CVSS: 6.1EPSS: 0%CPEs: 216EXPL: 0CVE-2019-12718 – Cisco Small Business Smart and Managed Switches Cross-Site Scripting Vulnerability
https://notcve.org/view.php?id=CVE-2019-12718
A vulnerability in the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface of the affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link and subsequently access a specific web interface page. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information. Una vulnerabilidad en la interfaz basada en web de Cisco Small Business Smart and Managed Switches, podría permitir a un atacante remoto no autenticado conducir un ataque de tipo cross-site scripting (XSS) contra un usuario de la interfaz basada en web. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-sbss-xss • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 216EXPL: 0CVE-2019-12636 – Cisco Small Business Smart and Managed Switches Cross-Site Request Forgery Vulnerability
https://notcve.org/view.php?id=CVE-2019-12636
A vulnerability in the web-based management interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the targeted user. If the user has administrative privileges, the attacker could alter the configuration, execute commands, or cause a denial of service (DoS) condition on an affected device. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-sbss-csrf • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 5%CPEs: 114EXPL: 1CVE-2019-1943 – Cisco Small Business Series Switches Open Redirect Vulnerability
https://notcve.org/view.php?id=CVE-2019-1943
A vulnerability in the web interface of Cisco Small Business 200, 300, and 500 Series Switches software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of the parameters of an HTTP request. An attacker could exploit this vulnerability by intercepting a user's HTTP request and modifying it into a request that causes the web interface to redirect the user to a specific malicious URL. This type of vulnerability is known as an open redirect attack and is used in phishing attacks that get users to unknowingly visit malicious sites. Una vulnerabilidad en la interfaz web del software Cisco Small Business 200, 300 y 500 Series Switches podría permitir que un atacante remoto no autenticado redirija a un usuario a una página web maliciosa. • https://www.exploit-db.com/exploits/47118 http://www.securityfocus.com/bid/109288 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-sbss-redirect • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 7.5EPSS: 0%CPEs: 114EXPL: 0CVE-2019-1891 – Cisco Small Business Series Switches HTTP Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2019-1891
A vulnerability in the web interface of Cisco Small Business 200, 300, and 500 Series Managed Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper validation of requests sent to the web interface. An attacker could exploit this vulnerability by sending a malicious request to the web interface of an affected device. A successful exploit could allow the attacker to cause an unexpected reload of the device, resulting in a DoS condition. Una vulnerabilidad en la interfaz web de los Switches Administrados de las series 200, 300 y 500 de Cisco Small Business, podría permitir a un atacante remoto no identificado causar una condición de denegación de servicio (DoS) en un dispositivo afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-sbss-dos • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 114EXPL: 0CVE-2019-1892 – Cisco Small Business Series Switches Memory Corruption Vulnerability
https://notcve.org/view.php?id=CVE-2019-1892
A vulnerability in the Secure Sockets Layer (SSL) input packet processor of Cisco Small Business 200, 300, and 500 Series Managed Switches could allow an unauthenticated, remote attacker to cause a memory corruption on an affected device. The vulnerability is due to improper validation of HTTPS packets. An attacker could exploit this vulnerability by sending a malformed HTTPS packet to the management web interface of the affected device. A successful exploit could allow the attacker to cause an unexpected reload of the device, resulting in a denial of service (DoS) condition. Una vulnerabilidad en el procesador de paquetes de entrada de Secure Sockets Layer (SSL) de los Switches Administrados de las series 200, 300 y 500 de Cisco Small Business, podría permitir a un atacante remoto no autenticado causar una corrupción de memoria de un dispositivo afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-sbss-memcorrupt • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •