CVE-2019-12679

Cisco Firepower Management Center (FMC) exposes multiple SQL injection vulnerabilities in its web-based management interface due to improper input validation. An authenticated, remote attacker could send crafted SQL queries to the FMC backend, potentially viewing restricted data, altering configu...

CVE-2019-1696

Cisco Firepower Threat Defense (FTD) software is affected by CVE-2019-1696 through multiple DoS vulnerabilities in the SMB Protocol preprocessor detection engine. An unauthenticated, adjacent or remote attacker could cause a denial of service. Affected products are FTD with SMB preprocessor detec...

CVE-2019-1802

Cisco Firepower Management Center (FMC) is affected by CVE-2019-1802: an authenticated, remote attacker can exploit a cross-site scripting (XSS) vulnerability due to insufficient validation of input in the web-based management interface. A successful exploit requires a user to view a report conta...

CVE-2020-3499

CVE-2020-3499 affects Cisco Firepower Management Center (FMC) Software in the licensing service. The issue allows an unauthenticated, remote attacker to cause a DoS by sending malicious requests that mishandle system resource values, rendering the FMC unresponsive and hindering management of depe...

CVE-2022-20926

CVE-2022-20926 relates to the Cisco Firepower Management Center (FMC) web management interface. The issue stems from insufficient validation of user-supplied parameters on certain API endpoints, allowing an authenticated remote attacker with valid Device permissions to send crafted input and exec...

CVE-2018-0365

Cisco Firepower Management Center’s web-based management interface is affected by a CSRF vulnerability due to insufficient CSRF protections. An unauthenticated, remote attacker could lure a user into clicking a malicious link and perform arbitrary actions in the web UI with the user’s privileges....

CVE-2019-12682

CVE-2019-12682 affects Cisco Firepower Management Center (FMC) Software. The vulnerability set consists of multiple SQL injection flaws in the FMC web-based management interface caused by improper input validation. An authenticated, remote attacker could send crafted SQL queries to the FMC backen...

CVE-2019-12701

Cisco Firepower Management Center (FMC) Software is affected by CVE-2019-12701, a file and malware inspection policy bypass vulnerability. The issue arises from insufficient validation of incoming traffic, allowing an unauthenticated, remote attacker to bypass file and malware inspection policies...

CVE-2021-1455

CVE-2021-1455 relates to multiple cross-site scripting (XSS) vulnerabilities in Cisco Firepower Management Center (FMC) web-based management interface. The root cause is insufficient validation of user-supplied input in the FMC web UI, enabling an unauthenticated, remote attacker to persuade a us...

CVE-2023-20074

CVE-2023-20074 : Cisco Firepower Management Center (FMC) web-based management interface is affected by multiple stored XSS vulnerabilities caused by insufficient validation of user-supplied input. An unauthenticated, remote attacker could inject crafted input into data fields to execute arbitrary...

CVE-2016-1342

Cisco FirePOWER Management Center (FMC) versions 5.3–6.0.0.1 are affected by an information-disclosure vulnerability where the device login page reveals potentially sensitive software-version information by reading help HTML files. The root cause is verbose output returned from HTML file retrieva...

CVE-2016-1413

Cisco Firepower Management Center Web Interface Code Injection Vulnerability (CVE-2016-1413) affects FMC versions 5.4.0–6.0.0.1. The issue stems from improper sanitization of certain parameter values, allowing an authenticated, remote attacker to inject code and modify pages in the web interface....

CVE-2017-12220

Cisco Firepower Management Center is affected by CVE-2017-12220: a reflected cross-site scripting vulnerability in the web-based management interface due to insufficient validation of user-supplied input. An unauthenticated, remote attacker could lure a user into clicking a crafted link to execut...

CVE-2020-3549

The CVE-2020-3549 entry is backed by several connected documents describing a sftunnel MITM issue in Cisco Firepower FMC/FTD. The flaw arises from insufficient sftunnel negotiation protection during initial device registration, allowing an unauthenticated attacker in a man-in-the-middle position ...

CVE-2024-20275

Cisco Secure Firewall Management Center (FMC) Software’s cluster backup feature is vulnerable due to insufficient validation of data from the web-based management interface. An authenticated user with Network Administrator privileges could trigger a near-user action (cluster backup) to cause the ...

CVE-2024-20377

CVE-2024-20377 concerns Cisco Firepower Management Center (FMC) web-based management interface. A stored XSS vulnerability arises from improper validation of user-supplied input, enabling an authenticated, remote attacker to lure a user into clicking a crafted link, which could execute arbitrary ...

CVE-2019-12691

Cisco Firepower Management Center (FMC) is affected by a directory traversal vulnerability in its web-based management interface due to insufficient input validation. An authenticated, remote attacker could send a crafted HTTP request to exploit this and bypass security restrictions to access the...

CVE-2019-1699

Cisco Firepower Threat Defense (FTD) Software is affected by an authenticated, local command-injection vulnerability in its CLI due to insufficient input validation. An attacker can inject commands into arguments for a specific command, potentially executing commands with root privileges. The cor...

CVE-2020-3308

Cisco Firepower Threat Defense (FTD) Software is vulnerable in its Image Signature Verification feature. The root cause is improper verification of digital signatures for patch images, enabling an authenticated, remote attacker with administrator-level credentials to craft and load an unsigned pa...

CVE-2020-3312

CVE-2020-3312 affects Cisco Firepower Threat Defense (FTD) Software. The vulnerability stems from insufficient application identification in the FTD policy configuration, enabling an unauthenticated, remote attacker to read sensitive data by sending specifically crafted traffic to an affected dev...

CVE-2020-3318

CVE-2020-3318 affects Cisco Firepower Management Center (FMC) Software and Cisco Firepower User Agent Software. The issue is described as multiple vulnerabilities enabling an unauthenticated, remote attacker to access a sensitive part of an affected system with a high-privileged account via stati...

CVE-2024-20409

CVE-2024-20409 affects Cisco Firepower Management Center (FMC) Web UI. The issue is insufficient validation of user-supplied input in the web-based management interface, enabling an unauthenticated, remote attacker to perform a cross-site scripting (XSS) attack by inserting crafted input into int...

CVE-2024-20472

Cisco Secure Firewall Management Center (FMC) Software contains a web interface SQL injection vulnerability (CVE-2024-20472) exploitable by an attacker authenticated as Administrator. The issue stems from insufficient input validation in the FMC web UI, enabling crafted SQL queries that could dis...

CVE-2019-12686

CVE-2019-12686 concerns multiple SQL injection vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC). The root cause is improper input validation, enabling an authenticated, remote attacker to send crafted SQL queries to the FMC backend. Impact statement...

CVE-2019-12688

CVE-2019-12688 affects Cisco Firepower Management Center (FMC) web UI. The vulnerability arises from insufficient input validation in the FMC web UI, allowing an authenticated, remote attacker to execute arbitrary commands on the affected device. The issue is evidenced across multiple sources (Ci...

CVE-2020-3307

CVE-2020-3307 affects Cisco Firepower Management Center (FMC) Web UI. It enables an unauthenticated, remote attacker to write arbitrary entries to the device log via a crafted HTTP request due to insufficient input validation. Impact per docs is log data manipulation; exploitation is via network ...

CVE-2024-20340

The CVE-2024-20340 issue affects Cisco Secure Firewall Management Center (formerly Firepower FMC) web-based management. The vulnerability is an SQL injection caused by insufficient validation of user-supplied input in the FMC web interface, exploitable by an authenticated attacker who has a valid...

CVE-2025-20148

CVE-2025-20148 affects Cisco Secure Firewall Management Center (FMC) Web UI. The flaw arises from improper validation of user-supplied data, enabling an authenticated attacker (requires at least a Security Analyst, Read Only) to inject arbitrary HTML into device-generated documents. Consequences ...

CVE-2017-12221

Cisco Firepower Management Center is affected by CVE-2017-12221, a cross-site scripting (XSS) vulnerability in the web framework caused by insufficient validation of user-supplied input. An authenticated, remote attacker could exploit this in the web interface to execute arbitrary script code in ...

CVE-2018-15458

Cisco Firepower Management Center (FMC) Shell Access Filter vulnerability allows an unauthenticated, remote attacker to trigger unbounded writes to a system log file when used with certain remote authentication configurations. This can cause high disk utilization, leading to a DoS and instability...

CVE-2024-20410

Cisco Firepower Management Center (FMC) web-based management interface is affected by a cross-site scripting (XSS) vulnerability due to insufficient input validation. The issue allows an unauthenticated, remote attacker to craft input in interface data fields that could execute arbitrary script c...

CVE-2016-6368

CVE-2016-6368 describes a denial-of-service in Cisco Firepower System Software through improper input validation in the detection engine’s Pragmatic General Multicast (PGM) protocol decoding. A crafted PGM packet can cause the Snort process to restart, potentially bypassing traffic inspection or ...

CVE-2017-6715

CVE-2017-6715 describes an XSS vulnerability in the web framework of Cisco Firepower Management Center. An authenticated, remote attacker could exploit the issue via crafted input in the web interface to execute script code in a user’s browser. Affected products are Cisco Firepower Management Cen...

CVE-2019-12680

CVE-2019-12680 covers multiple SQL injection vulnerabilities in Cisco Firepower Management Center (FMC) web-based management interface. Root cause: improper input validation allowing crafted SQL queries via authenticated remote access. Impact: an attacker could view restricted data, modify data, ...

CVE-2019-1980

CVE-2019-1980 affects Cisco Firepower Threat Defense Software (FTD), Cisco FirePOWER Services for ASA, and Cisco Firepower Management Center. Root cause: improper detection of the initial use of a protocol on a nonstandard port in the protocol inspection component, enabling an unauthenticated, re...

CVE-2020-3313

CVE-2020-3313 concerns Cisco Firepower Management Center (FMC) web UI. The vulnerability stems from insufficient validation of user-supplied input in the FMC web-based management interface, enabling an unauthenticated, remote attacker to perform a cross-site scripting (XSS) attack by persuading a...

CVE-2024-20415

Cisco Firepower Management Center (FMC) web interface suffers reflected XSS due to insufficient validation of user-supplied input. Affected component is the web-based management UI; exploitation by an unauthenticated, remote attacker could run arbitrary script code in the interface context or acc...

CVE-2024-20482

CVE-2024-20482 affects Cisco Secure Firewall Management Center (FMC) web-based management interface. An authenticated user with a custom read-only role can exploit insufficient validation of role permissions to perform a write operation, potentially modifying certain parts of the configuration. T...

CVE-2017-12300

CVE-2017-12300 affects Cisco Firepower System Software’s SNORT detection engine. The vulnerability stems from incorrect SMB2 file detection when the file length is used for matching, allowing an unauthenticated, remote attacker to bypass a file policy blocking SMB2 traffic by sending a crafted SM...

CVE-2017-6716

The CVE-2017-6716 issue affects Cisco Firepower Management Center (FMC) web framework. A stored XSS vulnerability exists in FMC’s web interface that can be exploited by an authenticated, remote attacker against users, with affected releases prior to 6.0.0.0 (notably 5.4.1.6). The root cause is im...

CVE-2019-15280

CVE-2019-15280 affects Cisco Firepower Management Center (FMC) web-based management interface. The issue is a stored XSS caused by insufficient validation of user-supplied input in the FMC UI, enabling an authenticated, remote attacker with administrator credentials to inject malicious script tha...

CVE-2024-20274

Cisco Secure Firewall Management Center (FMC) Web UI HTML Injection (CVE-2024-20274) affects the FMC web-based management interface. A vulnerability arises from improper validation of user-supplied data, enabling an authenticated attacker with policy-editing credentials to inject arbitrary HTML i...

CVE-2024-20379

Cisco Secure Firewall Management Center (FMC) Software contains a vulnerability in its web-based management interface that could allow an authenticated, remote attacker to read arbitrary files from the underlying operating system. The issue arises from improper validation of user-supplied input; ...

CVE-2015-6411

Cisco FirePOWER Management Center is affected by CVE-2015-6411. Versions 5.4.1.3, 6.0.0, and 6.0.1 disclose potentially sensitive software version information via verbose responses when help files are requested, enabling an unauthenticated, remote attacker to read the disclosed field. The root ca...

CVE-2016-6419

CVE-2016-6419 is a SQL injection vulnerability in Cisco Firepower Management Center (FMC). The issue affects FMC versions 4.10.3 through 5.4.0 and stems from a lack of input validation in the web framework, allowing remote authenticated users to execute arbitrary SQL commands via unspecified vect...

CVE-2018-0383

Cisco FireSIGHT System Software has CVE-2018-0383 in its detection engine, permitting an unauthenticated, remote FTP connection to bypass a file policy (Block upload with reset) by exploiting improper handling of FTP control connections. Affected: FireSIGHT/FMS software; vulnerability detailed in...

CVE-2019-1671

CVE-2019-1671 concerns the Cisco Firepower Management Center (FMC) web-based management interface. It describes an XSS vulnerability caused by insufficient validation of user-supplied input, enabling an unauthenticated, remote attacker to lure a user into clicking a malicious link and potentially...

CVE-2019-1949

CVE-2019-1949 affects Cisco Firepower Management Center. The issue is a cross-site scripting (XSS) vulnerability in the web-based management interface due to insufficient validation of user-supplied input. An authenticated, remote attacker could lure a user to click a malicious link and execute a...

CVE-2024-20300

CVE-2024-20300 affects Cisco Firepower Management Center (FMC) Software, targeting the web-based management interface. The issue is caused by insufficient validation of user-supplied input in the FMC web UI, enabling an authenticated, remote attacker to perform a cross-site scripting (XSS) attack...

CVE-2016-1431

Cisco Firepower Management Center is affected by CVE-2016-1431: an XSS vulnerability in the HTTP framework allows unauthenticated remote attackers to inject arbitrary web script or HTML via a crafted URL. Affected versions include FMC 4.10.3 and 5.2.0–5.4.0 (including 5.3.0/5.3.1 as listed in sou...