Cisco Catalyst SD-WAN Manager

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of the web-based management interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Cisco SD-WAN vManage HTTP Authentication User Enumeration Vulnerability

Cisco Software-Defined Application Visibility and Control on Cisco vManage Authentication Bypass Vulnerability

Cisco SD-WAN vManage Information Disclosure Vulnerabilities

Cisco SD-WAN vManage Authorization Bypass Vulnerability

Cisco SD-WAN SQL Injection Vulnerability

Cisco SD-WAN Information Disclosure Vulnerability

Cisco SD-WAN vManage Software Information Disclosure Vulnerability

Cisco Catalyst SD-WAN Manager Reflected HTML Injection Vulnerability

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a directory traversal attack and obtain read access to sensitive files on an affected system. The vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains directory traversal character sequences to an affected system. A successful exploit could allow the attacker to write arbitrary files on the affected system.

Cisco SD-WAN vManage Cypher Query Language Injection Vulnerability

Cisco SD-WAN vManage Cross-Site Scripting Vulnerability