CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2019-12689 – Cisco Firepower Management Center Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2019-12689
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system of an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending malicious commands to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system of the affected device. Una vulnerabilidad en la interfaz de administración basada en web del Software Cisco Firepower Management Center (FMC), podría permitir a un atacante remoto autenticado ejecutar código arbitrario sobre el sistema operativo subyacente de un dispositivo afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-fmc-rce-12689 • CWE-20: Improper Input Validation •
CVSS: 9.0EPSS: 0%CPEs: 5EXPL: 0CVE-2019-12683 – Cisco Firepower Management Center SQL Injection Vulnerabilities
https://notcve.org/view.php?id=CVE-2019-12683
Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary SQL injections on an affected device. These vulnerabilities exist due to improper input validation. An attacker could exploit these vulnerabilities by sending crafted SQL queries to an affected device. A successful exploit could allow the attacker to view information that they are not authorized to view, make changes to the system that they are not authorized to make, and execute commands within the underlying operating system that may affect the availability of the device. Múltiples vulnerabilidades en la interfaz de administración basada en web del Software Cisco Firepower Management Center (FMC), podrían permitir a un atacante remoto autenticado ejecutar inyecciones SQL arbitrarias sobre un dispositivo afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-fmc-sql-inj • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.0EPSS: 0%CPEs: 4EXPL: 0CVE-2019-12681 – Cisco Firepower Management Center SQL Injection Vulnerabilities
https://notcve.org/view.php?id=CVE-2019-12681
Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary SQL injections on an affected device. These vulnerabilities exist due to improper input validation. An attacker could exploit these vulnerabilities by sending crafted SQL queries to an affected device. A successful exploit could allow the attacker to view information that they are not authorized to view, make changes to the system that they are not authorized to make, and execute commands within the underlying operating system that may affect the availability of the device. Múltiples vulnerabilidades en la interfaz de administración basada en web del Software Cisco Firepower Management Center (FMC), podrían permitir a un atacante remoto autenticado ejecutar inyecciones SQL arbitrarias sobre un dispositivo afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-fmc-sql-inj • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.8EPSS: 0%CPEs: 6EXPL: 0CVE-2019-1949 – Cisco Firepower Management Center Persistent Cross-Site Scripting Vulnerability
https://notcve.org/view.php?id=CVE-2019-1949
A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Una vulnerabilidad en la interfaz de administración basada en web de Firepower Management Center de Cisco, podría permitir a un atacante remoto autenticado realizar un ataque de tipo cross-site scripting (XSS) contra un usuario de la interfaz de administración basada en web de un sistema afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-fmc-xss • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.8EPSS: 0%CPEs: 5EXPL: 0CVE-2019-1833 – Cisco Firepower Threat Defense Software SSL/TLS Policy Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2019-1833
A vulnerability in the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) protocol parser of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured policies. The vulnerability is due to improper parsing of specific attributes in a TLS packet header. An attacker could exploit this vulnerability by sending malicious TLS messages to the affected system. A successful exploit could allow the attacker to bypass the configured policies for the system, which could allow traffic to flow through without being inspected. Una vulnerabilidad en Secure Sockets Layer (SSL)/Transport Layer Security (TLS) protocol parser of Cisco Firepower Threat Defense (FTD) Software, podría permitir a un atacante remoto no autorizado omitir las políticas configuradas. • http://www.securityfocus.com/bid/108338 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-ftd-ssltls-bypass • CWE-693: Protection Mechanism Failure •