuration changes, enabling an attac...

CVE-2017-3809

CVE-2017-3809 affects Cisco Firepower Management Center (FMC) Policy deployment module. An unauthenticated, remote attacker could exploit a flaw in the rules engine (lack of condition checks) to prevent deployment of a complete and accurate rule base by spoofing Object IDs of Port objects. Affect...

CVE-2018-0384

The CVE-2018-0384 entry describes a vulnerability in the Cisco FireSIGHT System Software detection engine where TCP packets arriving out of order during a TCP SYN retransmission are mishandled, allowing an unauthenticated, remote attacker to bypass a URL-based access control policy. The impact is...

CVE-2019-12689

Cisco Firepower Management Center (FMC) web interface is vulnerable to unauthenticated input-validation errors that can enable remote code execution with high impact. Affected FMC versions include 6.1.0, 6.2.0, 6.2.1, 6.2.2 and 6.2.2.1 (per multiple sources); exploits require an authenticated rem...

CVE-2022-20872

Cisco Firepower Management Center (FMC) faces multiple stored XSS vulnerabilities in its web-based management interface due to insufficient validation of user input. An authenticated, remote attacker could supply crafted input in various FMC UI fields to execute script code within the interface o...

CVE-2023-20005

CVE-2023-20005 concerns Cisco Firepower Management Center (FMC) Web UI vulnerabilities where insufficient validation of user-supplied input enables stored cross-site scripting. The issue affects the FMC web-based management interface and could allow an unauthenticated, remote attacker to insert c...

CVE-2020-3311

CVE-2020-3311 concerns the web interface of Cisco Firepower Management Center (FMC). The issue arises from improper input validation of HTTP request parameters, enabling an unauthenticated, remote attacker to intercept/modify a user’s HTTP request and redirect the user to a malicious web page. Co...

CVE-2021-1456

CVE-2021-1456 affects Cisco Firepower Management Center (FMC) Web UI. Root cause: insufficient validation of user-supplied input in the web-based management interface. A remote, unauthenticated attacker could lure a user to click a crafted link, enabling arbitrary script execution in the interfac...

CVE-2021-34754

Cisco Firepower Threat Defense (FTD) Software is affected by multiple ENIP payload-inspection vulnerabilities that allow an unauthenticated attacker to bypass configured access control and intrusion policies by sending specially crafted ENIP packets. The root cause is incomplete deep packet inspe...

CVE-2024-20264

CVE-2024-20264 concerns Cisco Secure Firewall Management Center (formerly Firepower FMC). The issue is a cross-site scripting (XSS) vulnerability in the web-based management interface caused by insufficient validation of user-supplied input across several data fields. An authenticated, remote att...

CVE-2016-9193

CVE-2016-9193 affects Cisco Firepower Management Center and FireSIGHT System Software when using a file policy with Block Malware. The root cause is described as incorrect handling of duplicate downloads of malware files, enabling an unauthenticated, remote attacker to bypass malware detection/bl...

CVE-2019-1802

Cisco Firepower Management Center (FMC) is affected by CVE-2019-1802: an authenticated, remote attacker can exploit a cross-site scripting (XSS) vulnerability due to insufficient validation of input in the web-based management interface. A successful exploit requires a user to view a report conta...

CVE-2021-1458

Cisco Firepower Management Center (FMC) is affected by multiple XSS vulnerabilities in its web-based management interface due to insufficient validation of user input. An unauthenticated, remote attacker can lure a user into clicking a crafted link to execute arbitrary script code in the context ...

CVE-2021-34751

CVE-2021-34751 affects Cisco Firepower Management Center (FMC) software. The vulnerability stems from improper encryption of sensitive information stored in the FMC GUI configuration manager, allowing an authenticated, low-privilege, remote attacker to view sensitive configuration parameters in c...

CVE-2018-0365

Cisco Firepower Management Center’s web-based management interface is affected by a CSRF vulnerability due to insufficient CSRF protections. An unauthenticated, remote attacker could lure a user into clicking a malicious link and perform arbitrary actions in the web UI with the user’s privileges....

CVE-2020-3549

The CVE-2020-3549 entry is backed by several connected documents describing a sftunnel MITM issue in Cisco Firepower FMC/FTD. The flaw arises from insufficient sftunnel negotiation protection during initial device registration, allowing an unauthenticated attacker in a man-in-the-middle position ...

CVE-2021-1455

CVE-2021-1455 relates to multiple cross-site scripting (XSS) vulnerabilities in Cisco Firepower Management Center (FMC) web-based management interface. The root cause is insufficient validation of user-supplied input in the FMC web UI, enabling an unauthenticated, remote attacker to persuade a us...

CVE-2024-20361

Cisco CVE-2024-20361 affects Firepower Management Center (FMC) Software, enabling an unauthenticated remote attacker to bypass access controls on managed Firepower Threat Defense (FTD) devices. The root cause is the incorrect deployment of the Object Groups for ACLs feature from FMC to FTD in hig...

CVE-2017-3847

CVE-2017-3847 affects Cisco Firepower Management Center Web Framework. An authenticated, remote attacker can exploit a vulnerability in the web interface by sending crafted URLs to execute arbitrary script code in the browser (XSS). Root cause: insufficient validation/sanitization of user input. ...

CVE-2019-12701

Cisco Firepower Management Center (FMC) Software is affected by CVE-2019-12701, a file and malware inspection policy bypass vulnerability. The issue arises from insufficient validation of incoming traffic, allowing an unauthenticated, remote attacker to bypass file and malware inspection policies...

CVE-2019-1696

Cisco Firepower Threat Defense (FTD) software is affected by CVE-2019-1696 through multiple DoS vulnerabilities in the SMB Protocol preprocessor detection engine. An unauthenticated, adjacent or remote attacker could cause a denial of service. Affected products are FTD with SMB preprocessor detec...

CVE-2020-3499

CVE-2020-3499 affects Cisco Firepower Management Center (FMC) Software in the licensing service. The issue allows an unauthenticated, remote attacker to cause a DoS by sending malicious requests that mishandle system resource values, rendering the FMC unresponsive and hindering management of depe...