Skip to content
OpenAdvisories

Vendor

Cisco

3,476 known vulnerabilities.

Products

Cisco Small Business RV Series Router Firmware 262 Cisco IOS XE Software 248 Cisco Identity Services Engine Software 200 Cisco Firepower Threat Defense Software 160 Cisco Adaptive Security Appliance (ASA) Software 159 Cisco Firepower Management Center 128 Cisco IOS XR Software 115 Cisco NX-OS Software 102 Cisco Secure Firewall Threat Defense (FTD) Software 81 Cisco Data Center Network Manager 74 Cisco Unified Communications Manager 62 Cisco SD-WAN vManage 61 Cisco SD-WAN Solution 54 Cisco Prime Infrastructure 50 Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 48 Cisco Webex Meetings 46 Cisco Catalyst SD-WAN Manager 46 Cisco Unified Computing System (Managed) 41 Cisco Enterprise NFV Infrastructure Software 41 IOS 39 Cisco Unity Connection 39 Cisco IOS 36 Cisco ISE Passive Identity Connector 36 Cisco Unified Contact Center Express 36 Cisco WebEx WRF Player 35 Cisco Digital Network Architecture Center (DNA Center) 33 Cisco TelePresence Video Communication Server (VCS) Expressway 33 Cisco Email Security Appliance (ESA) 30 Cisco Application Policy Infrastructure Controller (APIC) 30 Cisco Secure Email 29 Cisco Aironet Access Point Software 29 Cisco UTD SNORT IPS Engine Software 29 Cisco Secure Firewall Management Center (FMC) 29 Cisco RoomOS Software 28 Cisco Nexus Dashboard 28 Cisco Unified Computing System E-Series Software (UCSE) 26 Cisco Wireless LAN Controller (WLC) 25 Cisco Web Security Appliance (WSA) 24 Cisco Unified Communications Manager IM and Presence Service 23 Cisco Secure Endpoint 23
All Critical High Medium Low Exploited only Public exploit

3,476 results · Feed

  • Medium 5.4
    CVE-2018-0482

    Cisco Prime Network Control System Stored Cross-Site Scripting Vulnerability

    A vulnerability in the web-based management interface of Cisco Prime Network Control System could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface of the affected system. The vul…

    Cisco Cisco Prime Network Control System Network devices
  • Medium 4.6
    CVE-2018-0483

    Cisco Jabber Client Framework Instant Message Cross-Site Scripting Vulnerability

    A vulnerability in Cisco Jabber Client Framework (JCF) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of an affected system. The vulnerability is due to insufficient validation of user-supplied inpu…

    Cisco Cisco Jabber IM for Android Android Network devices
  • Medium 4.3
    CVE-2018-0474

    Cisco Unified Communications Manager Digest Credentials Disclosure Vulnerability

    A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view digest credentials in clear text. The vulnerability is due to the incorrect inclusion of saved passwords in con…

    Cisco Cisco Unified Communications Manager Network devices
  • Medium 5.1
    CVE-2018-0449

    Cisco Jabber Client Framework Insecure Directory Permissions Vulnerability

    A vulnerability in the Cisco Jabber Client Framework (JCF) software, installed as part of the Cisco Jabber for Mac client, could allow an authenticated, local attacker to corrupt arbitrary files on an affected device that has elevated privileges. The vulnerab…

    Cisco Cisco Jabber for Mac Network devices
  • Medium 6.5
    CVE-2018-0461

    Cisco IP Phone 8800 Series Arbitrary Script Injection Vulnerability

    A vulnerability in the Cisco IP Phone 8800 Series Software could allow an unauthenticated, remote attacker to conduct an arbitrary script injection attack on an affected device. The vulnerability exists because the software running on an affected device insuf…

    Cisco Cisco IP Phone 8800 Series Software Network devices
  • Medium 6.8
    CVE-2018-0282

    Cisco IOS and IOS XE Software TCP Denial of Service Vulnerability

    A vulnerability in the TCP socket code of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to a state condition between the socket state and the transmission control …

    Cisco Cisco IOS iOS Network devices
  • High 7.3
    CVE-2018-0181

    Cisco Policy Suite for Mobile and Cisco Policy Suite Diameter Routing Agent Software Redis Server Unauthenticated Access Vulnerability

    A vulnerability in the Redis implementation used by the Cisco Policy Suite for Mobile and Cisco Policy Suite Diameter Routing Agent software could allow an unauthenticated, remote attacker to modify key-value pairs for short-lived events stored by the Redis s…

    Cisco Cisco Policy Suite (CPS) Software Network devices
  • High 8.1
    CVE-2018-15465

    Cisco Adaptive Security Appliance Software Privilege Escalation Vulnerability

    A vulnerability in the authorization subsystem of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, but unprivileged (levels 0 and 1), remote attacker to perform privileged actions by using the web management interface. The vulner…

    Cisco Cisco Adaptive Security Appliance (ASA) Software Network devices
  • Critical 9.4
    CVE-2018-15441

    Cisco Prime License Manager SQL Injection Vulnerability

    A vulnerability in the web framework code of Cisco Prime License Manager (PLM) could allow an unauthenticated, remote attacker to execute arbitrary SQL queries. The vulnerability is due to a lack of proper validation of user-supplied input in SQL queries. An …

    Cisco Cisco Prime License Manager Network devices
  • Medium 5.5
    CVE-2018-15452

    Cisco Advanced Malware Protection for Endpoints on Windows DLL Preloading Vulnerability

    A vulnerability in the DLL loading component of Cisco Advanced Malware Protection (AMP) for Endpoints on Windows could allow an authenticated, local attacker to disable system scanning services or take other actions to prevent detection of unauthorized intrus…

    Cisco Cisco AMP for Endpoints Network devices
  • Medium 5.4
    CVE-2018-15451

    Cisco Prime Service Catalog Cross-Site Scripting Vulnerability

    A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerability is due to…

    Cisco Cisco Prime Service Catalog Network devices
  • Medium 6.5
    CVE-2018-15450

    Cisco Prime Collaboration Assurance File Overwrite Vulnerability

    A vulnerability in the web-based UI of Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to overwrite files on the file system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerabi…

    Cisco Cisco Prime Collaboration Assurance Network devices
  • Medium 6.5
    CVE-2018-15447

    Cisco Integrated Management Controller Supervisor SQL Injection Vulnerability

    A vulnerability in the web framework code of Cisco Integrated Management Controller (IMC) Supervisor could allow an unauthenticated, remote attacker to execute arbitrary SQL queries. The vulnerability is due to a lack of proper validation of user-supplied inp…

    Cisco Cisco Integrated Management Controller (IMC) Supervisor Network devices
  • Medium 4.3
    CVE-2018-15449

    Cisco Video Surveillance Media Server Denial of Service Vulnerability

    A vulnerability in the web-based management interface of Cisco Video Surveillance Media Server could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of the web-based management interface of an affected system. The vulnerability is…

    Cisco Cisco Video Surveillance Media Server Software Network devices
  • Medium 5.3
    CVE-2018-15448

    Cisco Registered Envelope Service Information Disclosure Vulnerability

    A vulnerability in the user management functions of Cisco Registered Envelope Service could allow an unauthenticated, remote attacker to discover sensitive user information. The attacker could use this information to conduct additional reconnaissance attacks.…

    Cisco Cisco Registered Envelope Service Network devices
  • Medium 6.3
    CVE-2018-15445

    Cisco Energy Management Suite Cross-Site Request Forgery Vulnerability

    A vulnerability in the web-based management interface of Cisco Energy Management Suite Software could allow an authenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulner…

    Cisco Cisco Energy Management Suite Network devices
  • Medium 5.3
    CVE-2018-15446

    Cisco Meeting Server Information Disclosure Vulnerability

    A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper protections on data that is returned from user meeting requests when the Guest access via ID …

    Cisco Cisco Meeting Server Network devices
  • Medium 6.3
    CVE-2018-15444

    Cisco Energy Management Suite XML External Entity Vulnerability

    A vulnerability in the web-based user interface of Cisco Energy Management Suite Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper han…

    Cisco Cisco Energy Management Suite Network devices
  • Medium 5.8
    CVE-2018-15443

    Cisco Firepower Detection Engine TCP Intrusion Prevention System Rule Bypass Vulnerability

    A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a configured Intrusion Prevention System (IPS) rule that inspects certain types of TCP traffic. The vulnerability is due to in…

    Cisco Cisco Firepower Management Center Network devices
  • Critical 9.8
    CVE-2018-15381 EPSS 87%

    Cisco Unity Express Arbitrary Command Execution Vulnerability

    A Java deserialization vulnerability in Cisco Unity Express (CUE) could allow an unauthenticated, remote attacker to execute arbitrary shell commands with the privileges of the root user. The vulnerability is due to insecure deserialization of user-supplied c…

    Cisco Cisco Unity Express Network devices
  • Critical 9.8
    CVE-2018-15394

    Cisco Stealthwatch Management Console Authentication Bypass Vulnerability

    A vulnerability in the Stealthwatch Management Console (SMC) of Cisco Stealthwatch Enterprise could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected system. The vuln…

    Cisco Cisco Stealthwatch Enterprise Network devices
  • Medium 4.8
    CVE-2018-15393

    Cisco Content Security Management Appliance (SMA) Cross-Site Scripting Vulnerability

    A vulnerability in the web-based management interface of Cisco Content Security Management Appliance (SMA) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management inter…

    Cisco Cisco Content Security Management Appliance (SMA) Network devices
  • Critical 9.8
    CVE-2018-15439 Public exploit EPSS 50%

    Cisco Small Business Switches Privileged Access Vulnerability

    A vulnerability in the Cisco Small Business Switches software could allow an unauthenticated, remote attacker to bypass the user authentication mechanism of an affected device. The vulnerability exists because under specific circumstances, the affected softwa…

    Cisco Cisco Small Business 300 Series Managed Switches Network devices
  • Medium 5.5
    CVE-2018-15437 Public exploit

    Cisco Immunet and Cisco AMP for Endpoints System Scan Denial of Service Vulnerability

    A vulnerability in the system scanning component of Cisco Immunet and Cisco Advanced Malware Protection (AMP) for Endpoints running on Microsoft Windows could allow a local attacker to disable the scanning functionality of the product. This could allow execut…

    Cisco Cisco AMP for Endpoints Network devices
  • Unscored —
    CVE-2018-0284

    Cisco Meraki Local Status Page Privilege Escalation Vulnerability

    A vulnerability in the local status page functionality of the Cisco Meraki MR, MS, MX, Z1, and Z3 product lines could allow an authenticated, remote attacker to modify device configuration files. The vulnerability occurs when handling requests to the local st…

    Cisco Cisco Meraki Z1 Cisco Meraki MR Cisco Meraki MX Network devices
  • High 8.6
    CVE-2018-15454

    Cisco Adaptive Security Appliance Software and Cisco Firepower Threat Defense Software Denial of Service Vulnerability

    A vulnerability in the Session Initiation Protocol (SIP) inspection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to rel…

    Cisco Cisco Adaptive Security Appliance (ASA) Software Network devices
  • High 7.8
    CVE-2018-15442 Public exploit EPSS 16%

    Cisco Webex Meetings Desktop App Update Service Command Injection Vulnerability

    A vulnerability in the update service of Cisco Webex Meetings Desktop App for Windows could allow an authenticated, local attacker to execute arbitrary commands as a privileged user. The vulnerability is due to insufficient validation of user-supplied paramet…

    Cisco Cisco WebEx Event Center Network devices
  • High 7.4
    CVE-2018-0441

    Cisco IOS Access Points Software 802.11r Fast Transition Denial of Service Vulnerability

    A vulnerability in the 802.11r Fast Transition feature set of Cisco IOS Access Points (APs) Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a corruption…

    Cisco Cisco Aironet Access Point Software Network devices
  • Medium 5.8
    CVE-2018-0381

    Cisco Aironet 1560, 1800, 2800, and 3800 Series Access Points Denial of Service Vulnerability

    A vulnerability in the Cisco Aironet Series Access Points (APs) software could allow an authenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to a deadlo…

    Cisco Cisco Aironet Access Points Network devices
  • High 7.5
    CVE-2018-0417

    Cisco Wireless LAN Controller Software GUI Privilege Escalation Vulnerability

    A vulnerability in TACACS authentication with Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, local attacker to perform certain operations within the GUI that are not normally available to that user on the CLI. The vulnerability is …

    Cisco Cisco Wireless LAN Controller (WLC) Network devices
  • Medium 6.5
    CVE-2018-0420

    Cisco Wireless LAN Controller Software Directory Traversal Vulnerability

    A vulnerability in the web-based interface of Cisco Wireless LAN Controller Software could allow an authenticated, remote attacker to view sensitive information. The issue is due to improper sanitization of user-supplied input in HTTP request parameters that …

    Cisco Cisco Wireless LAN Controller (WLC) Network devices
  • High 8.6
    CVE-2018-0443

    Cisco Wireless LAN Controller Software Control and Provisioning of Wireless Access Points Protocol Denial of Service Vulnerability

    A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol component of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerabili…

    Cisco Cisco Wireless LAN Controller (WLC) Network devices
  • High 7.5
    CVE-2018-0442

    Cisco Wireless LAN Controller Software Control and Provisioning of Wireless Access Points Protocol Information Disclosure Vulnerability

    A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol component of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to retrieve memory contents, which could lead to the disclosu…

    Cisco Cisco Wireless LAN Controller (WLC) Network devices
  • Medium 6.5
    CVE-2018-15438

    Cisco Prime Collaboration Assurance Cross-Site Request Forgery Vulnerability

    A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnera…

    Cisco Cisco Prime Collaboration Assurance Network devices
  • Medium 6.1
    CVE-2018-15435

    Cisco SocialMiner Cross-Site Scripting Vulnerability

    A vulnerability in the web-based management interface of Cisco SocialMiner could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerability is due to …

    Cisco Cisco SocialMiner Network devices
  • High 8.6
    CVE-2018-0378

    Cisco NX-OS Software for Nexus 5500, 5600, and 6000 Series Switches Precision Time Protocol Denial of Service Vulnerability

    A vulnerability in the Precision Time Protocol (PTP) feature of Cisco Nexus 5500, 5600, and 6000 Series Switches running Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. T…

    Cisco Cisco NX-OS Software for Nexus 6000 Series Network devices
  • High 7.7
    CVE-2018-0456

    Cisco NX-OS Software Authenticated Simple Network Management Protocol Denial of Service Vulnerability

    A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco NX-OS Software could allow an authenticated, remote attacker to cause the SNMP application of an affected device to restart unexpectedly. The vulnerability is due…

    Cisco Cisco NX-OS Software for Nexus 3000 Series 7.0(3)I7(3) Network devices
  • High 8.8
    CVE-2018-0395

    Cisco FXOS and NX-OS Software Link Layer Discovery Protocol Denial of Service Vulnerability

    A vulnerability in the Link Layer Discovery Protocol (LLDP) implementation for Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition when the device unexpectedly reloads. Th…

    Cisco Cisco NX-OS Software Firepower 4100 Series Next-Generation Firewalls Network devices
  • Medium 5.4
    CVE-2018-15402

    Cisco Enterprise NFV Infrastructure Software Cross-Site Request Forgery Vulnerability

    A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to conduct cross-site request forgery (CSRF) attacks. The vulnerability is due to improper validation of Origin headers on HTTP requests wi…

    Cisco Cisco Enterprise NFV Infrastructure Software Network devices
  • Medium 5.4
    CVE-2018-15395

    Cisco Wireless LAN Controller Software Privilege Escalation Vulnerability

    A vulnerability in the authentication and authorization checking mechanisms of Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, adjacent attacker to gain network access to a Cisco TrustSec domain. Under normal circumstances, this acc…

    Cisco Cisco Wireless LAN Controller (WLC) Network devices