Vendor CVEs

Cisco Systems, Inc.

All CVEs

6,961 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2018-0152	Cisco Systems, Inc. iOS Xe	Hig	0.57	8.8	0.03	Mar 28, 2018	A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to gain elevated privileges on an affected device. The vulnerability exists because the affected software does not reset the privilege level for each…
CVE-2018-0213	Cisco Systems, Inc. Identity Services Engine Software	Hig	0.57	8.8	0.03	Mar 8, 2018	A vulnerability in the credential reset functionality for Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to gain elevated privileges. The vulnerability is due to a lack of proper input validation. An attacker could exploit this vulnerability…
CVE-2018-0210	Cisco Systems, Inc. Data Center Network Manager	Hig	0.57	8.8	0.01	Mar 8, 2018	A vulnerability in the web-based management interface of Cisco Data Center Network Manager could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to…
CVE-2018-0148	Cisco Systems, Inc. Ucs Director	Hig	0.57	8.8	0.01	Feb 22, 2018	A vulnerability in the web-based management interface of Cisco UCS Director Software and Cisco Integrated Management Controller (IMC) Supervisor Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary…
CVE-2017-5826	Microfocus Aruba Clearpass Policy Manager	Hig	0.57	8.8	0.03	Feb 15, 2018	An authenticated remote code execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.
CVE-2017-5825	Microfocus Aruba Clearpass Policy Manager	Hig	0.57	8.8	0.02	Feb 15, 2018	A privilege escalation vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.
CVE-2018-0113	Cisco Systems, Inc. Ucs Central Software	Hig	0.57	8.8	0.02	Feb 8, 2018	A vulnerability in an operations script of Cisco UCS Central could allow an authenticated, remote attacker to execute arbitrary shell commands with the privileges of the daemon user. The vulnerability is due to insufficient input validation. An attacker could exploit this…
CVE-2018-0107	Cisco Systems, Inc. Prime Service Catalog	Hig	0.57	8.8	0.01	Jan 18, 2018	A vulnerability in the web framework of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to execute unwanted actions on an affected device. The vulnerability is due to a lack of cross-site request forgery (CSRF) protection. An attacker could exploit…
CVE-2018-0099	Cisco Systems, Inc. D9800 Network Transport Receiver	Hig	0.57	8.8	0.03	Jan 18, 2018	A vulnerability in the web management GUI of the Cisco D9800 Network Transport Receiver could allow an authenticated, remote attacker to perform a command injection attack. The vulnerability is due to insufficient input validation of GUI command arguments. An attacker could…
CVE-2017-12343	Cisco Systems, Inc. Data Center Network Manager	Hig	0.57	8.8	0.02	Nov 30, 2017	Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) Software could allow a remote attacker to inject arbitrary values into DCNM configuration parameters, redirect a user to a malicious website, inject malicious content into a DCNM client interface, or conduct a…
CVE-2017-12262	Cisco Systems, Inc. Application Policy Infrastructure Controller Enterprise Module	Hig	0.57	8.8	0.01	Nov 2, 2017	A vulnerability within the firewall configuration of the Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) could allow an unauthenticated, adjacent attacker to gain privileged access to services only available on the internal network of the device.…
CVE-2017-12271	Cisco Systems, Inc. Spa300 Firmware	Hig	0.57	8.8	0.01	Oct 19, 2017	A vulnerability in Cisco SPA300 and SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute unwanted actions on an affected device. The vulnerability is due to a lack of cross-site request forgery (CSRF) protection. An attacker could exploit this…
CVE-2017-12230	Cisco Systems, Inc. iOS Xe	Hig	0.57	8.8	0.03	Sep 29, 2017	A vulnerability in the web-based user interface (web UI) of Cisco IOS XE 16.2 could allow an authenticated, remote attacker to elevate their privileges on an affected device. The vulnerability is due to incorrect default permission settings for new users who are created by using…
CVE-2017-12226	Cisco Systems, Inc. iOS Xe	Hig	0.57	8.8	0.03	Sep 29, 2017	A vulnerability in the web-based Wireless Controller GUI of Cisco IOS XE Software for Cisco 5760 Wireless LAN Controllers, Cisco Catalyst 4500E Supervisor Engine 8-E (Wireless) Switches, and Cisco New Generation Wireless Controllers (NGWC) 3850 could allow an authenticated,…
CVE-2017-12253	Cisco Systems, Inc. Unified Intelligence Center	Hig	0.57	8.8	0.01	Sep 21, 2017	A vulnerability in the Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to execute unwanted actions. The vulnerability is due to a lack of cross-site request forgery (CSRF) protection. An attacker could exploit this vulnerability by tricking the…
CVE-2017-12214	Cisco Systems, Inc. Unified Customer Voice Portal	Hig	0.57	8.8	0.02	Sep 21, 2017	A vulnerability in the Operations, Administration, Maintenance, and Provisioning (OAMP) credential reset functionality for Cisco Unified Customer Voice Portal (CVP) could allow an authenticated, remote attacker to gain elevated privileges. The vulnerability is due to a lack of…
CVE-2017-12216	Cisco Systems, Inc. Socialminer	Hig	0.57	8.8	0.03	Sep 7, 2017	A vulnerability in the web-based user interface of Cisco SocialMiner could allow an unauthenticated, remote attacker to have read and write access to information stored in the affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries…
CVE-2017-6757	Cisco Systems, Inc. Unified Communications Manager	Hig	0.57	8.8	0.02	Aug 7, 2017	A vulnerability in Cisco Unified Communications Manager 10.5(2.10000.5), 11.0(1.10000.10), and 11.5(1.10000.6) could allow an authenticated, remote attacker to conduct a blind SQL injection attack. The vulnerability is due to a failure to validate user-supplied input used in SQL…
CVE-2017-6756	Cisco Systems, Inc. Prime Collaboration Provisioning	Hig	0.57	8.8	0.01	Aug 7, 2017	A vulnerability in the Web UI Application of the Cisco Prime Collaboration Provisioning Tool through 12.2 could allow an unauthenticated, remote attacker to execute unwanted actions. The vulnerability is due to a lack of defense against cross-site request forgery (CSRF) attacks.…
CVE-2017-9490	Comcast Arris TG1682G	Hig	0.57	8.8	0.01	Jul 31, 2017	The Comcast firmware on Arris TG1682G (eMTA&DOCSIS version 10.0.132.SIP.PC20.CT, software version TG1682_2.2p7s2_PROD_sey) devices allows configuration changes via CSRF.
CVE-2017-9489	Cisco Systems, Inc. DPC3939	Hig	0.57	8.8	0.01	Jul 31, 2017	The Comcast firmware on Cisco DPC3939B (firmware version dpc3939b-v303r204217-150321a-CMCST) devices allows configuration changes via CSRF.
CVE-2017-9488	Cisco Systems, Inc. DPC3939	Hig	0.57	8.8	0.01	Jul 31, 2017	The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) and DPC3941T (firmware version DPC3941_2.5s3_PROD_sey) devices allows remote attackers to access the web UI by establishing a session to the wan0 WAN IPv6 address and then…
CVE-2017-6712	Cisco Systems, Inc. Elastic Services Controller	Hig	0.57	8.8	0.02	Jul 6, 2017	A vulnerability in certain commands of Cisco Elastic Services Controller could allow an authenticated, remote attacker to elevate privileges to root and run dangerous commands on the server. The vulnerability occurs because a "tomcat" user on the system can run certain shell…
CVE-2017-6692	Cisco Systems, Inc. Ultra Services Framework	Hig	0.57	8.8	0.02	Jun 13, 2017	A vulnerability in Cisco Ultra Services Framework Element Manager could allow an authenticated, remote attacker to log in to the device with the privileges of the root user, aka an Insecure Default Account Information Vulnerability. More Information: CSCvd85710. Known Affected…
CVE-2017-6689	Cisco Systems, Inc. Elastic Services Controller	Hig	0.57	8.8	0.01	Jun 13, 2017	A vulnerability in the ConfD CLI of Cisco Elastic Services Controllers could allow an authenticated, remote attacker to log in to an affected system as the admin user, aka an Insecure Default Administrator Credentials Vulnerability. More Information: CSCvc76661. Known Affected…
CVE-2017-6688	Cisco Systems, Inc. Elastic Services Controller	Hig	0.57	8.8	0.02	Jun 13, 2017	A vulnerability in Cisco Elastic Services Controllers could allow an authenticated, remote attacker to log in to an affected system as the Linux root user, aka an Insecure Default Password Vulnerability. More Information: CSCvc76631. Known Affected Releases: 2.2(9.76).
CVE-2017-6687	Cisco Systems, Inc. Ultra Services Framework	Hig	0.57	8.8	0.01	Jun 13, 2017	A vulnerability in Cisco Ultra Services Framework Element Manager could allow an authenticated, remote attacker with access to the management network to log in to the affected device using default credentials present on the system, aka an Insecure Default Password Vulnerability.…
CVE-2017-6686	Cisco Systems, Inc. Ultra Services Framework	Hig	0.57	8.8	0.01	Jun 13, 2017	A vulnerability in Cisco Ultra Services Framework Element Manager could allow an authenticated, remote attacker with access to the management network to log in as an admin or oper user of the affected device, aka an Insecure Default Credentials Vulnerability. More Information:…
CVE-2017-6685	Cisco Systems, Inc. Ultra Services Framework Staging Server	Hig	0.57	8.8	0.01	Jun 13, 2017	A vulnerability in Cisco Ultra Services Framework Staging Server could allow an authenticated, remote attacker with access to the management network to log in as an admin user of the affected device, aka an Insecure Default Credentials Vulnerability. More Information:…
CVE-2017-6684	Cisco Systems, Inc. Elastic Services Controller	Hig	0.57	8.8	0.02	Jun 13, 2017	A vulnerability in Cisco Elastic Services Controllers could allow an authenticated, remote attacker to log in to an affected system as the Linux admin user, aka an Insecure Default Credentials Vulnerability. More Information: CSCvc76651. Known Affected Releases: 21.0.0.
CVE-2017-6682	Cisco Systems, Inc. Elastic Services Controller	Hig	0.57	8.8	0.02	Jun 13, 2017	A vulnerability in the ConfD CLI of Cisco Elastic Services Controllers could allow an authenticated, remote attacker to run arbitrary commands as the Linux tomcat user on an affected system. More Information: CSCvc76620. Known Affected Releases: 2.2(9.76).
CVE-2017-6659	Cisco Systems, Inc. Prime Collaboration Assurance	Hig	0.57	8.8	0.01	Jun 13, 2017	A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. More Information: CSCvc91800.…
CVE-2017-6634	Cisco Systems, Inc. Industrial Ethernet 1000 Series Switches	Hig	0.57	8.8	0.01	May 22, 2017	A vulnerability in the Device Manager web interface of Cisco Industrial Ethernet 1000 Series Switches 1.3 could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of an affected system. The vulnerability is due to…
CVE-2017-6619	Cisco Systems, Inc. Integrated Management Controller Supervisor	Hig	0.57	8.8	0.03	Apr 20, 2017	A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an authenticated, remote attacker to execute arbitrary commands on an affected system. The vulnerability exists because the affected software does not sufficiently sanitize…
CVE-2017-6607	Cisco Systems, Inc. Cisco Adaptive Security Appliance	Hig	0.57	8.7	0.02	Apr 20, 2017	A vulnerability in the DNS code of Cisco ASA Software could allow an unauthenticated, remote attacker to cause an affected device to reload or corrupt the information present in the device's local DNS cache. The vulnerability is due to a flaw in handling crafted DNS response…
CVE-2017-3858	Cisco Systems, Inc. iOS Xe	Hig	0.57	8.8	0.03	Mar 22, 2017	A vulnerability in the web framework of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation of HTTP parameters supplied by the user. An…
CVE-2017-3854	Cisco Systems, Inc. Wireless Lan Controller Software	Hig	0.57	8.8	0.01	Mar 15, 2017	A vulnerability in the mesh code of Cisco Wireless LAN Controller (WLC) software could allow an unauthenticated, remote attacker to impersonate a WLC in a meshed topology. The vulnerability is due to insufficient authentication of the parent access point in a mesh configuration.…
CVE-2017-3819	Cisco Systems, Inc. Virtualized Packet Core	Hig	0.57	8.8	0.03	Mar 15, 2017	A privilege escalation vulnerability in the Secure Shell (SSH) subsystem in the StarOS operating system for Cisco ASR 5000 Series, ASR 5500 Series, ASR 5700 Series devices, and Cisco Virtualized Packet Core could allow an authenticated, remote attacker to gain unrestricted, root…
CVE-2017-3835	Cisco Systems, Inc. Identity Services Engine Software	Hig	0.57	8.8	0.02	Feb 22, 2017	A vulnerability in the sponsor portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access notices owned by other users, because of SQL Injection. More Information: CSCvb15627. Known Affected Releases: 1.4(0.908).
CVE-2017-3801	Cisco Systems, Inc. Unified Computing System Director	Hig	0.57	8.8	0.00	Feb 15, 2017	A vulnerability in the web-based GUI of Cisco UCS Director 6.0.0.0 and 6.0.0.1 could allow an authenticated, local attacker to execute arbitrary workflow items with just an end-user profile, a Privilege Escalation Vulnerability. The vulnerability is due to improper role-based…
CVE-2017-3794	Cisco Systems, Inc. Webex Meetings Server	Hig	0.57	8.8	0.01	Jan 26, 2017	A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against an administrative user. More Information: CSCuz03317. Known Affected Releases: 2.6. Known Fixed Releases: 2.7.1.12.
CVE-2016-9218	Cisco Systems, Inc. Hybrid Meeting Server	Hig	0.57	8.8	0.01	Jan 26, 2017	A vulnerability in Cisco Hybrid Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against the user of the web interface. More Information: CSCvc28662. Known Affected Releases: 1.0.
CVE-2016-9217	Cisco Systems, Inc. Intercloud Fabric	Hig	0.57	8.8	0.01	Dec 26, 2016	A vulnerability in Cisco Intercloud Fabric for Business and Cisco Intercloud Fabric for Providers could allow an unauthenticated, remote attacker to connect to the database used by these products. More Information: CSCus99394. Known Affected Releases: 7.3(0)ZN(0.99).
CVE-2016-6468	Cisco Systems, Inc. Emergency Responder	Hig	0.57	8.8	0.01	Dec 14, 2016	A vulnerability in the web-based management interface of Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. More Information: CSCvb06663. Known…
CVE-2016-6444	Cisco Systems, Inc. Meeting Server	Hig	0.57	8.8	0.01	Oct 27, 2016	A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a Web Bridge user. More Information: CSCvb03308. Known Affected Releases: 1.8, 1.9, 2.0.
CVE-2016-6443	Cisco Systems, Inc. Prime Infrastructure	Hig	0.57	8.8	0.03	Oct 27, 2016	A vulnerability in the Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL database interface could allow an authenticated, remote attacker to impact system confidentiality by executing a subset of arbitrary SQL queries that can cause product instability.…
CVE-2016-6442	Cisco Systems, Inc. Finesse	Hig	0.57	8.8	0.01	Oct 27, 2016	A vulnerability in Cisco Finesse Agent and Supervisor Desktop Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against the user of the web interface. More Information: CSCvb57213. Known Affected Releases: 11.0(1).
CVE-2016-6427	Cisco Systems, Inc. Unified Contact Center Express	Hig	0.57	8.8	0.01	Oct 6, 2016	Cross-site request forgery (CSRF) vulnerability in Cisco Unified Intelligence Center (CUIC) 8.5.4 through 9.1(1), as used in Unified Contact Center Express 10.0(1) through 11.0(1), allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCuy75036…
CVE-2016-6417	Cisco Systems, Inc. Firesight System Software	Hig	0.57	8.8	0.01	Oct 5, 2016	Cross-site request forgery (CSRF) vulnerability in Cisco FireSIGHT System Software 4.10.2 through 6.1.0 and Firepower Management Center allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCva21636.
CVE-2016-1470	Cisco Systems, Inc. Small Business 220	Hig	0.57	8.8	0.01	Sep 2, 2016	Cross-site request forgery (CSRF) vulnerability in the web-based management interface on Cisco Small Business 220 devices with firmware before 1.0.1.1 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuz76230.

CVE-2018-0152HigMar 28, 2018
Cisco Systems, Inc.
iOS Xe
risk 0.57cvss 8.8epss 0.03
A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to gain elevated privileges on an affected device. The vulnerability exists because the affected software does not reset the privilege level for each…
CVE-2018-0213HigMar 8, 2018
Cisco Systems, Inc.
Identity Services Engine Software
risk 0.57cvss 8.8epss 0.03
A vulnerability in the credential reset functionality for Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to gain elevated privileges. The vulnerability is due to a lack of proper input validation. An attacker could exploit this vulnerability…
CVE-2018-0210HigMar 8, 2018
Cisco Systems, Inc.
Data Center Network Manager
risk 0.57cvss 8.8epss 0.01
A vulnerability in the web-based management interface of Cisco Data Center Network Manager could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to…
CVE-2018-0148HigFeb 22, 2018
Cisco Systems, Inc.
Ucs Director
risk 0.57cvss 8.8epss 0.01
A vulnerability in the web-based management interface of Cisco UCS Director Software and Cisco Integrated Management Controller (IMC) Supervisor Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary…
CVE-2017-5826HigFeb 15, 2018
Microfocus
Aruba Clearpass Policy Manager
risk 0.57cvss 8.8epss 0.03
An authenticated remote code execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.
CVE-2017-5825HigFeb 15, 2018
Microfocus
Aruba Clearpass Policy Manager
risk 0.57cvss 8.8epss 0.02
A privilege escalation vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.
CVE-2018-0113HigFeb 8, 2018
Cisco Systems, Inc.
Ucs Central Software
risk 0.57cvss 8.8epss 0.02
A vulnerability in an operations script of Cisco UCS Central could allow an authenticated, remote attacker to execute arbitrary shell commands with the privileges of the daemon user. The vulnerability is due to insufficient input validation. An attacker could exploit this…
CVE-2018-0107HigJan 18, 2018
Cisco Systems, Inc.
Prime Service Catalog
risk 0.57cvss 8.8epss 0.01
A vulnerability in the web framework of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to execute unwanted actions on an affected device. The vulnerability is due to a lack of cross-site request forgery (CSRF) protection. An attacker could exploit…
CVE-2018-0099HigJan 18, 2018
Cisco Systems, Inc.
D9800 Network Transport Receiver
risk 0.57cvss 8.8epss 0.03
A vulnerability in the web management GUI of the Cisco D9800 Network Transport Receiver could allow an authenticated, remote attacker to perform a command injection attack. The vulnerability is due to insufficient input validation of GUI command arguments. An attacker could…
CVE-2017-12343HigNov 30, 2017
Cisco Systems, Inc.
Data Center Network Manager
risk 0.57cvss 8.8epss 0.02
Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) Software could allow a remote attacker to inject arbitrary values into DCNM configuration parameters, redirect a user to a malicious website, inject malicious content into a DCNM client interface, or conduct a…
CVE-2017-12262HigNov 2, 2017
Cisco Systems, Inc.
Application Policy Infrastructure Controller Enterprise Module
risk 0.57cvss 8.8epss 0.01
A vulnerability within the firewall configuration of the Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) could allow an unauthenticated, adjacent attacker to gain privileged access to services only available on the internal network of the device.…
CVE-2017-12271HigOct 19, 2017
Cisco Systems, Inc.
Spa300 Firmware
risk 0.57cvss 8.8epss 0.01
A vulnerability in Cisco SPA300 and SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute unwanted actions on an affected device. The vulnerability is due to a lack of cross-site request forgery (CSRF) protection. An attacker could exploit this…
CVE-2017-12230HigSep 29, 2017
Cisco Systems, Inc.
iOS Xe
risk 0.57cvss 8.8epss 0.03
A vulnerability in the web-based user interface (web UI) of Cisco IOS XE 16.2 could allow an authenticated, remote attacker to elevate their privileges on an affected device. The vulnerability is due to incorrect default permission settings for new users who are created by using…
CVE-2017-12226HigSep 29, 2017
Cisco Systems, Inc.
iOS Xe
risk 0.57cvss 8.8epss 0.03
A vulnerability in the web-based Wireless Controller GUI of Cisco IOS XE Software for Cisco 5760 Wireless LAN Controllers, Cisco Catalyst 4500E Supervisor Engine 8-E (Wireless) Switches, and Cisco New Generation Wireless Controllers (NGWC) 3850 could allow an authenticated,…
CVE-2017-12253HigSep 21, 2017
Cisco Systems, Inc.
Unified Intelligence Center
risk 0.57cvss 8.8epss 0.01
A vulnerability in the Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to execute unwanted actions. The vulnerability is due to a lack of cross-site request forgery (CSRF) protection. An attacker could exploit this vulnerability by tricking the…
CVE-2017-12214HigSep 21, 2017
Cisco Systems, Inc.
Unified Customer Voice Portal
risk 0.57cvss 8.8epss 0.02
A vulnerability in the Operations, Administration, Maintenance, and Provisioning (OAMP) credential reset functionality for Cisco Unified Customer Voice Portal (CVP) could allow an authenticated, remote attacker to gain elevated privileges. The vulnerability is due to a lack of…
CVE-2017-12216HigSep 7, 2017
Cisco Systems, Inc.
Socialminer
risk 0.57cvss 8.8epss 0.03
A vulnerability in the web-based user interface of Cisco SocialMiner could allow an unauthenticated, remote attacker to have read and write access to information stored in the affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries…
CVE-2017-6757HigAug 7, 2017
Cisco Systems, Inc.
Unified Communications Manager
risk 0.57cvss 8.8epss 0.02
A vulnerability in Cisco Unified Communications Manager 10.5(2.10000.5), 11.0(1.10000.10), and 11.5(1.10000.6) could allow an authenticated, remote attacker to conduct a blind SQL injection attack. The vulnerability is due to a failure to validate user-supplied input used in SQL…
CVE-2017-6756HigAug 7, 2017
Cisco Systems, Inc.
Prime Collaboration Provisioning
risk 0.57cvss 8.8epss 0.01
A vulnerability in the Web UI Application of the Cisco Prime Collaboration Provisioning Tool through 12.2 could allow an unauthenticated, remote attacker to execute unwanted actions. The vulnerability is due to a lack of defense against cross-site request forgery (CSRF) attacks.…
CVE-2017-9490HigJul 31, 2017
Comcast
Arris TG1682G
risk 0.57cvss 8.8epss 0.01
The Comcast firmware on Arris TG1682G (eMTA&DOCSIS version 10.0.132.SIP.PC20.CT, software version TG1682_2.2p7s2_PROD_sey) devices allows configuration changes via CSRF.
CVE-2017-9489HigJul 31, 2017
Cisco Systems, Inc.
DPC3939
risk 0.57cvss 8.8epss 0.01
The Comcast firmware on Cisco DPC3939B (firmware version dpc3939b-v303r204217-150321a-CMCST) devices allows configuration changes via CSRF.
CVE-2017-9488HigJul 31, 2017
Cisco Systems, Inc.
DPC3939
risk 0.57cvss 8.8epss 0.01
The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) and DPC3941T (firmware version DPC3941_2.5s3_PROD_sey) devices allows remote attackers to access the web UI by establishing a session to the wan0 WAN IPv6 address and then…
CVE-2017-6712HigJul 6, 2017
Cisco Systems, Inc.
Elastic Services Controller
risk 0.57cvss 8.8epss 0.02
A vulnerability in certain commands of Cisco Elastic Services Controller could allow an authenticated, remote attacker to elevate privileges to root and run dangerous commands on the server. The vulnerability occurs because a "tomcat" user on the system can run certain shell…
CVE-2017-6692HigJun 13, 2017
Cisco Systems, Inc.
Ultra Services Framework
risk 0.57cvss 8.8epss 0.02
A vulnerability in Cisco Ultra Services Framework Element Manager could allow an authenticated, remote attacker to log in to the device with the privileges of the root user, aka an Insecure Default Account Information Vulnerability. More Information: CSCvd85710. Known Affected…
CVE-2017-6689HigJun 13, 2017
Cisco Systems, Inc.
Elastic Services Controller
risk 0.57cvss 8.8epss 0.01
A vulnerability in the ConfD CLI of Cisco Elastic Services Controllers could allow an authenticated, remote attacker to log in to an affected system as the admin user, aka an Insecure Default Administrator Credentials Vulnerability. More Information: CSCvc76661. Known Affected…
CVE-2017-6688HigJun 13, 2017
Cisco Systems, Inc.
Elastic Services Controller
risk 0.57cvss 8.8epss 0.02
A vulnerability in Cisco Elastic Services Controllers could allow an authenticated, remote attacker to log in to an affected system as the Linux root user, aka an Insecure Default Password Vulnerability. More Information: CSCvc76631. Known Affected Releases: 2.2(9.76).
CVE-2017-6687HigJun 13, 2017
Cisco Systems, Inc.
Ultra Services Framework
risk 0.57cvss 8.8epss 0.01
A vulnerability in Cisco Ultra Services Framework Element Manager could allow an authenticated, remote attacker with access to the management network to log in to the affected device using default credentials present on the system, aka an Insecure Default Password Vulnerability.…
CVE-2017-6686HigJun 13, 2017
Cisco Systems, Inc.
Ultra Services Framework
risk 0.57cvss 8.8epss 0.01
A vulnerability in Cisco Ultra Services Framework Element Manager could allow an authenticated, remote attacker with access to the management network to log in as an admin or oper user of the affected device, aka an Insecure Default Credentials Vulnerability. More Information:…
CVE-2017-6685HigJun 13, 2017
Cisco Systems, Inc.
Ultra Services Framework Staging Server
risk 0.57cvss 8.8epss 0.01
A vulnerability in Cisco Ultra Services Framework Staging Server could allow an authenticated, remote attacker with access to the management network to log in as an admin user of the affected device, aka an Insecure Default Credentials Vulnerability. More Information:…
CVE-2017-6684HigJun 13, 2017
Cisco Systems, Inc.
Elastic Services Controller
risk 0.57cvss 8.8epss 0.02
A vulnerability in Cisco Elastic Services Controllers could allow an authenticated, remote attacker to log in to an affected system as the Linux admin user, aka an Insecure Default Credentials Vulnerability. More Information: CSCvc76651. Known Affected Releases: 21.0.0.
CVE-2017-6682HigJun 13, 2017
Cisco Systems, Inc.
Elastic Services Controller
risk 0.57cvss 8.8epss 0.02
A vulnerability in the ConfD CLI of Cisco Elastic Services Controllers could allow an authenticated, remote attacker to run arbitrary commands as the Linux tomcat user on an affected system. More Information: CSCvc76620. Known Affected Releases: 2.2(9.76).
CVE-2017-6659HigJun 13, 2017
Cisco Systems, Inc.
Prime Collaboration Assurance
risk 0.57cvss 8.8epss 0.01
A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. More Information: CSCvc91800.…
CVE-2017-6634HigMay 22, 2017
Cisco Systems, Inc.
Industrial Ethernet 1000 Series Switches
risk 0.57cvss 8.8epss 0.01
A vulnerability in the Device Manager web interface of Cisco Industrial Ethernet 1000 Series Switches 1.3 could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of an affected system. The vulnerability is due to…
CVE-2017-6619HigApr 20, 2017
Cisco Systems, Inc.
Integrated Management Controller Supervisor
risk 0.57cvss 8.8epss 0.03
A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an authenticated, remote attacker to execute arbitrary commands on an affected system. The vulnerability exists because the affected software does not sufficiently sanitize…
CVE-2017-6607HigApr 20, 2017
Cisco Systems, Inc.
Cisco Adaptive Security Appliance
risk 0.57cvss 8.7epss 0.02
A vulnerability in the DNS code of Cisco ASA Software could allow an unauthenticated, remote attacker to cause an affected device to reload or corrupt the information present in the device's local DNS cache. The vulnerability is due to a flaw in handling crafted DNS response…
CVE-2017-3858HigMar 22, 2017
Cisco Systems, Inc.
iOS Xe
risk 0.57cvss 8.8epss 0.03
A vulnerability in the web framework of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation of HTTP parameters supplied by the user. An…
CVE-2017-3854HigMar 15, 2017
Cisco Systems, Inc.
Wireless Lan Controller Software
risk 0.57cvss 8.8epss 0.01
A vulnerability in the mesh code of Cisco Wireless LAN Controller (WLC) software could allow an unauthenticated, remote attacker to impersonate a WLC in a meshed topology. The vulnerability is due to insufficient authentication of the parent access point in a mesh configuration.…
CVE-2017-3819HigMar 15, 2017
Cisco Systems, Inc.
Virtualized Packet Core
risk 0.57cvss 8.8epss 0.03
A privilege escalation vulnerability in the Secure Shell (SSH) subsystem in the StarOS operating system for Cisco ASR 5000 Series, ASR 5500 Series, ASR 5700 Series devices, and Cisco Virtualized Packet Core could allow an authenticated, remote attacker to gain unrestricted, root…
CVE-2017-3835HigFeb 22, 2017
Cisco Systems, Inc.
Identity Services Engine Software
risk 0.57cvss 8.8epss 0.02
A vulnerability in the sponsor portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access notices owned by other users, because of SQL Injection. More Information: CSCvb15627. Known Affected Releases: 1.4(0.908).
CVE-2017-3801HigFeb 15, 2017
Cisco Systems, Inc.
Unified Computing System Director
risk 0.57cvss 8.8epss 0.00
A vulnerability in the web-based GUI of Cisco UCS Director 6.0.0.0 and 6.0.0.1 could allow an authenticated, local attacker to execute arbitrary workflow items with just an end-user profile, a Privilege Escalation Vulnerability. The vulnerability is due to improper role-based…
CVE-2017-3794HigJan 26, 2017
Cisco Systems, Inc.
Webex Meetings Server
risk 0.57cvss 8.8epss 0.01
A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against an administrative user. More Information: CSCuz03317. Known Affected Releases: 2.6. Known Fixed Releases: 2.7.1.12.
CVE-2016-9218HigJan 26, 2017
Cisco Systems, Inc.
Hybrid Meeting Server
risk 0.57cvss 8.8epss 0.01
A vulnerability in Cisco Hybrid Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against the user of the web interface. More Information: CSCvc28662. Known Affected Releases: 1.0.
CVE-2016-9217HigDec 26, 2016
Cisco Systems, Inc.
Intercloud Fabric
risk 0.57cvss 8.8epss 0.01
A vulnerability in Cisco Intercloud Fabric for Business and Cisco Intercloud Fabric for Providers could allow an unauthenticated, remote attacker to connect to the database used by these products. More Information: CSCus99394. Known Affected Releases: 7.3(0)ZN(0.99).
CVE-2016-6468HigDec 14, 2016
Cisco Systems, Inc.
Emergency Responder
risk 0.57cvss 8.8epss 0.01
A vulnerability in the web-based management interface of Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. More Information: CSCvb06663. Known…
CVE-2016-6444HigOct 27, 2016
Cisco Systems, Inc.
Meeting Server
risk 0.57cvss 8.8epss 0.01
A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a Web Bridge user. More Information: CSCvb03308. Known Affected Releases: 1.8, 1.9, 2.0.
CVE-2016-6443HigOct 27, 2016
Cisco Systems, Inc.
Prime Infrastructure
risk 0.57cvss 8.8epss 0.03
A vulnerability in the Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL database interface could allow an authenticated, remote attacker to impact system confidentiality by executing a subset of arbitrary SQL queries that can cause product instability.…
CVE-2016-6442HigOct 27, 2016
Cisco Systems, Inc.
Finesse
risk 0.57cvss 8.8epss 0.01
A vulnerability in Cisco Finesse Agent and Supervisor Desktop Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against the user of the web interface. More Information: CSCvb57213. Known Affected Releases: 11.0(1).
CVE-2016-6427HigOct 6, 2016
Cisco Systems, Inc.
Unified Contact Center Express
risk 0.57cvss 8.8epss 0.01
Cross-site request forgery (CSRF) vulnerability in Cisco Unified Intelligence Center (CUIC) 8.5.4 through 9.1(1), as used in Unified Contact Center Express 10.0(1) through 11.0(1), allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCuy75036…
CVE-2016-6417HigOct 5, 2016
Cisco Systems, Inc.
Firesight System Software
risk 0.57cvss 8.8epss 0.01
Cross-site request forgery (CSRF) vulnerability in Cisco FireSIGHT System Software 4.10.2 through 6.1.0 and Firepower Management Center allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCva21636.
CVE-2016-1470HigSep 2, 2016
Cisco Systems, Inc.
Small Business 220
risk 0.57cvss 8.8epss 0.01
Cross-site request forgery (CSRF) vulnerability in the web-based management interface on Cisco Small Business 220 devices with firmware before 1.0.1.1 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuz76230.

Page 13 of 140