Cisco Identity Services Engine 3.3.0

Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerabiliy

Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit these vulnerabilities by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker must have at least a low-privileged account on the affected device.

Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit these vulnerabilities by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker must have at least a low-privileged account on the affected device.

Cisco Identity Services Engine Information Disclosure Vulnerability

Cisco Identity Services Engine Event Injection Vulnerability

Cisco Identity Services Engine Certificate Reload Vulnerability

Cisco Identity Services Engine Observable Response Discrepancy Vulnerability

Cisco Identity Services Engine Path Traversal Vulnerability

Cisco Identity Services Engine Arbitrary File Deletion Vulnerability

Cisco Identity Services Engine Arbitrary File Write Vulnerability

Cisco ISE REST API SQL Injection Vulnerability

Cisco ISE Profiler SQL Injection Vulnerability

Cisco ISE XML External Entity Injection Vulnerability

Cisco Identity Services Engine SQL Injection Vulnerability

Cisco Identity Services Engine SQL Injection Vulnerability

Cisco Identity Services Engine SQL Injection Vulnerability

Cisco Identity Services Engine Certificate Management SQL Injection Vulnerability

Cisco Identity Services Engine Arbitrary File Read Vulnerability

Cisco Identity Services Engine External Entity Injection Vulnerability

Cisco Identity Services Engine Authorization Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability exists because certain files lack proper data protection mechanisms. An attacker with read-only Administrator privileges could exploit this vulnerability by performing actions where the results should only be viewable to a high-privileged user. A successful exploit could allow the attacker to view passwords that are normally not visible to read-only administrators.

Cisco Identity Services Engine Arbitrary File Upload Vulnerability

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) guest portals could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit these vulnerabilities by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker must have valid administrative credentials.

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) guest portals could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit these vulnerabilities by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker must have valid administrative credentials.

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have Admin privileges on an affected device.

Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerability

Cisco Identity Services Stored Cross-Site Scripting Vulnerability

Cisco Identity Services Engine Cross-Site Scripting Vulnerability

Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerability

Cisco Identity Services Engine Multiple Cross-Site Scripting Vulnerabilities

Cisco Identity Services Engine Authentication Bypass Vulnerability

Cisco Identity Services Engine IP Filter Access Restriction for Admin Access Configuration Bypass Vulnerability