CVE-2020-3499

CVE-2020-3499 affects Cisco Firepower Management Center (FMC) Software in the licensing service. The issue allows an unauthenticated, remote attacker to cause a DoS by sending malicious requests that mishandle system resource values, rendering the FMC unresponsive and hindering management of depe...

CVE-2020-3514

CVE-2020-3514 describes a Cisco Firepower Threat Defense (FTD) Software multi-instance container escape. An authenticated, local attacker with valid device credentials could modify a startup container configuration file to escape the container and execute commands with root privileges in the host...

CVE-2017-3847

CVE-2017-3847 affects Cisco Firepower Management Center Web Framework. An authenticated, remote attacker can exploit a vulnerability in the web interface by sending crafted URLs to execute arbitrary script code in the browser (XSS). Root cause: insufficient validation/sanitization of user input. ...

CVE-2024-20275

Cisco Secure Firewall Management Center (FMC) Software’s cluster backup feature is vulnerable due to insufficient validation of data from the web-based management interface. An authenticated user with Network Administrator privileges could trigger a near-user action (cluster backup) to cause the ...

CVE-2019-1802

Cisco Firepower Management Center (FMC) is affected by CVE-2019-1802: an authenticated, remote attacker can exploit a cross-site scripting (XSS) vulnerability due to insufficient validation of input in the web-based management interface. A successful exploit requires a user to view a report conta...

CVE-2020-3549

The CVE-2020-3549 entry is backed by several connected documents describing a sftunnel MITM issue in Cisco Firepower FMC/FTD. The flaw arises from insufficient sftunnel negotiation protection during initial device registration, allowing an unauthenticated attacker in a man-in-the-middle position ...

CVE-2021-1455

CVE-2021-1455 relates to multiple cross-site scripting (XSS) vulnerabilities in Cisco Firepower Management Center (FMC) web-based management interface. The root cause is insufficient validation of user-supplied input in the FMC web UI, enabling an unauthenticated, remote attacker to persuade a us...

CVE-2022-20926

CVE-2022-20926 relates to the Cisco Firepower Management Center (FMC) web management interface. The issue stems from insufficient validation of user-supplied parameters on certain API endpoints, allowing an authenticated remote attacker with valid Device permissions to send crafted input and exec...

CVE-2024-20379

Cisco Secure Firewall Management Center (FMC) Software contains a vulnerability in its web-based management interface that could allow an authenticated, remote attacker to read arbitrary files from the underlying operating system. The issue arises from improper validation of user-supplied input; ...

CVE-2024-20387

CVE-2024-20387 affects Cisco FMC Software (Web-based management interface). The issue is due to improper input sanitization, enabling an authenticated, remote attacker to store malicious content for stored XSS by persuading a user to click a malicious link. Impact is stored XSS on the affected de...

CVE-2025-20148

CVE-2025-20148 affects Cisco Secure Firewall Management Center (FMC) Web UI. The flaw arises from improper validation of user-supplied data, enabling an authenticated attacker (requires at least a Security Analyst, Read Only) to inject arbitrary HTML into device-generated documents. Consequences ...

CVE-2016-1342

Cisco FirePOWER Management Center (FMC) versions 5.3–6.0.0.1 are affected by an information-disclosure vulnerability where the device login page reveals potentially sensitive software-version information by reading help HTML files. The root cause is verbose output returned from HTML file retrieva...

CVE-2019-12682

CVE-2019-12682 affects Cisco Firepower Management Center (FMC) Software. The vulnerability set consists of multiple SQL injection flaws in the FMC web-based management interface caused by improper input validation. An authenticated, remote attacker could send crafted SQL queries to the FMC backen...

CVE-2019-12701

Cisco Firepower Management Center (FMC) Software is affected by CVE-2019-12701, a file and malware inspection policy bypass vulnerability. The issue arises from insufficient validation of incoming traffic, allowing an unauthenticated, remote attacker to bypass file and malware inspection policies...

CVE-2021-34754

Cisco Firepower Threat Defense (FTD) Software is affected by multiple ENIP payload-inspection vulnerabilities that allow an unauthenticated attacker to bypass configured access control and intrusion policies by sending specially crafted ENIP packets. The root cause is incomplete deep packet inspe...

CVE-2016-6439

CVE-2016-6439 affects Cisco Firepower System Software prior to 6.0.1. The denial-of-service arises in the detection engine’s HTTP packet stream reassembly, where an unauthenticated remote attacker can send crafted HTTP streams to trigger the Snort process to restart. If the Snort process restarts...

CVE-2017-12220

Cisco Firepower Management Center is affected by CVE-2017-12220: a reflected cross-site scripting vulnerability in the web-based management interface due to insufficient validation of user-supplied input. An unauthenticated, remote attacker could lure a user into clicking a crafted link to execut...

CVE-2019-12681

CVE-2019-12681 affects Cisco Firepower Management Center (FMC) web-based management interface. The vulnerabilities arise from improper input validation, enabling an authenticated, remote attacker to perform arbitrary SQL injections via crafted queries. Impact described in sources includes unautho...

CVE-2020-3308

Cisco Firepower Threat Defense (FTD) Software is vulnerable in its Image Signature Verification feature. The root cause is improper verification of digital signatures for patch images, enabling an authenticated, remote attacker with administrator-level credentials to craft and load an unsigned pa...

CVE-2024-20409

CVE-2024-20409 affects Cisco Firepower Management Center (FMC) Web UI. The issue is insufficient validation of user-supplied input in the web-based management interface, enabling an unauthenticated, remote attacker to perform a cross-site scripting (XSS) attack by inserting crafted input into int...

CVE-2016-1413

Cisco Firepower Management Center Web Interface Code Injection Vulnerability (CVE-2016-1413) affects FMC versions 5.4.0–6.0.0.1. The issue stems from improper sanitization of certain parameter values, allowing an authenticated, remote attacker to inject code and modify pages in the web interface....

CVE-2019-12688

CVE-2019-12688 affects Cisco Firepower Management Center (FMC) web UI. The vulnerability arises from insufficient input validation in the FMC web UI, allowing an authenticated, remote attacker to execute arbitrary commands on the affected device. The issue is evidenced across multiple sources (Ci...

CVE-2019-12691

Cisco Firepower Management Center (FMC) is affected by a directory traversal vulnerability in its web-based management interface due to insufficient input validation. An authenticated, remote attacker could send a crafted HTTP request to exploit this and bypass security restrictions to access the...

CVE-2023-20206

Cisco Firepower Management Center (FMC) web-based management interface is affected by stored cross-site scripting (XSS) vulnerabilities due to insufficient input validation. An unauthenticated, remote attacker could insert crafted input in various interface fields to execute arbitrary script code...

CVE-2024-20377

CVE-2024-20377 concerns Cisco Firepower Management Center (FMC) web-based management interface. A stored XSS vulnerability arises from improper validation of user-supplied input, enabling an authenticated, remote attacker to lure a user into clicking a crafted link, which could execute arbitrary ...

CVE-2017-12300

CVE-2017-12300 affects Cisco Firepower System Software’s SNORT detection engine. The vulnerability stems from incorrect SMB2 file detection when the file length is used for matching, allowing an unauthenticated, remote attacker to bypass a file policy blocking SMB2 traffic by sending a crafted SM...

CVE-2018-15458

Cisco Firepower Management Center (FMC) Shell Access Filter vulnerability allows an unauthenticated, remote attacker to trigger unbounded writes to a system log file when used with certain remote authentication configurations. This can cause high disk utilization, leading to a DoS and instability...

CVE-2019-1696

Cisco Firepower Threat Defense (FTD) software is affected by CVE-2019-1696 through multiple DoS vulnerabilities in the SMB Protocol preprocessor detection engine. An unauthenticated, adjacent or remote attacker could cause a denial of service. Affected products are FTD with SMB preprocessor detec...

CVE-2020-3307

CVE-2020-3307 affects Cisco Firepower Management Center (FMC) Web UI. It enables an unauthenticated, remote attacker to write arbitrary entries to the device log via a crafted HTTP request due to insufficient input validation. Impact per docs is log data manipulation; exploitation is via network ...

CVE-2020-3312

CVE-2020-3312 affects Cisco Firepower Threat Defense (FTD) Software. The vulnerability stems from insufficient application identification in the FTD policy configuration, enabling an unauthenticated, remote attacker to read sensitive data by sending specifically crafted traffic to an affected dev...

CVE-2024-20410

Cisco Firepower Management Center (FMC) web-based management interface is affected by a cross-site scripting (XSS) vulnerability due to insufficient input validation. The issue allows an unauthenticated, remote attacker to craft input in interface data fields that could execute arbitrary script c...

CVE-2024-20415

Cisco Firepower Management Center (FMC) web interface suffers reflected XSS due to insufficient validation of user-supplied input. Affected component is the web-based management UI; exploitation by an unauthenticated, remote attacker could run arbitrary script code in the interface context or acc...

CVE-2024-20482

CVE-2024-20482 affects Cisco Secure Firewall Management Center (FMC) web-based management interface. An authenticated user with a custom read-only role can exploit insufficient validation of role permissions to perform a write operation, potentially modifying certain parts of the configuration. T...

CVE-2019-12686

CVE-2019-12686 concerns multiple SQL injection vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC). The root cause is improper input validation, enabling an authenticated, remote attacker to send crafted SQL queries to the FMC backend. Impact statement...

CVE-2020-3318

CVE-2020-3318 affects Cisco Firepower Management Center (FMC) Software and Cisco Firepower User Agent Software. The issue is described as multiple vulnerabilities enabling an unauthenticated, remote attacker to access a sensitive part of an affected system with a high-privileged account via stati...

CVE-2024-20340

The CVE-2024-20340 issue affects Cisco Secure Firewall Management Center (formerly Firepower FMC) web-based management. The vulnerability is an SQL injection caused by insufficient validation of user-supplied input in the FMC web interface, exploitable by an authenticated attacker who has a valid...

CVE-2024-20374

Cisco Secure Firewall Management Center (FMC) Command Injection (CVE-2024-20374) affects FMC web-based management interface. The root cause is insufficient input validation of certain HTTP request parameters, enabling an authenticated administrator to execute arbitrary commands on the underlying ...

CVE-2019-12680

CVE-2019-12680 covers multiple SQL injection vulnerabilities in Cisco Firepower Management Center (FMC) web-based management interface. Root cause: improper input validation allowing crafted SQL queries via authenticated remote access. Impact: an attacker could view restricted data, modify data, ...

CVE-2019-12690

CVE-2019-12690 is a command-injection flaw in the Cisco Firepower Management Center (FMC) web UI. An authenticated, remote attacker can submit crafted input via the UI to execute arbitrary commands with root privileges on the underlying OS, due to insufficient validation of user-supplied input. T...

CVE-2019-1949

CVE-2019-1949 affects Cisco Firepower Management Center. The issue is a cross-site scripting (XSS) vulnerability in the web-based management interface due to insufficient validation of user-supplied input. An authenticated, remote attacker could lure a user to click a malicious link and execute a...

CVE-2017-12221

Cisco Firepower Management Center is affected by CVE-2017-12221, a cross-site scripting (XSS) vulnerability in the web framework caused by insufficient validation of user-supplied input. An authenticated, remote attacker could exploit this in the web interface to execute arbitrary script code in ...

CVE-2019-15280

CVE-2019-15280 affects Cisco Firepower Management Center (FMC) web-based management interface. The issue is a stored XSS caused by insufficient validation of user-supplied input in the FMC UI, enabling an authenticated, remote attacker with administrator credentials to inject malicious script tha...

CVE-2020-3313

CVE-2020-3313 concerns Cisco Firepower Management Center (FMC) web UI. The vulnerability stems from insufficient validation of user-supplied input in the FMC web-based management interface, enabling an unauthenticated, remote attacker to perform a cross-site scripting (XSS) attack by persuading a...

CVE-2024-20274

Cisco Secure Firewall Management Center (FMC) Web UI HTML Injection (CVE-2024-20274) affects the FMC web-based management interface. A vulnerability arises from improper validation of user-supplied data, enabling an authenticated attacker with policy-editing credentials to inject arbitrary HTML i...

CVE-2024-20300

CVE-2024-20300 affects Cisco Firepower Management Center (FMC) Software, targeting the web-based management interface. The issue is caused by insufficient validation of user-supplied input in the FMC web UI, enabling an authenticated, remote attacker to perform a cross-site scripting (XSS) attack...

CVE-2024-20471

Cisco Secure Firewall Management Center (FMC) Software is affected by a SQL injection vulnerability in its web-based management interface. The issue stems from inadequate input validation in the admin-facing interface, requiring Administrator privileges and an authenticated session to exploit. Su...

CVE-2017-6715

CVE-2017-6715 describes an XSS vulnerability in the web framework of Cisco Firepower Management Center. An authenticated, remote attacker could exploit the issue via crafted input in the web interface to execute script code in a user’s browser. Affected products are Cisco Firepower Management Cen...

CVE-2017-6716

The CVE-2017-6716 issue affects Cisco Firepower Management Center (FMC) web framework. A stored XSS vulnerability exists in FMC’s web interface that can be exploited by an authenticated, remote attacker against users, with affected releases prior to 6.0.0.0 (notably 5.4.1.6). The root cause is im...

CVE-2019-12687

CVE-2019-12687 affects Cisco Firepower Management Center (FMC) via the web UI. The root cause is insufficient input validation in the web UI, enabling an authenticated, remote attacker to execute arbitrary commands on the FMC. The issue is associated with FMC web UI components and has high impact...

CVE-2019-1833

CVE-2019-1833 affects Cisco Firepower Threat Defense Software: an SSL/TLS parser issue that permits an unauthenticated remote attacker to bypass configured policies by exploiting improper parsing of TLS packet header attributes. Exploitation could allow uninspected traffic to pass through the sys...