CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 0CVE-2019-16028 – Cisco Firepower Management Center Lightweight Directory Access Protocol Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2019-16028
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. The vulnerability is due to improper handling of Lightweight Directory Access Protocol (LDAP) authentication responses from an external authentication server. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to gain administrative access to the web-based management interface of the affected device. Una vulnerabilidad en la interfaz de administración basada en web de Cisco Firepower Management Center (FMC), podría permitir a un atacante remoto no autenticado omitir la autenticación y ejecutar acciones arbitrarias con privilegios administrativos en un dispositivo afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200122-fmc-auth • CWE-287: Improper Authentication •
CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-3302 – Cisco Firepower Management Center File Overwrite Vulnerability
https://notcve.org/view.php?id=CVE-2020-3302
A vulnerability in the web UI of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to overwrite files on the file system of an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by uploading a crafted file to the web UI on an affected device. A successful exploit could allow the attacker to overwrite files on the file system of the affected device. Una vulnerabilidad en la Interfaz de Usuario web del Cisco Firepower Management Center (FMC) Software, podría permitir a un atacante remoto autenticado sobrescribir archivos en el sistema de archivos de un dispositivo afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmcai-z5dQObVN • CWE-20: Improper Input Validation •
CVSS: 8.1EPSS: 0%CPEs: 13EXPL: 0CVE-2020-3301 – Cisco Firepower Management Center Static Credential Vulnerabilities
https://notcve.org/view.php?id=CVE-2020-3301
Multiple vulnerabilities in Cisco Firepower Management Center (FMC) Software and Cisco Firepower User Agent Software could allow an attacker to access a sensitive part of an affected system with a high-privileged account. For more information about these vulnerabilities, see the Details section of this advisory. Múltiples vulnerabilidades en el Cisco Firepower Management Center (FMC) Software y el Cisco Firepower User Agent Software, podrían permitir a un atacante acceder a una parte confidencial de un sistema afectado con una cuenta muy privilegiada. Para más información sobre estas vulnerabilidades, consulte la sección Detalles de este aviso. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmcua-statcred-weeCcZct • CWE-798: Use of Hard-coded Credentials •
CVSS: 9.8EPSS: 0%CPEs: 13EXPL: 0CVE-2020-3318 – Cisco Firepower Management Center Static Credential Vulnerabilities
https://notcve.org/view.php?id=CVE-2020-3318
Multiple vulnerabilities in Cisco Firepower Management Center (FMC) Software and Cisco Firepower User Agent Software could allow an attacker to access a sensitive part of an affected system with a high-privileged account. For more information about these vulnerabilities, see the Details section of this advisory. Múltiples vulnerabilidades en el Cisco Firepower Management Center (FMC) Software y Cisco Firepower User Agent Software, podrían permitir a un atacante acceder a una parte confidencial de un sistema afectado con una cuenta muy privilegiada. Para más información sobre estas vulnerabilidades, consulte la sección Detalles de este aviso. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmcua-statcred-weeCcZct • CWE-798: Use of Hard-coded Credentials •
CVSS: 5.8EPSS: 0%CPEs: 23EXPL: 0CVE-2020-3315 – Multiple Cisco Products Snort HTTP Detection Engine File Policy Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2020-3315
Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass the configured file policies on an affected system. The vulnerability is due to errors in how the Snort detection engine handles specific HTTP responses. An attacker could exploit this vulnerability by sending crafted HTTP packets that would flow through an affected system. A successful exploit could allow the attacker to bypass the configured file policies and deliver a malicious payload to the protected network. Múltiples productos de Cisco están afectados por una vulnerabilidad en el motor de detección Snort que podría permitir a un atacante remoto no autenticado omitir las políticas de archivos configuradas sobre un sistema afectado. • https://lists.debian.org/debian-lts-announce/2023/02/msg00011.html https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort_filepolbypass-m4X5DgOP https://www.debian.org/security/2023/dsa-5354 • CWE-668: Exposure of Resource to Wrong Sphere CWE-693: Protection Mechanism Failure •