CVSS: 7.2EPSS: 0%CPEs: 6EXPL: 0CVE-2018-0221
https://notcve.org/view.php?id=CVE-2018-0221
A vulnerability in specific CLI commands for the Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to perform command injection to the underlying operating system or cause a hang or disconnect of the user session. The attacker needs valid administrator credentials for the device. The vulnerability is due to incomplete input validation of user input for certain CLI ISE configuration commands. An attacker could exploit this vulnerability by authenticating as an administrative user, issuing a specific CLI command, and entering crafted, malicious user input for the command parameters. An exploit could allow the attacker to perform command injection to the lower-level Linux operating system. • http://www.securityfocus.com/bid/103347 http://www.securitytracker.com/id/1040471 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-ise6 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.8EPSS: 0%CPEs: 12EXPL: 0CVE-2017-12261
https://notcve.org/view.php?id=CVE-2017-12261
A vulnerability in the restricted shell of the Cisco Identity Services Engine (ISE) that is accessible via SSH could allow an authenticated, local attacker to run arbitrary CLI commands with elevated privileges. The vulnerability is due to incomplete input validation of the user input for CLI commands issued at the restricted shell. An attacker could exploit this vulnerability by authenticating to the targeted device and executing commands that could lead to elevated privileges. An attacker would need valid user credentials to the device to exploit this vulnerability. The vulnerability affects the following Cisco Identity Services Engine (ISE) products running Release 1.4, 2.0, 2.0.1, 2.1.0: ISE, ISE Express, ISE Virtual Appliance. • http://www.securityfocus.com/bid/101641 http://www.securitytracker.com/id/1039717 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-ise • CWE-264: Permissions, Privileges, and Access Controls CWE-863: Incorrect Authorization •
CVSS: 9.8EPSS: 0%CPEs: 18EXPL: 0CVE-2017-6747
https://notcve.org/view.php?id=CVE-2017-6747
A vulnerability in the authentication module of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass local authentication. The vulnerability is due to improper handling of authentication requests and policy assignment for externally authenticated users. An attacker could exploit this vulnerability by authenticating with a valid external user account that matches an internal username and incorrectly receiving the authorization policy of the internal account. An exploit could allow the attacker to have Super Admin privileges for the ISE Admin portal. This vulnerability does not affect endpoints authenticating to the ISE. • http://www.securitytracker.com/id/1039054 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170802-ise • CWE-287: Improper Authentication •
CVSS: 5.4EPSS: 0%CPEs: 9EXPL: 0CVE-2017-6734
https://notcve.org/view.php?id=CVE-2017-6734
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected device, related to the Guest Portal. More Information: CSCvd74794. Known Affected Releases: 1.3(0.909) 2.1(0.800). Una vulnerabilidad en la interfaz de gestión web del portal de Cisco Identity Services Engine (ISE) Software podría permitir que un atacante remoto autenticado lleve a cabo un ataque de Cross-Site Scripting (XSS) contra un usuario de dicha interfaz en un sistema afectado. Esto se relaciona con Guest Portal. • http://www.securityfocus.com/bid/99459 http://www.securitytracker.com/id/1038823 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-ise2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-9214
https://notcve.org/view.php?id=CVE-2016-9214
Cisco Identity Services Engine (ISE) contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of the affected system. More Information: CSCvb86332 CSCvb86760. Known Affected Releases: 2.0(101.130). Cisco Identity Services Engine (ISE) contiene una vulnerabilidad que podría permitir a un atacante remoto no autenticado llevar a cabo un ataque de XSS contra el usuario de la interfaz web del sistema afectado. Más Información: CSCvb86332 CSCvb86760. • http://www.securityfocus.com/bid/94807 http://www.securitytracker.com/id/1037417 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-ise1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •