Skip to content
OpenAdvisories

Vendor

Cisco

3,476 known vulnerabilities.

Products

Cisco Small Business RV Series Router Firmware 262 Cisco IOS XE Software 248 Cisco Identity Services Engine Software 200 Cisco Firepower Threat Defense Software 160 Cisco Adaptive Security Appliance (ASA) Software 159 Cisco Firepower Management Center 128 Cisco IOS XR Software 115 Cisco NX-OS Software 102 Cisco Secure Firewall Threat Defense (FTD) Software 81 Cisco Data Center Network Manager 74 Cisco Unified Communications Manager 62 Cisco SD-WAN vManage 61 Cisco SD-WAN Solution 54 Cisco Prime Infrastructure 50 Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 48 Cisco Webex Meetings 46 Cisco Catalyst SD-WAN Manager 46 Cisco Unified Computing System (Managed) 41 Cisco Enterprise NFV Infrastructure Software 41 IOS 39 Cisco Unity Connection 39 Cisco IOS 36 Cisco ISE Passive Identity Connector 36 Cisco Unified Contact Center Express 36 Cisco WebEx WRF Player 35 Cisco Digital Network Architecture Center (DNA Center) 33 Cisco TelePresence Video Communication Server (VCS) Expressway 33 Cisco Email Security Appliance (ESA) 30 Cisco Application Policy Infrastructure Controller (APIC) 30 Cisco Secure Email 29 Cisco Aironet Access Point Software 29 Cisco UTD SNORT IPS Engine Software 29 Cisco Secure Firewall Management Center (FMC) 29 Cisco RoomOS Software 28 Cisco Nexus Dashboard 28 Cisco Unified Computing System E-Series Software (UCSE) 26 Cisco Wireless LAN Controller (WLC) 25 Cisco Web Security Appliance (WSA) 24 Cisco Unified Communications Manager IM and Presence Service 23 Cisco Secure Endpoint 23
All Critical High Medium Low Exploited only Public exploit

1,877 results · Clear filters · Feed

  • Medium 6.0
    CVE-2024-20492

    Cisco Expressway Series Privilege Escalation Vulnerability

    A vulnerability in the restricted shell of Cisco Expressway Series could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker…

    Cisco Cisco TelePresence Video Communication Server (VCS) Expressway Network devices
  • Medium 6.3
    CVE-2024-20491

    Cisco Nexus Dashboard Insights Information Disclosure Vulnerability

    A vulnerability in a logging function of Cisco Nexus Dashboard Insights could allow an attacker with access to a tech support file to view sensitive information. This vulnerability exists because remote controller credentials are recorded in an internal log t…

    Cisco Cisco Nexus Dashboard Insights Network devices
  • Medium 6.3
    CVE-2024-20490

    Cisco Nexus Dashboard Fabric Controller and Nexus Dashboard Orchestrator Information Disclosure Vulnerability

    A vulnerability in a logging function of Cisco Nexus Dashboard Fabric Controller (NDFC) and Cisco Nexus Dashboard Orchestrator (NDO) could allow an attacker with access to a tech support file to view sensitive information. This vulnerability exists because HT…

    Cisco Cisco Data Center Network Manager Cisco Nexus Dashboard Orchestrator Network devices
  • Medium 5.4
    CVE-2024-20477

    Cisco Nexus Dashboard Fabric Controller Unauthorized REST API Endpoint Vulnerability

    A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to upload or delete files on an affected device. This vulnerability exists because of missing authorization controls on the affected RE…

    Cisco Cisco Data Center Network Manager Network devices
  • Medium 6.5
    CVE-2024-20470

    Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Remote Code Execution Vulnerability

    A vulnerability in the web-based management interface of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device. In order to exploit this…

    Cisco Cisco Small Business RV Series Router Firmware Network devices
  • Medium 6.3
    CVE-2024-20448

    Cisco Nexus Dashboard Fabric Controller Credential Information Disclosure Vulnerability

    A vulnerability in the Cisco Nexus Dashboard Fabric Controller (NDFC) software, formerly Cisco Data Center Network Manager (DCNM), could allow an attacker with access to a backup file to view sensitive information. This vulnerability is due to the improper st…

    Cisco Cisco Data Center Network Manager Network devices
  • Medium 5.5
    CVE-2024-20444

    Cisco Nexus Dashboard Fabric Controller REST API Command Injection Vulnerability

    A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC), formerly Cisco Data Center Network Manager (DCNM), could allow an authenticated, remote attacker with network-admin privileges to perform a command injection attack against an affected device.…

    Cisco Cisco Data Center Network Manager Network devices
  • Medium 5.4
    CVE-2024-20442

    Cisco Nexus Dashboard Unauthorized API Endpoints Vulnerability

    A vulnerability in the REST API endpoints of Cisco Nexus Dashboard could allow an authenticated, low-privileged, remote attacker to perform limited Administrator actions on an affected device. This vulnerability is due to insufficient authorization controls o…

    Cisco Cisco Nexus Dashboard Network devices
  • Medium 5.7
    CVE-2024-20441

    Cisco Nexus Dashboard Fabric Controller Unauthorized API Endpoint Vulnerability

    A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to learn sensitive information on an affected device. This vulnerability is due to insufficient authorization controls on the affected …

    Cisco Cisco Data Center Network Manager Network devices
  • Medium 6.3
    CVE-2024-20438

    Cisco Nexus Dashboard Fabric Controller Unauthorized REST API Vulnerability

    A vulnerability in the REST API endpoints of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to read or write files on an affected device. This vulnerability exists because of missing authorization controls on some REST API endpoints.…

    Cisco Cisco Data Center Network Manager Network devices
  • Medium 5.9
    CVE-2024-20385

    Cisco Nexus Dashboard Orchestrator SSL Certificate Validation Vulnerability

    A vulnerability in the SSL/TLS implementation of Cisco Nexus Dashboard Orchestrator (NDO) could allow an unauthenticated, remote attacker to intercept sensitive information from an affected device.  This vulnerability exists because the Cisco NDO Validat…

    Cisco Cisco Nexus Dashboard Orchestrator Network devices
  • Medium 6.5
    CVE-2024-20365

    Cisco Integrated Management Controller Redfish Command Injection Vulnerability

    A vulnerability in the Redfish API of Cisco UCS B-Series, Cisco UCS Managed C-Series, and Cisco UCS X-Series Servers could allow an authenticated, remote attacker with administrative privileges to perform command injection attacks on an affected system and el…

    Cisco Cisco Unified Computing System (Managed) Network devices
  • Medium 4.3
    CVE-2024-20434

    A vulnerability in Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service…

    Cisco Cisco IOS XE Software iOS Network devices
  • Medium 6.5
    CVE-2024-20414

    A vulnerability in the web UI feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, r…

    Cisco Cisco IOS XE Software IOS iOS Network devices
  • Medium 5.8
    CVE-2024-20465

    A vulnerability in the access control list (ACL) programming of Cisco IOS Software running on Cisco Industrial Ethernet…

    Cisco IOS iOS Network devices
  • Medium 4.7
    CVE-2024-20510

    A vulnerability in the Central Web Authentication (CWA) feature of Cisco IOS XE Software for Wireless Controllers could…

    Cisco Cisco IOS XE Software iOS Network devices
  • Medium 6.1
    CVE-2024-20496

    Cisco SD-WAN vEdge Routers Denial of Service Vulnerability

    A vulnerability in the UDP packet validation code of Cisco SD-WAN vEdge Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected system. This vulnerability is due to incorrect handling of a specifi…

    Cisco Cisco SD-WAN vEdge Router Cisco SD-WAN vEdge Cloud Network devices
  • Medium 6.4
    CVE-2024-20475

    Cisco SD-WAN vManage Cross-Site Scripting Vulnerability

    A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerabi…

    Cisco Cisco Catalyst SD-WAN Manager Network devices
  • Medium 5.8
    CVE-2024-20508

    Cisco UTD Snort IPS Engine Software for Cisco IOS XE Software Security Policy Bypass and Denial of Service Vulnerability

    A vulnerability in Cisco Unified Threat Defense (UTD) Snort Intrusion Prevention System (IPS) Engine for Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass configured security policies or cause a denial of service (DoS) condition …

    Cisco Cisco UTD SNORT IPS Engine Software Network devices
  • Medium 5.3
    CVE-2024-20390

    Cisco IOS XR Software Dedicated XML Agent TCP Denial of Service Vulnerability

    A vulnerability in the Dedicated XML Agent feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) on XML TCP listen port 38751. This vulnerability is due to a lack of proper error validation of ingr…

    Cisco Cisco IOS XR Software iOS Network devices
  • Medium 5.5
    CVE-2024-20343

    Cisco IOS XR Software CLI Arbitrary File Read Vulnerability

    A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to read any file in the file system of the underlying Linux operating system. The attacker must have valid credentials on the affected device. This vulnerability …

    Cisco Cisco IOS XR Software iOS Network devices
  • Medium 6.1
    CVE-2024-20506

    ClamAV Privilege Handling Escalation Vulnerability

    A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an authe…

    Cisco ClamAV clamav clamav Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 4.0
    CVE-2024-20505

    ClamAV Memory Handling DoS

    A vulnerability in the PDF parsing module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an unauthe…

    Cisco ClamAV clamav clamav Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 4.3
    CVE-2024-20497

    Cisco Expressway Edge Improper Authorization Vulnerability

    A vulnerability in Cisco Expressway Edge (Expressway-E) could allow an authenticated, remote attacker to masquerade as another user on an affected system. This vulnerability is due to inadequate authorization checks for Mobile and Remote Access (MRA) users. A…

    Cisco Cisco TelePresence Video Communication Server (VCS) Expressway Network devices
  • Medium 5.5
    CVE-2024-20503

    Cisco Duo Epic for Hyperdrive Information Disclosure Vulnerability

    A vulnerability in Cisco Duo Epic for Hyperdrive could allow an authenticated, local attacker to view sensitive information in cleartext on an affected system. This vulnerability is due to improper storage of an unencrypted registry key. A low-privileged atta…

    Cisco Cisco Duo Authentication for Epic Network devices
  • Medium 6.0
    CVE-2024-20469

    Cisco Identity Services Engine Command Injection Vulnerability

    A vulnerability in specific CLI commands in Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability…

    Cisco Cisco Identity Services Engine Software Network devices
  • Medium 5.3
    CVE-2024-20284

    Cisco NX-OS Software Python Parser Escape Vulnerability

    A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to escape the Python sandbox and gain unauthorized access to the underlying operating system of the device. The vulnerability is due…

    Cisco Cisco NX-OS Software Network devices
  • Medium 5.3
    CVE-2024-20285

    Cisco NX-OS Software Python Parser Escape Vulnerability

    A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to escape the Python sandbox and gain unauthorized access to the underlying operating system of the device. The vulnerability is due…

    Cisco Cisco NX-OS Software Network devices
  • Medium 5.3
    CVE-2024-20286

    Cisco NX-OS Software Python Parser Escape Vulnerability

    A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to escape the Python sandbox and gain unauthorized access to the underlying operating system of the device. The vulnerability is due…

    Cisco Cisco NX-OS Software Network devices
  • Medium 4.4
    CVE-2024-20289

    Cisco NX-OS Software Command Injection Vulnerability

    A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to execute arbitrary commands on the underlying operating system of an affected device.  This vulnerability is due to insufficient validation …

    Cisco Cisco NX-OS Software Cisco NX-OS System Software in ACI Mode Network devices
  • Medium 6.5
    CVE-2024-20478

    Cisco Application Policy Infrastructure Controller App Privilege Escalation Vulnerability

    A vulnerability in the software upgrade component of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Network Controller, formerly Cisco Cloud APIC, could allow an authenticated, remote attacker with Administrator-level privilege…

    Cisco Cisco Application Policy Infrastructure Controller (APIC) Network devices
  • Medium 6.7
    CVE-2024-20411

    Cisco NX-OS Bash Arbitrary Code Execution Vulnerability

    A vulnerability in Cisco NX-OS Software could allow an authenticated, local attacker with privileges to access the Bash shell to execute arbitrary code as root on an affected device. This vulnerability is due to insufficient security restrictions when ex…

    Cisco Cisco NX-OS Software Network devices
  • Medium 6.7
    CVE-2024-20413

    Cisco NX-OS Bash Privilege Escalation Vulnerability

    A vulnerability in Cisco NX-OS Software could allow an authenticated, local attacker with privileges to access the Bash shell to elevate privileges to network-admin on an affected device. This vulnerability is due to insufficient security restrictions when ex…

    Cisco Cisco NX-OS Software Network devices
  • Medium 4.3
    CVE-2024-20279

    Cisco Application Policy Infrastructure Controller Unauthorized Policy Actions Vulnerability

    A vulnerability in the restricted security domain implementation of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to modify the behavior of default system policies, such as quality of service (QoS) pol…

    Cisco Cisco Application Policy Infrastructure Controller (APIC) Network devices
  • Medium 6.5
    CVE-2024-20417

    Cisco Identity Services Engine REST API Blind SQL Injection Vulnerabities

    Multiple vulnerabilities in the REST API of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct blind SQL injection attacks. These vulnerabilities are due to insufficient validation of user-supplied input in REST API …

    Cisco Cisco Identity Services Engine Software Network devices
  • Medium 6.5
    CVE-2024-20466

    Cisco Identity Services Engine Sensitive Information Disclosure Vulnerability

    A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due to improper enforcement of administr…

    Cisco Cisco Identity Services Engine Software Network devices
  • Medium 6.5
    CVE-2024-20486

    Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability

    A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. This vulne…

    Cisco Cisco Identity Services Engine Software Network devices
  • Medium 6.1
    CVE-2024-20488

    Cisco Unified Communications Manager Cross-Site Scripting Vulnerability

    A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct a cross-…

    Cisco Cisco Unified Communications Manager Network devices
  • Medium 4.8
    CVE-2024-20479

    A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to con…

    Cisco Cisco Identity Services Engine Software Network devices
  • Medium 5.4
    CVE-2024-20443

    A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to con…

    Cisco Cisco Identity Services Engine Software Cisco Adaptive Security Appliance (ASA) Software Network devices