CVSS: 7.8EPSS: 0%CPEs: 12EXPL: 0CVE-2017-12261
https://notcve.org/view.php?id=CVE-2017-12261
02 Nov 2017 — A vulnerability in the restricted shell of the Cisco Identity Services Engine (ISE) that is accessible via SSH could allow an authenticated, local attacker to run arbitrary CLI commands with elevated privileges. The vulnerability is due to incomplete input validation of the user input for CLI commands issued at the restricted shell. An attacker could exploit this vulnerability by authenticating to the targeted device and executing commands that could lead to elevated privileges. An attacker would need valid... • http://www.securityfocus.com/bid/101641 • CWE-264: Permissions, Privileges, and Access Controls CWE-863: Incorrect Authorization •
CVSS: 9.8EPSS: 5%CPEs: 18EXPL: 0CVE-2017-6747
https://notcve.org/view.php?id=CVE-2017-6747
07 Aug 2017 — A vulnerability in the authentication module of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass local authentication. The vulnerability is due to improper handling of authentication requests and policy assignment for externally authenticated users. An attacker could exploit this vulnerability by authenticating with a valid external user account that matches an internal username and incorrectly receiving the authorization policy of the internal account. An explo... • http://www.securitytracker.com/id/1039054 • CWE-287: Improper Authentication •
CVSS: 5.4EPSS: 0%CPEs: 9EXPL: 0CVE-2017-6734
https://notcve.org/view.php?id=CVE-2017-6734
10 Jul 2017 — A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected device, related to the Guest Portal. More Information: CSCvd74794. Known Affected Releases: 1.3(0.909) 2.1(0.800). Una vulnerabilidad en la interfaz de gestión web del portal de Cisco Identity Services Engine (ISE) Software podría permitir que un atacante remoto au... • http://www.securityfocus.com/bid/99459 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •