A vulnerability within the Endpoint Learning feature of Cisco Nexus 9000 Series Switches running in Application Centric Infrastructure (ACI) mode could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition on an endpoint device in certain circumstances. The vulnerability is due to improper endpoint learning when packets are received on a specific port from outside the ACI fabric and destined to an endpoint located on a border leaf when Disable Remote Endpoint Learning has been enabled. This can result in a Remote (XR) entry being created for the impacted endpoint that will become stale if the endpoint migrates to a different port or leaf switch. This results in traffic not reaching the impacted endpoint until the Remote entry can be relearned by another mechanism.


A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerability exists because software digital signatures are not properly verified during CLI command execution. An attacker could exploit this vulnerability to install an unsigned software image on an affected device.


A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated remote attacker to cause the SNMP application to leak system memory which could cause an affected device to restart unexpectedly. The vulnerability is due to improper error handling when processing inbound SNMP packets. An attacker could exploit this vulnerability by sending multiple crafted SNMP packets to an affected device. A successful exploit could allow the attacker to cause the SNMP application to leak system memory because of an improperly handled error condition during packet processing. Over time this memory leak could cause the SNMP application to restart multiple times leading to a system-level restart and a denial of service (DoS) condition.


A vulnerability in the Object Linking & Embedding (OLE2) file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper input and validation checking mechanisms for OLE2 files sent an affected device. An attacker could exploit this vulnerability by sending malformed OLE2 files to the device running an affected version ClamAV Software. An exploit could allow the attacker to cause an out-of-bounds write condition resulting in a crash that could result in a denial of service condition on an affected device.


A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated local attacker to execute arbitrary code as root. The vulnerability is due to incorrect input validation in the NX-API feature. An attacker could exploit this vulnerability by sending a crafted HTTP or HTTPS request to an internal service on an affected device that has the NX-API feature enabled. A successful exploit could allow the attacker to cause a buffer overflow and execute arbitrary code as root. Note: The NX-API feature is disabled by default. MDS 9000 Series Multilayer Switches are affected in versions prior to 8.1(1). Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I4(8) and 7.0(3)I7(1). Nexus 3500 Platform Switches are affected in versions prior to 6.0(2)A8(8). Nexus 3600 Platform Switches are affected in versions prior to 7.0(3)F3(5). Nexus 2000 5500 5600 and 6000 Series Switches are affected in versions prior to 7.3(2)N1(1). Nexus 7000 and 7700 Series Switches are affected in versions prior to 7.3(3)D1(1). Nexus 9000 Series Switches in Standalone NX-OS Mode are affected in versions prior to 7.0(3)I4(8) and 7.0(3)I7(1). Nexus 9500 R-Series Line Cards and Fabric Modules are affected in versions prior to 7.0(3)F3(5).


A vulnerability in the Hot Standby Router Protocol (HSRP) subsystem of Cisco IOS and IOS XE Software could allow an unauthenticated adjacent attacker to receive potentially sensitive information from an affected device. The vulnerability is due to insufficient memory initialization. An attacker could exploit this vulnerability by receiving HSRPv2 traffic from an adjacent HSRP member. A successful exploit could allow the attacker to receive potentially sensitive information from the adjacent device.


A vulnerability in the Easy Virtual Switching System (VSS) of Cisco IOS XE Software on Catalyst 4500 Series Switches could allow an unauthenticated adjacent attacker to cause the switches to reload. The vulnerability is due to incomplete error handling when processing Cisco Discovery Protocol (CDP) packets used with the Easy Virtual Switching System. An attacker could exploit this vulnerability by sending a specially crafted CDP packet. An exploit could allow the attacker to cause the device to reload resulting in a denial of service (DoS) condition.


A vulnerability in the Intelligent Platform Management Interface (IPMI) of Cisco Integrated Management Controller (IMC) could allow an authenticated remote attacker to inject arbitrary commands that are executed with root privileges on the underlying operating system (OS). The vulnerability is due to insufficient input validation of user-supplied commands. An attacker who has administrator privileges and access to the network where the IPMI resides could exploit this vulnerability by submitting crafted input to the affected commands. A successful exploit could allow the attacker to gain root privileges on the affected device.


A vulnerability in the BIOS upgrade utility of Cisco Unified Computing System (UCS) C-Series Rack Servers could allow an authenticated local attacker to install compromised BIOS firmware on an affected device. The vulnerability is due to insufficient validation of the firmware image file. An attacker could exploit this vulnerability by executing the BIOS upgrade utility with a specific set of options. A successful exploit could allow the attacker to bypass the firmware signature-verification process and install compromised BIOS firmware on an affected device.


A vulnerability in the internal packet-processing functionality of the Cisco StarOS operating system running on virtual platforms could allow an unauthenticated remote attacker to cause an affected device to stop processing traffic resulting in a denial of service (DoS) condition. The vulnerability is due to a logic error that may occur under specific traffic conditions. An attacker could exploit this vulnerability by sending a series of crafted packets to an affected device. A successful exploit could allow the attacker to prevent the targeted service interface from receiving any traffic which would lead to a DoS condition on the affected interface. The device may have to be manually reloaded to recover from exploitation of this vulnerability.


The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the RADIUS server settings.


A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker to execute code with root-level privileges on the underlying operating system.


A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated remote attacker to bypass authentication and get limited access to the web-based management interface. The vulnerability is due to an incorrect implementation of authentication in the web-based management interface. An attacker could exploit this vulnerability by sending a crafted authentication request to the web-based management interface on an affected system. A successful exploit could allow the attacker to view limited configuration details and potentially upload a virtual machine image.


Multiple vulnerabilities in the Server Message Block (SMB) Protocol preprocessor detection engine for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated adjacent or remote attacker to cause a denial of service (DoS) condition. For more information about these vulnerabilities see the Details section of this advisory.


A vulnerability in the CLI of Cisco Unified Communications Domain Manager (Cisco Unified CDM) Software could allow an authenticated local attacker to escape the restricted shell. The vulnerability is due to insufficient input validation of shell commands. An attacker could exploit this vulnerability by executing crafted commands in the shell. A successful exploit could allow the attacker to escape the restricted shell and access commands in the context of the restricted shell user which does not have root privileges.


A vulnerability in the web server of Cisco Integrated Management Controller (IMC) could allow an authenticated local attacker to cause a buffer overflow resulting in a denial of service (DoS) condition on an affected device. The vulnerability is due to incorrect bounds checking. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected system. An exploit could allow the attacker to cause a buffer overflow resulting in a process crash and DoS condition on the device.


A vulnerability in the HTTP traffic filtering component of Cisco Firepower Threat Defense Software Cisco FirePOWER Services Software for ASA and Cisco Firepower Management Center Software could allow an unauthenticated remote attacker to bypass filtering protections. The vulnerability is due to improper handling of HTTP requests including those communicated over a secure HTTPS connection that contain maliciously crafted headers. An attacker could exploit this vulnerability by sending malicious requests to an affected device. An exploit could allow the attacker to bypass filtering and deliver malicious requests to protected systems allowing attackers to deliver malicious content that would otherwise be blocked.


A vulnerability in the firmware of the Cisco UCS C-Series Rack Servers could allow an authenticated physical attacker to bypass Unified Extensible Firmware Interface (UEFI) Secure Boot validation checks and load a compromised software image on an affected device. The vulnerability is due to improper validation of the server firmware upgrade images. An attacker could exploit this vulnerability by installing a server firmware version that would allow the attacker to disable UEFI Secure Boot. A successful exploit could allow the attacker to bypass the signature validation checks that are done by UEFI Secure Boot technology and load a compromised software image on the affected device. A compromised software image is any software image that has not been digitally signed by Cisco.


A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated remote attacker with administrative privileges on an affected device to execute arbitrary commands. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious HTTP POST requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux shell as root. Cisco has released firmware updates that address this vulnerability.


A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. The vulnerability is due to improper session management on affected DCNM software. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to gain administrative access on the affected device.


A vulnerability in the search path processing of Cisco Directory Connector could allow an authenticated local attacker to load a binary of their choosing. The vulnerability is due to uncontrolled search path elements. An attacker could exploit this vulnerability by placing a binary of their choosing earlier in the search path utilized by Cisco Directory Connector to locate and load required resources.


A vulnerability in certain attachment detection mechanisms of the Cisco Email Security Appliance (ESA) could allow an unauthenticated remote attacker to bypass the filtering functionality of an affected device. The vulnerability is due to improper detection of certain content sent to an affected device. An attacker could exploit this vulnerability by sending certain file types without Content-Disposition information to an affected device. A successful exploit could allow an attacker to send messages that contain malicious content to users.


A vulnerability in the 802.11r Fast Transition (FT) implementation for Cisco IOS Access Points (APs) Software could allow an unauthenticated adjacent attacker to cause a denial of service (DoS) condition on an affected interface. The vulnerability is due to a lack of complete error handling condition for client authentication requests sent to a targeted interface configured for FT. An attacker could exploit this vulnerability by sending crafted authentication request traffic to the targeted interface causing the device to restart unexpectedly.


A vulnerability in the authorization subsystem of Cisco IOS XE Software could allow an authenticated but unprivileged (level 1) remote attacker to run privileged Cisco IOS commands by using the web UI. The vulnerability is due to improper validation of user privileges of web UI users. An attacker could exploit this vulnerability by submitting a malicious payload to a specific endpoint in the web UI. A successful exploit could allow the lower-privileged attacker to execute arbitrary commands with higher privileges on the affected device.


A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller (APIC) Software could allow an unauthenticated remote attacker to access sensitive system usage information. The vulnerability is due to a lack of proper data protection mechanisms for certain components in the underlying Application Centric Infrastructure (ACI). An attacker could exploit this vulnerability by attempting to observe certain network traffic when accessing the APIC. A successful exploit could allow the attacker to access and collect certain tracking data and usage statistics on an affected device.


Information disclosure in PAN-OS 7.1.23 and earlier PAN-OS 8.0.18 and earlier PAN-OS 8.1.8-h4 and earlier and PAN-OS 9.0.2 and earlier may allow for an authenticated user with read-only privileges to extract the API key of the device and/or the username/password from the XML API (in PAN-OS) and possibly escalate privileges granted to them.


A vulnerability in the web-based management interface of Cisco UCS Director and Cisco UCS Director Express for Big Data could allow an unauthenticated remote attacker to bypass authentication and execute arbitrary actions with administrator privileges on an affected system. The vulnerability is due to improper authentication request handling. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an unprivileged attacker to access and execute arbitrary actions through certain APIs.


A vulnerability in the filesystem permissions of Cisco NX-OS Software could allow an authenticated local attacker to gain read and write access to a critical configuration file. The vulnerability is due to a failure to impose strict filesystem permissions on the targeted device. An attacker could exploit this vulnerability by accessing and modifying restricted files. A successful exploit could allow an attacker to use the content of this configuration file to bypass authentication and log in as any user of the device. MDS 9000 Series Multilayer Switches are affected in versions prior to 6.2(25) 8.1(1b) and 8.3(1). Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I4(9) and 7.0(3)I7(4). Nexus 3500 Platform Switches are affected in versions prior to 6.0(2)A8(10) and 7.0(3)I7(4). Nexus 3600 Platform Switches are affected in versions prior to 7.0(3)F3(5). Nexus 2000 5500 5600 and 6000 Series Switches are affected in versions prior to 7.1(5)N1(1b) and 7.3(3)N1(1). Nexus 7000 and 7700 Series Switches are affected in versions prior to 6.2(22) 7.3(3)D1(1) and 8.2(3). Nexus 9000 Series Switches-Standalone are affected in versions prior to 7.0(3)I4(9) and 7.0(3)I7(4). Nexus 9500 R-Series Line Cards and Fabric Modules are affected in versions prior to 7.0(3)F3(5).


A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an authenticated remote attacker to write arbitrary files to the filesystem. The vulnerability is due to insufficient input validation and file-level permissions. An attacker could exploit this vulnerability by uploading invalid files to an affected device. A successful exploit could allow the attacker to write files in arbitrary locations on the filesystem. This vulnerability affects Cisco IP Phone 8800 Series products running a SIP Software release prior to 11.0(5) for Wireless IP Phone 8821 and 8821-EX; and 12.5(1)SR1 for the IP Conference Phone 8832 and the rest of the IP Phone 8800 Series.


A vulnerability in the NX API (NX-API) Sandbox interface for Cisco NX-OS Software could allow an authenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the NX-API Sandbox interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the NX-API Sandbox interface. An attacker could exploit this vulnerability by persuading a user of the NX-API Sandbox interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected NX-API Sandbox interface.


A vulnerability in Cisco AMP Threat Grid could allow an authenticated remote attacker to access sensitive information. The vulnerability is due to unsafe creation of API keys. An attacker could exploit this vulnerability by using insecure credentials to gain unauthorized access to the affected device. An exploit could allow the attacker to gain unauthorized access to information by using the API key credentials.


A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated local attacker to execute arbitrary commands on the underlying Linux operating system with the privilege level of root. The vulnerability is due to insufficient validation of arguments passed to a specific CLI command on the affected device. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability.


A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated local attacker with administrator credentials to execute arbitrary commands with elevated privileges on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability.


A vulnerability in the Software Image Management feature of Cisco DNA Center could allow an authenticated remote attacker to access to internal services without additional authentication. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending arbitrary HTTP requests to internal services. An exploit could allow the attacker to bypass any firewall or other protections to access unauthorized internal services. DNAC versions prior to 1.2.5 are affected.


A vulnerability in the web interface of Cisco RV110W RV130W and RV215W Routers could allow an unauthenticated remote attacker to acquire the list of devices that are connected to the guest network. The vulnerability is due to improper authorization of an HTTP request. An attacker could exploit this vulnerability by accessing a specific URI on the web interface of the router.


A vulnerability in the Graphite service of Cisco HyperFlex software could allow an unauthenticated remote attacker to retrieve data from the Graphite service. The vulnerability is due to insufficient authentication controls. An attacker could exploit this vulnerability by sending crafted requests to the Graphite service. A successful exploit could allow the attacker to retrieve any statistics from the Graphite service. Versions prior to 3.5(2a) are affected.


Multiple vulnerabilities in the web-based management interface of Cisco Enterprise Chat and Email could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected software. The vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit these vulnerabilities either by injecting malicious code in a chat window or by sending a crafted link to a user of the interface. In both cases the attacker must persuade the user to click the crafted link or open the chat window that contains the attacker's code. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information. Version 11.6(1) is affected.


A vulnerability in the “plug-and-play” services component of Cisco Industrial Network Director (IND) could allow an unauthenticated remote attacker to access sensitive information on an affected device. The vulnerability is due to improper access restrictions on the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to access running configuration information about devices managed by the IND including administrative credentials.


A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerability exists because software digital signatures are not properly verified during CLI command execution. An attacker could exploit this vulnerability to install an unsigned software image on an affected device.


A vulnerability in Performance Routing Version 3 (PfRv3) of Cisco IOS XE Software could allow an unauthenticated remote attacker to cause the affected device to reload. The vulnerability is due to the processing of malformed smart probe packets. An attacker could exploit this vulnerability by sending specially crafted smart probe packets at the affected device. A successful exploit could allow the attacker to reload the device resulting in a denial of service (DoS) attack on an affected system.


A vulnerability in the Network Address Translation 64 (NAT64) functions of Cisco IOS Software could allow an unauthenticated remote attacker to cause either an interface queue wedge or a device reload. The vulnerability is due to the incorrect handling of certain IPv4 packet streams that are sent through the device. An attacker could exploit this vulnerability by sending specific IPv4 packet streams through the device. An exploit could allow the attacker to either cause an interface queue wedge or a device reload resulting in a denial of service (DoS) condition.


A vulnerability in the network stack of Cisco NX-OS Software could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition on the affected device. The vulnerability is due to an issue with allocating and freeing memory buffers in the network stack. An attacker could exploit this vulnerability by sending crafted TCP streams to an affected device in a sustained way. A successful exploit could cause the network stack of an affected device to run out of available buffers impairing operations of control plane and management plane protocols resulting in a DoS condition. Note: This vulnerability can be triggered only by traffic that is destined to an affected device and cannot be exploited using traffic that transits an affected device. Nexus 1000V Switch for Microsoft Hyper-V is affected in versions prior to 5.2(1)SM3(2.1). Nexus 1000V Switch for VMware vSphere is affected in versions prior to 5.2(1)SV3(4.1a). Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I7(6) and 9.2(2). Nexus 3500 Platform Switches are affected in versions prior to 6.0(2)A8(11) 7.0(3)I7(6) and 9.2(2). Nexus 3600 Platform Switches are affected in versions prior to 7.0(3)F3(5) and 9.2(2). Nexus 5500 5600 and 6000 Series Switches are affected in versions prior to 7.1(5)N1(1b) and 7.3(5)N1(1). Nexus 7000 and 7700 Series Switches are affected in versions prior to 6.2(22. Nexus 9500 R-Series Line Cards and Fabric Modules are affected in versions prior to 7.0(3)F3(5) and 9.2(2). UCS 6200 and 6300 Series Fabric Interconnect are affected in versions prior to 3.2(3j) and 4.0(2a). UCS 6400 Series Fabric Interconnect are affected in versions prior to 4.0(2a).


A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker to execute code with root-level privileges on the underlying operating system.


A vulnerability in the implementation of the Lightweight Directory Access Protocol (LDAP) feature in Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated remote attacker to cause an affected device to reload resulting in a denial of service (DoS) condition. The vulnerabilities are due to the improper parsing of LDAP packets sent to an affected device. An attacker could exploit these vulnerabilities by sending a crafted LDAP packet using Basic Encoding Rules (BER) to be processed by an affected device. A successful exploit could allow the attacker to cause the affected device to reload resulting in a DoS condition.


A vulnerability in the web-based management interface of Cisco Webex Meetings Server could allow an unauthenticated remote attacker to access sensitive system information. The vulnerability is due to improper access control to files within the web-based management interface. An attacker could exploit this vulnerability by sending a malicious request to an affected device. A successful exploit could allow the attacker to access sensitive system information.


A vulnerability in the Quality of Voice Reporting (QOVR) service of Cisco Prime Collaboration Assurance (PCA) Software could allow an unauthenticated remote attacker to access the system as a valid user. The vulnerability is due to insufficient authentication controls. An attacker could exploit this vulnerability by connecting to the QOVR service with a valid username. A successful exploit could allow the attacker to perform actions with the privileges of the user that is used for access. This vulnerability affects Cisco PCA Software Releases prior to 12.1 SP2.


A vulnerability in the software cryptography module of the Cisco Adaptive Security Virtual Appliance (ASAv) and Firepower 2100 Series running Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated remote attacker to cause an unexpected reload of the device that results in a denial of service (DoS) condition. The vulnerability is due to a logic error with how the software cryptography module handles IPsec sessions. An attacker could exploit this vulnerability by creating and sending traffic in a high number of IPsec sessions through the targeted device. A successful exploit could cause the device to reload and result in a DoS condition.


A vulnerability in the controller authorization functionality of Cisco Nexus 9000 Series ACI Mode Switch Software could allow an authenticated local attacker to escalate standard users with root privilege on an affected device. The vulnerability is due to a misconfiguration of certain sudoers files for the bashroot component on an affected device. An attacker could exploit this vulnerability by authenticating to the affected device with a crafted user ID which may allow temporary administrative access to escalate privileges. A successful exploit could allow the attacker to escalate privileges on an affected device. This Vulnerability has been fixed in version 4.0(1h)


A vulnerability in the configuration import utility of Cisco Integrated Management Controller (IMC) could allow an unauthenticated remote attacker to have write access and upload arbitrary data to the filesystem. The vulnerability is due to a failure to delete temporarily uploaded files. An attacker could exploit this vulnerability by crafting a malicious file and uploading it to the affected device. An exploit could allow the attacker to fill up the filesystem or upload malicious scripts.


A vulnerability in the Tetration Analytics agent for Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated local attacker to execute arbitrary code as root. The vulnerability is due to an incorrect permissions setting. An attacker could exploit this vulnerability by replacing valid agent files with malicious code. A successful exploit could result in the execution of code supplied by the attacker. Nexus 9000 Series Switches in Standalone NX-OS Mode are affected running versions prior to 7.0(3)I7(5).


A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated remote attacker to retrieve sensitive information. The vulnerability is due to improper access controls for URLs. An attacker could exploit this vulnerability by connecting to an affected device via HTTP or HTTPS and requesting specific URLs. A successful exploit could allow the attacker to download the router configuration or detailed diagnostic information. Cisco has released firmware updates that address this vulnerability.


A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated local attacker to execute arbitrary commands on the underlying Linux operating system with the privilege level of root. The vulnerability is due to insufficient validation of arguments passed to a specific CLI command on the affected device. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability.


A vulnerability in the authentication service of the Cisco Unified Communications Manager IM and Presence (Unified CM IM&P) Service Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway Series could allow an unauthenticated remote attacker to cause a service outage for users attempting to authenticate resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient controls for specific memory operations. An attacker could exploit this vulnerability by sending a malformed Extensible Messaging and Presence Protocol (XMPP) authentication request to an affected system. A successful exploit could allow the attacker to cause an unexpected restart of the authentication service preventing users from successfully authenticating. Exploitation of this vulnerability does not impact users who were authenticated prior to an attack.


A vulnerability in the attachment scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated remote attacker to bypass configured content filters on the device. The vulnerability is due to improper input validation of the email body. An attacker could exploit this vulnerability by naming a malicious attachment with a specific pattern. A successful exploit could allow the attacker to bypass configured content filters that would normally block the attachment.


A vulnerability in the Web Services Management Agent (WSMA) function of Cisco IOS XE Software could allow an authenticated remote attacker to execute arbitrary Cisco IOS commands as a privilege level 15 user. The vulnerability occurs because the affected software improperly sanitizes user-supplied input. An attacker could exploit this vulnerability by submitting crafted HTTP requests to the targeted application. A successful exploit could allow the attacker to execute arbitrary commands on the affected device.


A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an unauthenticated remote attacker to access potentially sensitive system usage information. The vulnerability is due to a lack of proper data protection mechanisms. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow an attacker to view sensitive system data.


A vulnerability in the Redfish protocol of Cisco Integrated Management Controller (IMC) could allow an authenticated remote attacker to inject and execute arbitrary commands with root privileges on an affected device. The vulnerability is due to insufficient validation of user-supplied input by the affected software. An attacker could exploit this vulnerability by sending crafted authenticated commands to the web-based management interface of the affected software. A successful exploit could allow the attacker to inject and execute arbitrary commands on an affected device with root privileges.


A vulnerability in the Intelligent Platform Management Interface (IPMI) implementation of Cisco Integrated Management Controller (IMC) could allow an unauthenticated remote attacker to view sensitive system information. The vulnerability is due to insufficient security restrictions imposed by the affected software. A successful exploit could allow the attacker to view sensitive information that belongs to other users. The attacker could then use this information to conduct additional attacks.


A vulnerability in the web interface of Cisco Small Business 200 300 and 500 Series Switches software could allow an unauthenticated remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of the parameters of an HTTP request. An attacker could exploit this vulnerability by intercepting a user's HTTP request and modifying it into a request that causes the web interface to redirect the user to a specific malicious URL. This type of vulnerability is known as an open redirect attack and is used in phishing attacks that get users to unknowingly visit malicious sites.


A vulnerability the Cisco Enterprise NFV Infrastructure Software (NFVIS) restricted CLI could allow an authenticated local attacker with valid administrator-level credentials to elevate privileges and execute arbitrary commands on the underlying operating system as root. The vulnerability is due to insufficient restrictions during the execution of an affected CLI command. An attacker could exploit this vulnerability by leveraging the insufficient restrictions during the execution of an affected command. A successful exploit could allow the attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root.


A vulnerability in the Cisco Webex Teams client for Windows could allow an unauthenticated remote attacker to execute arbitrary commands on an affected system. This vulnerability is due to improper restrictions on software logging features used by the application on Windows operating systems. An attacker could exploit this vulnerability by convincing a targeted user to visit a website designed to submit malicious input to the affected application. A successful exploit could allow the attacker to cause the application to modify files and execute arbitrary commands on the system with the privileges of the targeted user.


A vulnerability in the file system permissions of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated local attacker to access sensitive information that is stored in the file system of an affected system. The vulnerability is due to improper implementation of file system permissions. An attacker could exploit this vulnerability by accessing and modifying restricted files. A successful exploit could allow the attacker to access sensitive and critical files. Firepower 4100 Series Next-Generation Firewalls are affected in versions prior to 2.2.2.91 and 2.3.1.110. Firepower 9300 Series Next-Generation Firewalls are affected in versions prior to 2.2.2.91 and 2.3.1.110. MDS 9000 Series Multilayer Switches are affected in versions prior to 6.2(25) 8.1(1b) and 8.3(1). Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I4(9) and 7.0(3)I7(4). Nexus 3500 Platform Switches are affected in versions prior to 6.0(2)A8(10) and 7.0(3)I7(4). Nexus 3600 Platform Switches are affected in versions prior to 7.0(3)F3(5). Nexus 2000 5500 5600 and 6000 Series Switches are affected in versions prior to 7.1(5)N1(1b) and 7.3(3)N1(1). Nexus 7000 and 7700 Series Switches are affected in versions prior to 6.2(22) 7.3(3)D1(1) and 8.2(3). Nexus 9000 Series Switches-Standalone are affected in versions prior to 7.0(3)I4(9) and 7.0(3)I7(4). Nexus 9500 R-Series Line Cards and Fabric Modules are affected in versions prior to 7.0(3)F3(5).


A vulnerability in Cisco Integrated Management Controller (IMC) Supervisor Cisco UCS Director and Cisco UCS Director Express for Big Data could allow an unauthenticated remote attacker to log in to the CLI of an affected system by using the SCP User account (scpuser) which has default user credentials. The vulnerability is due to the presence of a documented default account with an undocumented default password and incorrect permission settings for that account. Changing the default password for this account is not enforced during the installation of the product. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the scpuser account. This includes full read and write access to the system's database.


A vulnerability in the Cisco Common Services Platform Collector (CSPC) could allow an unauthenticated remote attacker to access an affected device by using an account that has a default static password. This account does not have administrator privileges. The vulnerability exists because the affected software has a user account with a default static password. An attacker could exploit this vulnerability by remotely connecting to the affected system using this account. A successful exploit could allow the attacker to log in to the CSPC using the default account. For Cisco CSPC 2.7.x Cisco fixed this vulnerability in Release 2.7.4.6. For Cisco CSPC 2.8.x Cisco fixed this vulnerability in Release 2.8.1.2.


A vulnerability in the Cisco SD-WAN Solution could allow an authenticated adjacent attacker to bypass authentication and have direct unauthorized access to other vSmart containers. The vulnerability is due to an insecure default configuration of the affected system. An attacker could exploit this vulnerability by directly connecting to the exposed services. An exploit could allow the attacker to retrieve and modify critical system files.


A vulnerability in the Session Initiation Protocol (SIP) call processing of Cisco Meeting Server (CMS) software could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition of the Cisco Meeting Server. The vulnerability is due to insufficient validation of Session Description Protocol (SDP) messages. An attacker could exploit this vulnerability by sending a crafted SDP message to the CMS call bridge. An exploit could allow the attacker to cause the CMS to reload causing a DoS condition for all connected clients. Versions prior to 2.3.9 are affected.


A vulnerability in access control list (ACL) functionality of the Gigabit Ethernet Management interface of Cisco IOS XE Software could allow an unauthenticated remote attacker to reach the configured IP addresses on the Gigabit Ethernet Management interface. The vulnerability is due to a logic error that was introduced in the Cisco IOS XE Software 16.1.1 Release which prevents the ACL from working when applied against the management interface. An attacker could exploit this issue by attempting to access the device via the management interface.


A vulnerability in the dashboard gadget rendering of Cisco Unified Intelligence Center could allow an unauthenticated remote attacker to obtain or manipulate sensitive information between a user’s browser and Cisco Unified Intelligence Center. The vulnerability is due to the lack of gadget validation. An attacker could exploit this vulnerability by forcing a user to load a malicious gadget. A successful exploit could allow the attacker to obtain sensitive information such as current user credentials or manipulate data between the user’s browser and Cisco Unified Intelligence Center in the context of the malicious gadget.


A vulnerability in the Cisco Discovery Protocol (CDP) implementation for the Cisco TelePresence Codec (TC) and Collaboration Endpoint (CE) Software could allow an unauthenticated adjacent attacker to inject arbitrary shell commands that are executed by the device. The vulnerability is due to insufficient input validation of received CDP packets. An attacker could exploit this vulnerability by sending crafted CDP packets to an affected device. A successful exploit could allow the attacker to execute arbitrary shell commands or scripts on the targeted device.


A vulnerability in the certificate handling component of the Cisco SPA112 SPA525 and SPA5X5 Series IP Phones could allow an unauthenticated remote attacker to listen to or control some aspects of a Transport Level Security (TLS)-encrypted Session Initiation Protocol (SIP) conversation. The vulnerability is due to the improper validation of server certificates. An attacker could exploit this vulnerability by crafting a malicious server certificate to present to the client. An exploit could allow an attacker to eavesdrop on TLS-encrypted traffic and potentially route or redirect calls initiated by an affected device. Affected software include version 7.6.2 of the Cisco Small Business SPA525 Series IP Phones and Cisco Small Business SPA5X5 Series IP Phones and version 1.4.2 of the Cisco Small Business SPA500 Series IP Phones and Cisco Small Business SPA112 Series IP Phones.


A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated remote attacker to gain access to sensitive files on an affected device. The vulnerability is due to incorrect permissions settings on affected DCNM software. An attacker could exploit this vulnerability by connecting to the web-based management interface of an affected device and requesting specific URLs. A successful exploit could allow the attacker to download arbitrary files from the underlying filesystem of the affected device.


A vulnerability in the detection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated adjacent attacker to send data directly to the kernel of an affected device. The vulnerability exists because the software improperly filters Ethernet frames sent to an affected device. An attacker could exploit this vulnerability by sending crafted packets to the management interface of an affected device. A successful exploit could allow the attacker to bypass the Layer 2 (L2) filters and send data directly to the kernel of the affected device. A malicious frame successfully delivered would make the target device generate a specific syslog entry.


PAN-OS 9.0.0 may allow an unauthenticated remote user to access php files.


A vulnerability in the Simple Object Access Protocol (SOAP) of Cisco TelePresence Management Suite (TMS) software could allow an unauthenticated remote attacker to gain unauthorized access to an affected device. The vulnerability is due to a lack of proper access and authentication controls on the affected TMS software. An attacker could exploit this vulnerability by gaining access to internal trusted networks to send crafted SOAP calls to the affected device. If successful an exploit could allow the attacker to access system management tools. Under normal circumstances this access should be prohibited.


Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated local attacker to read arbitrary files on the underlying operating system (OS) of an affected device. For more information about these vulnerabilities see the Details section of this advisory.


A vulnerability in the sysadmin virtual machine (VM) on Cisco ASR 9000 Series Aggregation Services Routers running Cisco IOS XR 64-bit Software could allow an unauthenticated remote attacker to access internal applications running on the sysadmin VM. The vulnerability is due to incorrect isolation of the secondary management interface from internal sysadmin applications. An attacker could exploit this vulnerability by connecting to one of the listening internal applications. A successful exploit could result in unstable conditions including both a denial of service and remote unauthenticated access to the device. This vulnerability has been fixed in Cisco IOS XR 64-bit Software Release 6.5.3 and 7.0.1 which will edit the calvados_boostrap.cfg file and reload the device.


A vulnerability in the Secure Sockets Layer (SSL) input packet processor of Cisco Small Business 200 300 and 500 Series Managed Switches could allow an unauthenticated remote attacker to cause a memory corruption on an affected device. The vulnerability is due to improper validation of HTTPS packets. An attacker could exploit this vulnerability by sending a malformed HTTPS packet to the management web interface of the affected device. A successful exploit could allow the attacker to cause an unexpected reload of the device resulting in a denial of service (DoS) condition.


A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated remote attacker to retrieve sensitive information from an affected device. The vulnerability is due to improper access controls for certain URLs on affected DCNM software. An attacker could exploit this vulnerability by connecting to the web-based management interface of an affected device and requesting specific URLs. A successful exploit could allow the attacker to download log files and diagnostic information from the affected device.


A vulnerability in Cisco Webex Business Suite could allow an unauthenticated remote attacker to inject arbitrary text into a user's browser. The vulnerability is due to improper validation of input. An attacker could exploit this vulnerability by convincing a targeted user to view a malicious URL. A successful exploit could allow the attacker to inject arbitrary text into the user's browser. The attacker could use the content injection to conduct spoofing attacks. Versions prior than 3.0.9 are affected.


A vulnerability in Cisco IOS XE SD-WAN Software could allow an unauthenticated local attacker to gain unauthorized access to an affected device. The vulnerability is due to the existence of default credentials within the default configuration of an affected device. An attacker who has access to an affected device could log in with elevated privileges. A successful exploit could allow the attacker to take complete control of the device. This vulnerability affects Cisco devices that are running Cisco IOS XE SD-WAN Software releases 16.11 and earlier.


A vulnerability in certain access control mechanisms for the Secure Shell (SSH) server implementation for Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated adjacent attacker to access a CLI instance on an affected device. The vulnerability is due to a lack of proper input- and validation-checking mechanisms for inbound SSH connections on an affected device. An attacker could exploit this vulnerability by attempting to establish an SSH connection to an affected controller. An exploit could allow the attacker to access an affected device's CLI to potentially cause further attacks. This vulnerability has been fixed in version 8.5(140.0).


A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections in the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious customized link. A successful exploit could allow the attacker to perform arbitrary actions on the affected device via a web browser and with the privileges of the user.


A vulnerability in the HTTP API of Cisco Enterprise Chat and Email could allow an unauthenticated remote attacker to download files attached through chat sessions. The vulnerability is due to insufficient authentication mechanisms on the file download function of the API. An attacker could exploit this vulnerability by sending a crafted request to the API. A successful exploit could allow the attacker to download files that other users attach through the chat feature. This vulnerability affects versions prior to 12.0(1)ES1.


A vulnerability in the implementation of the Simple Network Management Protocol (SNMP) Access Control List (ACL) feature of Cisco NX-OS Software could allow an unauthenticated remote attacker to perform SNMP polling of an affected device even if it is configured to deny SNMP traffic. The vulnerability is due to an incorrect length check when the configured ACL name is the maximum length which is 32 ASCII characters. An attacker could exploit this vulnerability by performing SNMP polling of an affected device. A successful exploit could allow the attacker to perform SNMP polling that should have been denied. The attacker has no control of the configuration of the SNMP ACL name.


A vulnerability in the Web Services Management Agent (WSMA) feature of Cisco Industrial Network Director (IND) could allow an unauthenticated remote attacker to gain unauthorized read access to sensitive data using an invalid X.509 certificate. The vulnerability is due to insufficient X.509 certificate validation when establishing a WSMA connection. An attacker could exploit this vulnerability by supplying a crafted X.509 certificate during the WSMA connection setup phase. A successful exploit could allow the attacker to conduct man-in-the-middle attacks to decrypt confidential information on WSMA connections to the affected software. At the time of publication this vulnerability affected Cisco IND Software releases prior to 1.7.


A vulnerability in the management interface of Cisco Application Policy Infrastructure Controller (APIC) software could allow an unauthenticated adjacent attacker to gain unauthorized access on an affected device. The vulnerability is due to a lack of proper access control mechanisms for IPv6 link-local connectivity imposed on the management interface of an affected device. An attacker on the same physical network could exploit this vulnerability by attempting to connect to the IPv6 link-local address on the affected device. A successful exploit could allow the attacker to bypass default access control restrictions on an affected device. Cisco Application Policy Infrastructure Controller (APIC) devices running versions prior to 4.2(0.21c) are affected.


A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated remote attacker to perform a command injection attack and execute arbitrary commands with root privileges. The vulnerability is due to insufficient input validation by the web portal framework. An attacker could exploit this vulnerability by providing malicious input during web portal authentication. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the underlying operating system.


A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator System Overview) versions 7.30 7.31 7.40 7.50 by sending a specially crafted XML file and trick the application server into leaking authentication credentials for its own SAP Management console resulting in Server-Side Request Forgery.


A vulnerability in the web-based management interface of Cisco HyperFlex software could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a maliciously crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information. Versions prior to 3.5(1a) are affected.

weak authentication management
cross site scripting vulnerability


A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated remote attacker to bypass authorization access critical services and cause a denial of service (DoS) condition. The vulnerability exists because the software fails to sanitize URLs before it handles requests. An attacker could exploit this vulnerability by submitting a crafted URL. A successful exploit could allow the attacker to gain unauthorized access to critical services and cause a DoS condition. This vulnerability affects Cisco IP Phone 8800 Series products running a SIP Software release prior to 11.0(5) for Wireless IP Phone 8821 and 8821-EX; and 12.5(1)SR1 for the IP Conference Phone 8832 and the rest of the IP Phone 8800 Series. Cisco IP Conference Phone 8831 is not affected.

weak authentication management
denial of service


A vulnerability in the TCP processing engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated remote attacker to cause an affected device to reload resulting in a denial of service (DoS) condition. The vulnerability is due to the improper handling of TCP traffic. An attacker could exploit this vulnerability by sending a specific sequence of packets at a high rate through an affected device. A successful exploit could allow the attacker to temporarily disrupt traffic through the device while it reboots.


A vulnerability in the ISDN functions of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated remote attacker to cause the device to reload. The vulnerability is due to incorrect processing of specific values in the Q.931 information elements. An attacker could exploit this vulnerability by calling the affected device with specific Q.931 information elements being present. An exploit could allow the attacker to cause the device to reload resulting in a denial of service (DoS) condition on an affected device.


A vulnerability in the Multiprotocol Label Switching (MPLS) Operations Administration and Maintenance (OAM) implementation of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated adjacent attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to the incorrect handling of certain MPLS OAM packets. An attacker could exploit this vulnerability by sending malicious MPLS OAM packets to an affected device. A successful exploit could allow the attacker to cause the lspv_server process to crash. The crash could lead to system instability and the inability to process or forward traffic though the device resulting in a DoS condition that require manual intervention to restore normal operating conditions.


A vulnerability in Cisco SIP IP Phone Software for Cisco IP Phone 7800 Series and 8800 Series could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition on an affected phone. The vulnerability is due to insufficient validation of input Session Initiation Protocol (SIP) packets. An attacker could exploit this vulnerability by altering the SIP replies that are sent to the affected phone during the registration process. A successful exploit could allow the attacker to cause the phone to reboot and not complete the registration process.


Reflected XSS in web interface for Intel(R) Accelerated Storage Manager in Intel(R) RSTe before version 5.5.0.2015 may allow an unauthenticated user to potentially enable denial of service via network access.


Data Corruption in Intel Unite(R) Client before version 3.3.176.13 may allow an unauthenticated user to potentially cause a denial of service via network access.


Vulnerability

in

the

Oracle

Outside

In

Technology

component

of

Oracle

Fusion

Middleware

(subcomponent:

Outside

In

Filters).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Outside

In

Technology.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

hang

or

frequently

repeatable

crash

(complete

DOS)

of

Oracle

Outside

In

Technology.

Note:

Outside

In

Technology

is

a

suite

of

software

development

kits

(SDKs).

The

protocol

and

CVSS

score

depend

on

the

software

that

uses

the

Outside

In

Technology

code.

The

CVSS

score

assumes

that

the

software

passes

data

received

over

a

network

directly

to

Outside

In

Technology

code

but

if

data

is

not

received

over

a

network

the

CVSS

score

may

be

lower.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).


Logic bug vulnerability in subsystem for Intel(R) CSME before version 12.0.35 Intel(R) TXE before 3.1.65 4.0.15 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.

weak authentication management
escalated privilege


A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated remote attacker to access administrative credentials. The vulnerability exists because affected devices use weak encryption algorithms for user credentials. An attacker could exploit this vulnerability by conducting a man-in-the-middle attack and decrypting intercepted credentials. A successful exploit could allow the attacker to gain access to an affected device with administrator privileges. This vulnerability affects Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers running firmware releases prior to 1.4.2.22.


GateManager versions prior to 9.2c The affected product uses a weak hash type which may allow an attacker to view user passwords.


Cisco AnyConnect Secure Mobility Client on Mac OS X uses weak permissions for a library directory which allows local users to gain privileges via a crafted library file aka Bug ID CSCue33619.


A vulnerability in the logic that handles access control to one of the hardware components in Cisco's proprietary Secure Boot implementation could allow an authenticated local attacker to write a modified firmware image to the component. This vulnerability affects multiple Cisco products that support hardware-based Secure Boot functionality. The vulnerability is due to an improper check on the area of code that manages on-premise updates to a Field Programmable Gate Array (FPGA) part of the Secure Boot hardware implementation. An attacker with elevated privileges and access to the underlying operating system that is running on the affected device could exploit this vulnerability by writing a modified firmware image to the FPGA. A successful exploit could either cause the device to become unusable (and require a hardware replacement) or allow tampering with the Secure Boot verification process which under some circumstances may allow the attacker to install and boot a malicious software image. An attacker will need to fulfill all the following conditions to attempt to exploit this vulnerability: Have privileged administrative access to the device. Be able to access the underlying operating system running on the device; this can be achieved either by using a supported documented mechanism or by exploiting another vulnerability that would provide an attacker with such access. Develop or have access to a platform-specific exploit. An attacker attempting to exploit this vulnerability across multiple affected platforms would need to research each one of those platforms and then develop a platform-specific exploit. Although the research process could be reused across different platforms an exploit developed for a given hardware platform is unlikely to work on a different hardware platform.


K7 Antivirus Premium before 15.1.0.53 allows local users to write to arbitrary memory locations and consequently gain privileges via a specific set of IOCTL calls.


In all Qualcomm products with Android releases from CAF using the Linux kernel during DMA allocation due to wrong data type of size allocation size gets truncated which makes allocation succeed when it should fail.


In all android releases(Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel if there is an unlikely memory alloc failure for the secure pool in boot it can result in wrong pointer access causing kernel panic.


In ArcGIS Enterprise 10.6.1 a crafted IFRAME element can be used to trigger a Cross Frame Scripting (XFS) attack through the EDIT MY PROFILE feature.


A vulnerability in the web-based interface of Cisco HyperFlex Software could allow an unauthenticated remote attacker to execute a cross-frame scripting (XFS) attack on an affected device. This vulnerability is due to insufficient HTML iframe protection. An attacker could exploit this vulnerability by directing a user to an attacker-controlled web page that contains a malicious HTML iframe. A successful exploit could allow the attacker to conduct clickjacking or other clientside browser attacks.


IBM QRadar SIEM 7.2 and 7.3 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 147709.


IBM QRadar SIEM 7.3 and 7.4 may vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 193245.


IBM QRadar SIEM 7.3 and 7.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 182364.


IBM QRadar SIEM 7.3 and 7.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 182365.


IBM Tivoli Endpoint Manager is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 123859.


IBM WebSphere Application Server 7.0 8.0 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information. IBM X-Force ID: 185590.


Adobe Experience Manager versions 6.5 6.4 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive information disclosure.

xml external entity injection
information disclosure


Adobe Experience Manager versions 6.4 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive information disclosure.


An issue was discovered in Foxit Reader and PhantomPDF before 9.7. It allows stack consumption via nested function calls for XML parsing.


The XML parser which is being used by SAP Enable Now before version 1902 has not been hardened correctly leading to Missing XML Validation vulnerability. This issue affects the file upload at multiple locations. An attacker can read local XXE files.


In Hamilton Medical AG T1-Ventillator versions 2.2.3 and prior an XML validation vulnerability in the ventilator allows privileged attackers with physical access to render the device persistently unusable by uploading specially crafted configuration files.


Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that results in privilege escalation. This issue affects PAN-OS 8.1 versions earlier than PAN-OS 8.1.12 and PAN-OS 9.0 versions earlier than PAN-OS 9.0.6. This issue does not affect PAN-OS 7.1 PAN-OS 8.0 or PAN-OS 9.1 or later versions.


On BIG-IP 13.1.0-13.1.3.1 12.1.0-12.1.5 and 11.5.2-11.6.5.1 a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI) also known as the BIG-IP Configuration utility.


Cloudera

Manager

and

allows

XSS.


Cloudera

Manager

and

allows

XSS

via

the

path

parameter.


Telligent

Community

before

before

and

before

has

XSS

via

the

Feed

RSS

widget.


In XenForo through 2.2.7 a threat actor with access to the admin panel can create a new Advertisement via the Advertising function and save an XSS payload in the body of the HTML document. This payload will execute globally on the client side.


The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile Field Manager.


The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI.


The Admin CP in vBulletin 5.6.3 allows XSS via a Title of a Child Help Item in the Login/Logoff part of the User Manual.


The Admin CP in vBulletin 5.6.3 allows XSS via a Style Options Settings Title to Styles Manager.


The Admin CP in vBulletin 5.6.3 allows XSS via the Paid Subscription Email Notification field in the Options.


The Admin CP in vBulletin 5.6.3 allows XSS via a Smilie Title to Smilies Manager.


The Admin CP in vBulletin 5.6.3 allows XSS via an Announcement Title to Channel Manager.


The Admin CP in vBulletin 5.6.3 allows XSS via a Rank Type to User Rank Manager.


The Admin CP in vBulletin 5.6.3 allows XSS via a Junior Member Title to User Title Manager.


The Admin CP in vBulletin 5.6.3 allows XSS via the admincp/search.php?do=dosearch URI.


The all-in-one-seo-pack plugin before 3.2.7 for WordPress (aka All in One SEO Pack) is susceptible to Stored XSS due to improper encoding of the SEO-specific description for posts provided by the plugin via unsafe placeholder replacement.


The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature.


TeamPass 2.1.27.36 allows Stored XSS by setting a crafted password for an item in a common available folder or sharing the item with an admin. (The crafted password is exploitable when viewing the change history of the item or tapping on the item.)


TeamPass 2.1.27.36 allows Stored XSS by setting a crafted Knowledge Base label and adding any available item.


TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins the XSS payload will be executed.


TeamPass 2.1.27.36 allows Stored XSS at the Search page by setting a crafted password for an item in any folder.


Ilch 2.1.22 allows stored XSS via the title text or email id to the Jobs Tab.


PandoraFMS <=7.54 allows Stored XSS by placing a payload in the name field of a visual console. When a user or an administrator visits the console the XSS payload will be executed.


Chamilo 1.11.14 allows stored XSS via main/install/index.php and main/install/ajax.php through the port parameter.


htmly 2.8.0 allows stored XSS via the blog title Tagline or Description to config.html.php.


razorCMS 3.4.7 allows Stored XSS via the keywords of the homepage within the settings component.


Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Lead screen.


Daybyday 2.1.0 allows stored XSS via the Name parameter to the New User screen.


Daybyday 2.1.0 allows stored XSS via the Company Name parameter to the New Client screen.


Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Project screen.


Chronoforeum 2.0.11 allows Stored XSS vulnerabilities when inserting a crafted payload into a post. If any user sees the post the inserted XSS code is executed.


Bludit 3.12.0 allows stored XSS via JavaScript code in an SVG document to bl-kernel/ajax/logo-upload.php.


OpenWrt

allows

XSS

via

these

Name

fields

to

the

cgi-bin/luci/admin/network/firewall/rules

URI:

\Open

ports

on

router\

and

\New

forward

rule\

and

\New

Source

NAT\

(this

can

occur

for

example

on

a

TP-Link

Archer

device).


OpenWrt

allows

XSS

via

the

\New

port

forward\

Name

field

to

the

cgi-bin/luci/admin/network/firewall/forwards

URI

(this

can

occur

for

example

on

a

TP-Link

Archer

device).


OTCMS 3.81 allows XSS via the mode parameter in an apiRun.php?mudi=autoRun request.


LayerBB 1.1.3 allows XSS via the application/commands/new.php pm_title variable a related issue to CVE-2019-17997.


FileRun 2019.05.21 allows XSS via the filename to the ?module=fileman&section=do&page=up URI. This issue has been fixed in FileRun 2019.06.01.


Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors.


AppCMS 2.0.101 allows XSS via the upload/callback.php params parameter.


HRworks 3.36.9 allows XSS via the purpose of a travel-expense report.


Subrion 4.2.1 allows XSS via the panel/members/ Username Full Name or Email field aka an \Admin Member JSON Update\ issue.


PbootCMS 2.0.2 allows XSS via vectors involving the Pboot/admin.php?p=/Single/index/mcode/1 and Pboot/?contact/ URIs.


VertrigoServ 2.17 allows XSS via the /inc/extensions.php ext parameter.


Collabtive 3.1 allows XSS via the manageuser.php?action=profile id parameter.


Maccms 8.0 allows XSS via the inc/config/cache.php t_key parameter because template/paody/html/vod_type.html mishandles the keywords parameter and a/tpl/module/db.php only filters the t_name parameter (not t_key).


TastyIgniter 3.0.7 allows XSS via /account /reservation /admin/dashboard and /admin/system_logs.


imgURL 2.31 allows XSS via an X-Forwarded-For HTTP header.


XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section.


OpenWrt 21.02.1 allows XSS via the NAT Rules Name screen.


OpenWrt 21.02.1 allows XSS via the Port Forwards Add Name screen.


OpenWrt 21.02.1 allows XSS via the Traffic Rules Name screen.


FTAPI 4.0 - 4.10 allows XSS via a crafted filename to the alternative text hover box in the file submission component.


SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parameter without any authentication.


Chamilo 1.11.14 allows XSS via a main/calendar/agenda_list.php?type= URI.


pfSense 2.5.0 allows XSS via the services_wol_edit.php Description field.


atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter.


Zurmo 3.2.3 allows XSS via the latitude or longitude parameter to maps/default/mapAndPoint.


Statamic 2.10.3 allows XSS via First Name or Last Name to the /users URI in an 'Add new user' request.


WolfCMS 0.8.3.1 allows XSS via an SVG file to /?/admin/plugin/file_manager/browse/.


TeaKKi 2.7 allows XSS via a crafted onerror attribute for a picture's URL.


xhEditor 1.2.2 allows XSS via JavaScript code in the SRC attribute of an IFRAME element within the editor's source-code view.


Virtualmin 6.03 allows XSS via the query string as demonstrated by the webmin_search.cgi URI.


MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on the home page.


Pimcore allows XSS via Users Assets Data Objects Video Thumbnails Image Thumbnails Field-Collections Objectbrick Classification Store Document Types Predefined Properties Predefined Asset Metadata Quantity Value and Static Routes functions.


NewsBee allows XSS via the Company Name field in the Settings under admin/admin.php.


AuraCMS 2.3 allows XSS via a Bukutamu -> AddGuestbook action.


LayerBB 1.1.1 allows XSS via the titles of conversations (PMs).


Bludit 2.3.4 allows XSS via a user name.


Typesetter 5.1 allows XSS via the index.php/Admin LABEL parameter during new page creation.


EasyCMS

allows

XSS

via

the

index.php?s=/admin/fields/update/navTabId/listfields/callbackType/closeCurrent

content

field.


feindura 2.0.7 allows XSS via the tags field of a new page created at index.php?category=0&page=new.


Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element and is uploaded via pages->manage under admin.php?action=files.


Dolibarr 11.0 allows XSS via the joinfiles topic or code parameter or the HTTP Referer header.


SOPlanning 1.45 allows XSS via the Name or Comment to status.php.


SOPlanning 1.45 allows XSS via the \Your SoPlanning url\ field.


IceWarp 11.4.5.0 allows XSS via the language parameter.


CALDERA 2.7.0 allows XSS via the Operation Name box.


Codoforum 4.8.3 allows XSS via a post using parameters display name title name or content.


HRSALE 2.0.0 allows XSS via the admin/project/projects_calendar set_date parameter.


OX App Suite through 7.10.2 has XSS.


OX App Suite through 7.10.3 allows XSS.


OX App Suite through 7.10.4 allows XSS via the app loading mechanism (the PATH_INFO to the /appsuite URI).


FROG xss via the admin/?/snippet/add name parameter which is mishandled during an edit action a related issue to CVE-2018-10319.


Frog CMS 0.9.5 has XSS via the admin/?/layout/edit/1 Body field.


Frog CMS 0.9.5 has XSS via the Database name field to the /install/index.php URI.


Frog CMS 0.9.5 has XSS in the admin/?/page/edit/1 body field.


Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit/1 Body field.


Frog CMS 0.9.5 has XSS via the /admin/?/user/add Name or Username parameter.


Frog CMS 0.9.5 has XSS via the name field of a new \File\ or \Directory\ on the admin/?/plugin/file_manager/browse/ screen.


Frog CMS 0.9.5 has XSS in /install/index.php via the 'config''admin_username' field.


Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit snippetname parameter aka Edit Snippet.


Frog CMS 0.9.5 has XSS via the admin/?/layout/edit layoutname parameter aka Edit Layout.


Frog CMS 0.9.5 has XSS via the admin/?/page/edit pagekeywords parameter aka Edit Page Metadata.


joyplus-cms

has

XSS

in

manager/admin_ajax.php?action=save&tab={pre}vod_type

via

the

parameter.


joyplus-cms 1.6.0 has XSS in admin_player.php related to manager/index.php \system manage\ and \add\ actions.


joyplus-cms 1.6.0 has XSS in manager/admin_vod.php via the keyword parameter.


joyplus-cms 1.6.0 has XSS via the device_name parameter in a manager/admin_ajax.php?action=save flag=add request.


joyplus-cms 1.6.0 has XSS via the manager/admin_ajax.php can_search_device array parameter.


joyplus-cms 1.6.0 has XSS via the manager/collect/collect_vod_zhuiju.php keyword parameter.


WeBid 1.2.2 has reflected XSS via the id parameter to admin/deletenews.php admin/editbannersuser.php admin/editfaqscategory.php or admin/excludeuser.php or the offset parameter to admin/edituser.php.


TemaTres 3.0 has reflected XSS via the replace_string or search_string parameter to the vocab/admin.php?doAdmin=bulkReplace URI.


Cacti 1.1.27 has reflected XSS via the PATH_INFO to host.php.


Metinfo 6.1.3 has reflected XSS via the admin/column/move.php lang_columnerr4 parameter.


tianti 2.3 has reflected XSS in the user management module via the tianti-module-admin/user/list userName parameter.


MISP 2.4.122 has reflected XSS via unsanitized URL parameters. This is related to app/View/Users/statistics_orgs.ctp.


TemaTres 3.0 has stored XSS via the value parameter to the vocab/admin.php?vocabulario_id=list URI.


VFront 0.99.5 has stored XSS via the admin/sync_reg_tab.php azzera parameter which is mishandled during admin/error_log.php rendering.


Dolibarr 9.0.5 has stored XSS vulnerability via a User Group Description section to card.php. A user with the \Create/modify other users groups and permissions\ privilege can inject script and can also achieve privilege escalation.


Dolibarr 9.0.5 has stored XSS in an Email Template section to mails_templates.php. A user with no privileges can inject script to attack the admin. (This stored XSS can affect all types of user privilege from Admin to users with no permissions.)


Dolibarr 9.0.5 has stored XSS in a User Note section to note.php. A user with no privileges can inject script to attack the admin.


Dolibarr 9.0.5 has stored XSS in a User Profile in a Signature section to card.php. A user with the \Create/modify other users groups and permissions\ privilege can inject script and can also achieve privilege escalation.


ProjectPier 0.8.8 has stored XSS


tianti 2.3 has stored XSS in the article management module via an article title.


tianti

has

stored

XSS

in

the

userlist

module

via

the

name

parameter

which

is

mishandled

in


ClipperCMS 1.3.3 has stored XSS via the Full Name field of (1) Security -> Manager Users or (2) Security -> Web Users.


ClipperCMS 1.3.3 has stored XSS via the \Tools -> Configuration\ screen of the manager/ URI.


SeaCMS 6.61 has stored XSS in admin_collect.php via the siteurl parameter.


Yosoro 1.0.4 has stored XSS.


zzcms 8.3 has stored XSS related to the content variable in user/manage.php and zt/show.php.


rejucms 2.1 has stored XSS via the admin/book.php content parameter.


Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function.


Pimcore

has

XSS

in

the

translations

grid

because

mishandles

certain

HTML

elements.


YUNUCMS 1.1.8 has XSS in app/admin/controller/System.php because crafted data can be written to the sys.php file as demonstrated by site_title in an admin/system/basic POST request.


FlightPath 4.8.3 has XSS in the Content Edit urgent message and Users sections of the Admin Console. This could lead to cookie stealing and other malicious actions.


Zimbra 2013 has XSS in aspell.php


PHPMyWind

has

XSS

in

shoppingcart.php

related

to

message.php

admin/message.php

and


PHPMailer 5.2.23 has XSS in the \From Email Address\ and \To Email Address\ fields of code_generator.php.


Symphony 2.6.9 has XSS in publish/notes/edit/##/saved/ via the bottom form field.


phpwcms

has

XSS

in

and

via

the

username

(aka

field.


Symphony

has

XSS

in

the

parameter

to

content/content.blueprintssections.php.


piwigo has XSS in password.php


piwigo has XSS in password.php (incomplete fix for CVE-2012-4525)


ClipperCMS 1.3.3 has XSS in the \Module name\ field in a \Modules -> Manage modules -> edit\ action to the manager/ URI.


PHPMyWind 5.5 has XSS in member.php via an HTTP Referer header


GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the \mobile board tail contents\ parameter aka the adm/board_form_update.php bo_mobile_content_tail parameter.


GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the \board head contents\ parameter aka the adm/board_form_update.php bo_content_head parameter.


GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the \Menu Link\ parameter aka the adm/menu_list_update.php me_link parameter.


GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the \mobile board title contents\ parameter aka the adm/board_form_update.php bo_mobile_subject parameter.


GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the \mobile board head contents\ parameter aka the adm/board_form_update.php bo_mobile_content_head parameter.


GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the \board title contents\ parameter aka the adm/board_form_update.php bo_subject parameter.


GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the \board tail contents\ parameter aka the adm/board_form_update.php bo_content_tail parameter.


GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the \Extra Contents\ parameter aka the adm/config_form_update.php cf_1~10 parameter.


Verydows 2.0 has XSS via the index.php?m=api&c=stats&a=count referrer parameter.


TestLink

has

XSS

via

the

edit

parameter

the

index.php

reqURI

parameter

or

the

URI

in

a

lib/testcases/tcEdit.php?doAction=doDeleteStep

request.


EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php.


EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php as demonstrated by a CSRF payload that changes the dynamic page template. The attacker can choose to resend the e/template/member/regsend.php registered activation mail page.


Domoticz 4.10717 has XSS via item.Name.


TestLink 1.9.19 has XSS via the error.php message parameter.


LimeSurvey

has

XSS

via

Boxes

in

or

a

label

title

in


Zurmo

has

XSS

via

the

app/index.php/zurmo/default


zzcms 2019 has XSS via an arbitrary user/ask.php?do=modify parameter because inc/stopsqlin.php does not block a mixed-case string such as sCrIpT.


Bolt 3.6.4 has XSS via the slug teaser or title parameter to editcontent/pages a related issue to CVE-2017-11128 and CVE-2018-19933.


Halo 1.1.0 has XSS via a crafted authorUrl in JSON data to api/content/posts/comments.


TuziCMS 2.0.6 has XSS via the PATH_INFO to a group URI as demonstrated by index.php/article/group/id/2/.


HongCMS 3.0.0 has XSS via the install/index.php tableprefix parameter.


HongCMS 3.0.0 has XSS via the install/index.php dbusername parameter.


HongCMS 3.0.0 has XSS via the install/index.php dbpassword parameter.


HongCMS 3.0.0 has XSS via the install/index.php dbname parameter.


HongCMS 3.0.0 has XSS via the install/index.php servername parameter.


Verydows 2.0 has XSS via the index.php?c=main a parameter as demonstrated by an a=indexXSS value.


VNote 2.2 has XSS via a new text note.


MISP 2.4.136 has XSS via a crafted URL to the app/View/Elements/global_menu.ctp user homepage favourite button.


MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could contain javascript: URLs.


pootle 2.0.5 has XSS via 'match_names' parameter


trixbox

has

XSS

via

the

to

or


UEditor 1.4.3.3 has XSS via the SRC attribute of an IFRAME element.


Portus 2.2.0 has XSS via the Team field related to typeahead.


GeniXCMS 1.1.5 has XSS via the from id lang menuid mod q status term to or token parameter. NOTE: this might overlap CVE-2017-14761 CVE-2017-14762 or CVE-2017-14765.


Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request.


LanSweeper 6.0.100.75 has XSS via the description parameter to /Calendar/CalendarActions.aspx.


AvantFAX 3.3.3 has XSS via an arbitrary parameter name to the default URI as demonstrated by a parameter whose name contains a SCRIPT element and whose value is 1.


CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI.


Webmin 1.890 has XSS via /config.cgi?webmin the /shell/index.cgi history parameter /shell/index.cgi?stripped=1 or the /webminlog/search.cgi uall or mall parameter.


SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element or via certain input with and ( characters which is mishandled during construction of an A element.


CuppaCMS

has

XSS

via

an

SVG

document

uploaded

to

the

administrator/#/component/table_manager/view/cu_views

URI.


Zurmo

has

XSS

via

an

admin's

use

of

the

name

parameter

in

the

reports

section

aka

the

app/index.php/reports/default/details?id=1

URI.


MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword langset parameter.


CMSimple

has

XSS

via

an

admin's

upload

of

an

SVG

file

at

a

?userfiles&subdir=userfiles/images/flags/

URI.


ShowDoc 2.4.1 has XSS via the lang parameter because install/database.php mishandles the $cur_lang value.


MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abt_type parameter.


enhavo 0.4.0 has XSS via a user-group that contains executable JavaScript code in the user-group name. The XSS attack launches when a victim visits the admin user group page.


UCMS 1.4.7 has XSS via the description parameter in an index.php list_editpost action.


DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider-account.php username field.


DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider.php SSL Provider Name or SSL Provider URL field.


DomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder field.


SEMCMS 3.5 has XSS via the first text box to the SEMCMS_Main.php URI.


UCMS 1.4.7 has XSS via the dir parameter in an index.php sadmin_fileedit action.


PHPCMF 4.1.3 has XSS via the first input field to the index.php?s=member&c=register&m=index URI.


IBOS 4.4.3 has XSS via a company full name.


YUNUCMS 1.0.7 has XSS via the content title on an admin/content/addcontent/cid/## page (aka a news center page).


MetInfo 6.1.2 has XSS via the /admin/index.php bigclass parameter in an n=column&a=doadd action.


Grafana 5.3.1 has XSS via a link on the \Dashboard > All Panels > General\ screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.


Grafana 5.3.1 has XSS via a column style on the \Dashboard > Table Panel\ screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.


JEECMS 9.3 has XSS via an index.do#/content/update?type=update URI.


Leanote 2.6.1 has XSS via the Blog Basic Setting title field which is mishandled during rendering of the \likes\ page.


Grafana 5.3.1 has XSS via the \Dashboard > Text Panel\ screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.


ImpressCMS

has

XSS

via

the

to

or


Cockpit 0.5.5 has XSS via a collection form or region.


Hue 3.12 has XSS via the /pig/save/ name and script parameters.


PHPMyWind 5.5 has XSS via the cid parameter to newsshow.php or the query string to news.php or about.php.


EasyCMS 1.3 has XSS via the s POST parameter (aka a search box value) in an index.php?s=/index/search/index.html request.


GeniXCMS 1.1.5 has XSS via the dbuser or dbhost parameter during step 1 of installation.


Osclass 3.7.4 has XSS via the query string to index.php a different vulnerability than CVE-2014-6280.


PrestaShop 1.7.2.4 has XSS via source-code editing on the \Pages > Edit page\ screen.


WolfCMS 0.8.3.1 has XSS via the /?/admin/page/add slug parameter.


UCMS 1.4.6 has XSS via the install/index.php mysql_dbname parameter.


MyBB 1.8.14 has XSS via the Title or Description field on the Edit Forum screen.


rejucms 2.1 has XSS via the ucenter/cms_user_add.php u_name parameter.


LavaLite 5.5 has XSS via a /edit URI as demonstrated by client/job/job/Zy8PWBekrJ/edit.


YzmCMS

has

XSS

via

the

title

parameter.


has

XSS

via

the

e107_admin/users.php?mode=main&action=list

parameter.


ChemCMS 1.0.6 has XSS via the \setting -> website information\ field.


Gxlcms

has

XSS

via

the

to


wityCMS 0.6.2 has XSS via the \Site Name\ field found in the \Contact\ \Configuration\ page.


Serendipity 2.0.4 has XSS via the serendipity_admin.php serendipitybody parameter.


In Moodle 3.x XSS can occur via attachments to evidence of prior learning.


In Moodle 3.x XSS can occur via evidence of prior learning.


Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Options.php.


Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.php.


Cross Site Scripting (XSS) vulnerability exiss in FlatCore-CMS 2.0.7 via the upload image function.


Cross Site Scripting (XSS) vulnerability exists in the admin panel in Beego v2.0.1 via the URI path in an HTTP request which is activated by administrators viewing the \Request Statistics\ page.


Cross Site Scripting (XSS) vulnerability exists in Pixelimity 1.0 via the HTTP POST parameter to admin/setting.php.


Cross Site Scripting (XSS) vulnerability exists in SeaCMS 12.6 via the (1) v_company and (2) v_tvs parameters in /admin_video.php


A Site Scripting (XSS) vulnerability exists in the Xerte Project Xerte through 3.8.4 via the link parameter in print.php.


Cross Site Scripting (XSS) vulnerability exists in index.html in AFI WebACMS through 2.1.0 via the the ID parameter.


Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via multiple models that contain a 'note' field to store additional information.


Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute.


Cross Site Scripting (XSS) vulnerability exists in bludit 3-13-1 via the username in admin/login.


Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URL field.


Cross Site Scripting (XSS) vulnerability exists in Piwigo 12.x via the pwg_activity function in include/functions.inc.php.


Cross

Site

Scripting

(XSS)

vulnerability

exists

in

Catfish

via

a

Google

search

in

url:/catfishcms/index.php/admin/Index/addmenu.htmland

then

the

.html

file

on

the

website

that

uses

this

editor

(the

file

suffix

is

allowed).


Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /ipblacklist?errorip= (reflected).


Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the extension name (stored).


Cross Site Scripting (XSS) vulnerability exists in all versions of KindEditor which can be exploited by an attacker to obtain user cookie information.


Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the SipRule field (stored).


Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the blacklist IP address (stored).


Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via the Mailbox name (stored).


Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /extensionsinstruction?id= (reflected).


Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmprop?id= (reflected).


Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the line name (stored).


Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the primary phone field (stored).


Cross Site Scripting (XSS) vulnerability exists in UEditor v1.4.3.3 which can be exploited by an attacker to obtain user cookie information.


Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the customer name field (stored).


Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmlist?folder= (reflected).


Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /planprop?id= (reflected).


Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /msglist?mbx= (reflected).


Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the outbound dialing plan (stored).


Cross Site Scripting (XSS) in Moodle 3.10.3 allows remote attackers to execute arbitrary web script or HTML via the \Description\ field.


Cross Site Scripting (XSS) vulnerability exists in cxuucms v3 via the imgurl of /feedback/post/ content parameter.


Cross Site Scripting (XSS vulnerability exists in Portainer before 2.9.1 via the node input box in Custom Templates.


Cross Site Scripting (XSS).vulnerability exists in Online DJ Booking Management System 1.0 in view-booking-detail.php.


Cross Site Scripting (XSS) in Sourcecodester Try My Recipe (Recipe Sharing Website - CMS) by oretnom23 allows attackers to gain the PHPSESID or other unspecified impacts via the fullname parameter to the login_registration page.


Cross site Scripting (XSS) vulnerability in MERCUSYS Mercury X18G 1.0.5 devices via crafted values to the 'src_dport_start' 'src_dport_end' and 'dest_port' parameters.


Cross Site Scripting (XSS) vulnerability exists in Rumble Mail Server 0.51.3135 via the servername parameter.


Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Simple Subscription Website 1.0 via the id parameter in plan_application.


Cross Site Scripting (XSS) vulnerability exists in Maccms v10 via link_Name parameter.


Cross Site Scripting (XSS) vulnerability exists in CMS Made Simple 2.2.15 via the Name field in an Add Category action in moduleinterface.php.


Cross Site Scripting (XSS). vulnerability exists in Microweber CMS 1.2.7 via the Login form which could let a malicious user execute Javascript by Inserting code in the request form.


Cross Site Scripting (XSS) vulnerability exists in Sourcecodester News247 CMS 1.0 via the search function in articles.


Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Vehicle Service Management System 1.0 via the Owner fullname parameter in a Send Service Request in vehicle_service.


Cross Site Scripting (XSS) in Remote Clinic v2.0 via the \Chat\ and \Personal Address\ field on staff/register.php


Cross Site Scripting (XSS) vulnerability in TRENDnet TV-IP110WN V1.2.2.64 V1.2.2.65 V1.2.2.68 via the profile parameter. in a GET request in view.cgi.


Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the \sessionpriv.php\ module. This allows attackers to craft a malicious URL which when clicked on by users can inject javascript code to be run by the application.


Cross Site Scripting (XSS) vulnerability in admin/files/edit in Omeka Classic <=2.7 allows remote attackers to inject arbitrary web script or HTML.


Cross Site Scripting (XSS) in the \Reset Password\ page form of Priority Enterprise Management System v8.00 allows attackers to execute javascript on behalf of the victim by sending a malicious URL or directing the victim to a malicious site.


Cross Site Scripting (XSS) vulnerability in contactus.php in Doctor Appointment System 1.0 allows remote attackers to inject arbitrary web script or HTML via the comment parameter.


Cross Site Scripting (XSS) vulnerability in contactus.php in Doctor Appointment System 1.0 allows remote attackers to inject arbitrary web script or HTML via the lastname parameter.


Cross Site Scripting (XSS) in X2Engine X2CRM v7.1 allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML via the \Comment\ field in \/profile/activity\ page.


Cross Site Scripting (XSS) in Remote Clinic v2.0 via the \Fever\ or \Blood Pressure\ field on the patients/register-report.php.


Cross Site Scripting (XSS) in Remote Clinic v2.0 via the \Clinic Name\ \Clinic Address\ \Clinic City\ or \Clinic Contact\ field on clinics/register.php


Cross Site Scripting (XSS) vulnerability exists in KindEditor (Chinese versions) 4.1.12 which can be exploited by an attacker to obtain user cookie information.


Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Full Name field on register-patient.php.


Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Symptons field on patients/register-report.php.


Cross Site Scripting (XSS) in Remote Clinic v2.0 via the First Name or Last Name field on staff/register.php.


Cross Site Scripting (XSS) vulnerability in the article comments feature in emlog 6.0.


Cross Site Scripting (XSS) vulnerability in objects/function.php in function getDeviceID in WWBN AVideo through 11.6 via the yptDevice parameter to view/include/head.php.


Cross Site Scripting (XSS) in IMG Tags in the ePO extension in McAfee Data Loss Prevention Endpoint (DLP Endpoint) 10.0.x allows authenticated users to inject arbitrary web script or HTML via injecting malicious JavaScript into a user's browsing session.


Cross site scripting (XSS) vulnerability in SAP Enterprise Portal 7.50 allows remote attackers to inject arbitrary web script or HTML aka SAP Security Notes 2469860 2471209 and 2488516.


Cross Site Scripting (XSS) exists in NexusPHP 1.5.beta5.20120707 via the PATH_INFO to location.php related to PHP_SELF.


Cross Site Scripting (XSS) exists in NexusPHP 1.5.beta5.20120707 via the PATH_INFO to ipsearch.php related to PHP_SELF.