Cisco Identity Services Engine 3.3.0

Cisco ISE API Unauthenticated Remote Code Execution Vulnerability

Cisco ISE API Unauthenticated Remote Code Execution Vulnerability

Cisco Identity Services Engine Authentication Bypass Vulnerability

Cisco Identity Services Engine Java Deserialization Vulnerability

Cisco Identity Services Engine Remote Code Execution Vulnerability

Cisco Identity Services Engine Multiple Remote Code Execution Vulnerability

Cisco Identity Services Engine Multiple Authenticated Remote Code Execution Vulnerability

ISE on AWS Static Credential

Cisco Identity Services Engine Insufficient Authorization Bypass Vulnerability

Cisco Identity Services Engine Remote Code Execution Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on the affected device with the privileges of the targeted user.

Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability

Cisco Identity Services Engine REST API Blind SQL Injection Vulnerabities

Cisco Identity Services Engine Authenticated Remote Code Execution Vulnerability

Cisco Identity Services Engine Authenticated Remote Code Execution Vulnerability

Cisco Identity Services Engine Path Traversal Vulnerability

Cisco Identity Services Engine Access Control Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to upload arbitrary files to an affected device. To exploit this vulnerability, an attacker would need at least valid Policy Admin credentials on the affected device. This vulnerability is due to improper validation of files that are uploaded to the web-based management interface. An attacker could exploit this vulnerability by uploading arbitrary files to an affected device. A successful exploit could allow the attacker to store malicious files on the system, execute arbitrary commands on the operating system, and elevate privileges to root.

Cisco Identity Services Engine Command Injection Vulnerability

Cisco Identity Services Engine Sensitive Information Disclosure Vulnerability

Cisco Identity Services Engine Authorization Bypass Vulnerability

Cisco Identity Services Engine XML External Entity Injection Vulnerability

Cisco Identity Services Engine Information Disclosure Vulnerability

Cisco Identity Services Engine Authorization Bypass Vulnerability

Cisco Identity Services Engine Cross-Site Scripting Vulnerability

Cisco Identity Services Engine Reflected Cross-Site Scripting Vulnerability

Cisco Identity Services Engine Reflected Cross-Site Scripting Vulnerability

Cisco Identity Services Engine Authenticated Privilege Escalation Vulnerability

Cisco Identity Services Engine Arbitrary File Read and Delete Vulnerability

Cisco Identity Services Engine Arbitrary File Read and Delete Vulnerability

Cisco Identity Services Engine Arbitrary File Read and Delete Vulnerability

Cisco Identity Services Engine Path Traversal Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a server-side request forgery (SSRF) attack through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected device. To successfully exploit this vulnerability, the attacker would need valid Super Admin credentials.

Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit these vulnerabilities by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker must have at least a low-privileged account on the affected device.

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have at least a low-privileged account on an affected device.

Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerabiliy

Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit these vulnerabilities by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker must have at least a low-privileged account on the affected device.

Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit these vulnerabilities by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker must have at least a low-privileged account on the affected device.

Cisco Identity Services Engine Observable Response Discrepancy Vulnerability

Cisco Identity Services Engine Path Traversal Vulnerability