CVE Vulnerability Catalog

A vulnerability in the web-based management interface of Cisco ThousandEyes Virtual Appliance is due to improper validation of user-supplied input. An authenticated remote attacker can save configuration details containing malicious values, allowing injection and execution of arbitrary operating system commands with root privileges.

The web-based management interface of Cisco Identity Services Engine (ISE) does not properly validate user-supplied input, allowing an unauthenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack. By persuading a user to click a crafted link, the attacker can execute arbitrary script code in the context of the interface or access sensitive browser-based information.

Incomplete validation of SSL certificates in the Snort 2 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software allows an unauthenticated remote attacker to cause the engine to restart. The attacker sends a crafted SSL connection setup request, resulting in a denial of service (DoS) condition.

An internal security review by Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams revealed multiple vulnerabilities related to improper privilege management (CWE-269). A software hardening release addressing these internally discovered issues has been made available.

Lack of server-side validation of Administrator permissions in the web-based management interface of Cisco Identity Services Engine (ISE) allows an authenticated remote attacker to modify parts of the configuration. The attacker submits a crafted HTTP request to modify descriptions of files on a specific page.

Lack of server-side validation of Administrator permissions in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an authenticated remote attacker to modify parts of the configuration. The attacker submits a crafted HTTP request to modify descriptions of files on a specific page.

Insufficient validation of user-supplied input in IPsec Open API calls in Cisco ISE allows an authenticated remote attacker to inject arbitrary commands on the underlying operating system. Exploitation requires valid administrative credentials and a node with more than one network interface, one of which is an active IPsec tunnel.

Insufficient validation of user-supplied input in Cisco ISE allows an authenticated remote attacker to obtain write access on the underlying operating system. The attacker sends a crafted HTTP request, and exploitation requires valid administrative credentials.

A logic error when parsing a DNS query and tracking incoming buffer sizes in the DNS over TCP implementation of Cisco Secure Firewall ASA and FTD Software allows an unauthenticated remote attacker to restart the TCP DNS response handler and reload the device. The attacker must be able to respond to DNS queries from the device, either by controlling the DNS service or through a machine-in-the-middle attack.

Insufficient validation of user-supplied parameters in API requests in Cisco Identity Services Engine (ISE) allows an authenticated remote attacker to view sensitive information. Exploitation requires valid administrative credentials, and the data obtained may include hashed credentials.

A vulnerability in the access control list (ACL) Object Group Search (OGS) implementation of Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software. It is due to a logic error in populating group access control policies (ACPs) with OGS configured. An unauthenticated, remote attacker could send traffic that should be blocked and bypass configured access controls.

A vulnerability in the access control list (ACL) Object Group Search (OGS) implementation of Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software. It is due to a logic error in populating group access control policies (ACPs) with OGS configured. An unauthenticated, remote attacker could send traffic that should be blocked and bypass configured access controls.

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive information from network users outside the security group the attacker is assigned to. It exists because certain files lack proper authorization enforcement. An attacker with administrative privileges and management rights over network users could export users and view passwords normally not visible to administrators.

MikroTik firmware 7.19.4 stores sensitive authentication credentials and network state in cleartext within non-volatile storage. An attacker with physical access to the device can extract this material from an SPI flash dump without authenticating and without knowing the administrative password.

A flaw has been found in itsourcecode Leave Management System 1.0 affecting an unknown function of the file /module/leave/index.php. Manipulation of the ID argument leads to SQL injection. The attack may be launched remotely, and the exploit has been published and may be used.

A weakness has been identified in GPAC 26.08-DEV affecting the function wait_for_header_and_parse of the file src/utils/downloader.c. Manipulation of the Content-Range argument causes an out-of-bounds read. The attack requires local access, and the exploit has been made publicly available and could be used for attacks. Upgrading to version abi-16.26 fixes this issue (patch name: c74a3065038ede35c1c7b75fa493a69ef6bcdb84).

Tanium addressed a server-side request forgery vulnerability in Threat Response. Technical details were not provided in the description.

Tanium addressed an improper access controls vulnerability in Threat Response. Technical details were not provided in the description.

Tanium addressed an information disclosure vulnerability in Discover. Technical details were not provided in the description.

Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition. Framework authorization for these methods was limited to read and write privileges on the Process Group itself, unlike the corresponding asynchronous update request methods, which also authorize the encapsulated components and referenced Controller Services, Parameter Contexts, and Parameter Providers. As a result, an authenticated user with write access could modify or remove components in descendant Process Groups protected by more restrictive access policies.