CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-20953 – Cisco TelePresence Collaboration Endpoint and RoomOS Software Vulnerabilities
https://notcve.org/view.php?id=CVE-2022-20953
Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal attacks, view sensitive data, or write arbitrary files on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. Varias vulnerabilidades en el software Cisco TelePresence Collaboration Endpoint (CE) y en el software Cisco RoomOS podrían permitir a un atacante conducir ataques de salto de ruta, visualizar datos confidenciales o escribir archivos arbitrarios en un dispositivo afectado. Para más información sobre estas vulnerabilidades, consulte la sección Detalles de este aviso • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-trav-beFvCcyu • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.6EPSS: 0%CPEs: 67EXPL: 0CVE-2022-20933 – Cisco Meraki MX and Z3 Teleworker Gateway VPN Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2022-20933
A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z3 Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient validation of client-supplied parameters while establishing an SSL VPN session. An attacker could exploit this vulnerability by crafting a malicious request and sending it to the affected device. A successful exploit could allow the attacker to cause the Cisco AnyConnect VPN server to crash and restart, resulting in the failure of the established SSL VPN connections and forcing remote users to initiate a new VPN connection and re-authenticate. A sustained attack could prevent new SSL VPN connections from being established. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-mx-vpn-dos-vnESbgBf • CWE-234: Failure to Handle Missing Parameter •
CVSS: 8.1EPSS: 0%CPEs: 4EXPL: 0CVE-2022-20822 – Cisco Identity Services Engine Unauthorized File Access Vulnerability
https://notcve.org/view.php?id=CVE-2022-20822
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to read and delete files on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains certain character sequences to an affected system. A successful exploit could allow the attacker to read or delete specific files on the device that their configured administrative level should not have access to. Cisco plans to release software updates that address this vulnerability. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-path-trav-Dz5dpzyM https://yoroi.company/en/research/cve-advisory-full-disclosure-cisco-ise-path-traversal • CWE-20: Improper Input Validation CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 0CVE-2022-20811 – Cisco TelePresence Collaboration Endpoint and RoomOS Software Vulnerabilities
https://notcve.org/view.php?id=CVE-2022-20811
Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal attacks, view sensitive data, or write arbitrary files on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. Varias vulnerabilidades en el software Cisco TelePresence Collaboration Endpoint (CE) y en el software Cisco RoomOS podrían permitir a un atacante conducir ataques de salto de rutas, visualizar datos confidenciales o escribir archivos arbitrarios en un dispositivo afectado. Para más información sobre estas vulnerabilidades, consulte la sección Detalles de este aviso • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-trav-beFvCcyu • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 12EXPL: 0CVE-2022-20917 – Cisco Jabber XMPP Stanza Smuggling
https://notcve.org/view.php?id=CVE-2022-20917
A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) message processing feature of Cisco Jabber could allow an authenticated, remote attacker to manipulate the content of XMPP messages that are used by the affected application. This vulnerability is due to the improper handling of nested XMPP messages within requests that are sent to the Cisco Jabber client software. An attacker could exploit this vulnerability by connecting to an XMPP messaging server and sending crafted XMPP messages to an affected Jabber client. A successful exploit could allow the attacker to manipulate the content of XMPP messages, possibly allowing the attacker to cause the Jabber client application to perform unsafe actions. Una vulnerabilidad en el Extensible Messaging y Presence Protocol (XMPP) característica del procesamiento de mensajes de Cisco Jabber podría permitir que un atacante remoto autenticado manipule el contenido de los mensajes XMPP que utiliza la aplicación afectada. Esta vulnerabilidad se debe al manejo inadecuado de mensajes XMPP anidados dentro de las solicitudes que se envían al software cliente Cisco Jabber. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-jabber-xmpp-Ne9SCM • CWE-668: Exposure of Resource to Wrong Sphere •