CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2019-12644 – Cisco Identity Services Engine Cross-Site Scripting Vulnerability
https://notcve.org/view.php?id=CVE-2019-12644
05 Sep 2019 — A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability exists because the web-based management interface of the affected device does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A succes... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190904-ise-xss • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 10EXPL: 0CVE-2019-1941 – Cisco Identity Services Engine Cross-Site Scripting Vulnerability
https://notcve.org/view.php?id=CVE-2019-1941
17 Jul 2019 — A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a malicious link. A successful exploit could allow the a... • http://www.securityfocus.com/bid/109297 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-1942 – Cisco Identity Services Engine Blind SQL Injection Vulnerability
https://notcve.org/view.php?id=CVE-2019-1942
17 Jul 2019 — A vulnerability in the sponsor portal web interface for Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to impact the integrity of an affected system by executing arbitrary SQL queries. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted input that includes SQL statements to an affected system. A successful exploit could allow the attacker to modify entries in some database tables, affe... • http://www.securityfocus.com/bid/109283 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-1851 – Cisco Identity Services Engine Arbitrary Client Certificate Creation Vulnerability
https://notcve.org/view.php?id=CVE-2019-1851
16 May 2019 — A vulnerability in the External RESTful Services (ERS) API of the Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to generate arbitrary certificates signed by the Internal Certificate Authority (CA) Services on ISE. This vulnerability is due to an incorrect implementation of role-based access control (RBAC). An attacker could exploit this vulnerability by crafting a specific HTTP request with administrative credentials. A successful exploit could allow the attacker to gene... • http://www.securityfocus.com/bid/108356 • CWE-285: Improper Authorization •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-0187 – Cisco Identity Services Engine Privileged Account Sensitive Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2018-0187
23 Jan 2019 — A vulnerability in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain confidential information for privileged accounts. The vulnerability is due to the improper handling of confidential information. An attacker could exploit this vulnerability by logging into the web interface on a vulnerable system. An exploit could allow an attacker to obtain confidential information for privileged accounts. This information could then be used to impersonate or... • http://www.securityfocus.com/bid/106717 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2018-15455 – Cisco Identity Services Engine Logging Cross-Site Scripting Vulnerability
https://notcve.org/view.php?id=CVE-2018-15455
23 Jan 2019 — A vulnerability in the logging component of Cisco Identity Services Engine could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability is due to the improper validation of requests stored in the system's logging database. An attacker could exploit this vulnerability by sending malicious requests to the targeted system. An exploit could allow the attacker to conduct cross-site scripting attacks when an administrator views the logs in the Admin Portal. Una vulner... • http://www.securityfocus.com/bid/106708 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2018-15459 – Cisco Identity Services Engine Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2018-15459
23 Jan 2019 — A vulnerability in the administrative web interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to gain additional privileges on an affected device. The vulnerability is due to improper controls on certain pages in the web interface. An attacker could exploit this vulnerability by authenticating to the device with an administrator account and sending a crafted HTTP request. A successful exploit could allow the attacker to create additional Admin accounts with differ... • http://www.securityfocus.com/bid/106707 • CWE-284: Improper Access Control •
CVSS: 4.9EPSS: 0%CPEs: 4EXPL: 0CVE-2018-15456 – Cisco Identity Services Engine Password Recovery Vulnerability
https://notcve.org/view.php?id=CVE-2018-15456
10 Jan 2019 — A vulnerability in the Admin Portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to view saved passwords in plain text. The vulnerability is due to the incorrect inclusion of saved passwords when loading configuration pages in the Admin Portal. An attacker with read or write access to the Admin Portal could exploit this vulnerability by browsing to a page that contains sensitive data. An exploit could allow the attacker to recover passwords for unauthorized use and e... • http://www.securityfocus.com/bid/106512 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-522: Insufficiently Protected Credentials •
CVSS: 6.5EPSS: 0%CPEs: 8EXPL: 0CVE-2018-15425 – Multiple Vulnerabilities in Cisco Identity Services Engine
https://notcve.org/view.php?id=CVE-2018-15425
05 Oct 2018 — A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device with the privileges of the web server. Una vulnerabilidad en la interfaz de gestión web de Cisco Identity Services Engine (ISE) podría permitir que un atacante remoto autenticado ejecute comandos arbitrarios en el sistema operativo subyacente de un dispositivo afectado con los privile... • http://www.securitytracker.com/id/1041792 • CWE-20: Improper Input Validation CWE-502: Deserialization of Untrusted Data •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2018-0413
https://notcve.org/view.php?id=CVE-2018-0413
01 Aug 2018 — A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow t... • http://www.securityfocus.com/bid/104950 • CWE-352: Cross-Site Request Forgery (CSRF) •