CVE-2021-1474

CVE-2021-1474 relates to Cisco Umbrella where the Admin Audit Log Export and Scheduled Reports features permit authenticated attackers to perform formula and link injections via CSV/linked content. Root cause: improper neutralization of formula elements in CSV files. Impact could affect confident...

CVE-2021-1475

CVE-2021-1475 affects Cisco Umbrella in the Admin audit log export and Scheduled Reports features. The root cause is improper neutralization of user-supplied input, enabling an authenticated, remote attacker to perform link and CSV/formula injections in reports. The advisory notes that Cisco rele...

CVE-2020-3337

Cisco Umbrella web server vulnerability (CVE-2020-3337) stems from improper input validation of URL parameters in an HTTP request, enabling an unauthenticated, remote attacker to redirect users to a malicious URL. Connected sources confirm affected product: Cisco Umbrella web server; vulnerabilit...

CVE-2018-0435

CVE-2018-0435 (Cisco Umbrella API Unauthorized Access) affects Cisco Umbrella API due to insufficient authentication configurations, enabling an authenticated remote attacker to read and potentially modify data across their own organization and other organizations. The connected documents confirm...

CVE-2022-20969

Cisco Umbrella stores data in management dashboard pages and is vulnerable to stored XSS due to unsanitized user input. The CVE-2022-20969 description and multiple connected sources confirm an authenticated, remote attacker could entice a user to click a malicious link and execute arbitrary scrip...

CVE-2019-1792

CVE-2019-1792 describes an XSS vulnerability in Cisco Umbrella’s URL block page caused by insufficient validation of input parameters. An unauthenticated, remote attacker could entice a user to click a crafted link, potentially enabling arbitrary script execution in the interface context or acces...

CVE-2021-1350

CVE-2021-1350 affects the Cisco Umbrella Dashboard web UI. The issue stems from insufficient rate limiting in the web UI, which could allow an unauthenticated, remote attacker to degrade service performance by sending crafted HTTPS packets at a high, sustained rate. Cisco has issued an advisory a...

CVE-2019-1807

The CVE-2019-1807 issue affects the Cisco Umbrella Dashboard web UI. It arises from session management: when a user authenticates and changes credentials in another active session, the app does not invalidate the existing session. An attacker with a separate, authenticated session could access th...

CVE-2020-3246

CVE-2020-3246 involves Cisco Umbrella’s web server and a CRLF injection due to insufficient input validation. An unauthenticated, remote attacker could entice a user to visit a crafted URL to inject arbitrary HTTP headers into responses. The connected Cisco advisory notes software updates exist a...

CVE-2021-40126

Cisco Umbrella exposes an email-enumeration vulnerability in its web-based dashboard. An authenticated, remote attacker could attempt to modify a user’s email address and trigger an overly descriptive error message when the new address already exists, allowing enumeration of existing email addres...