CVSS: 7.2EPSS: 0%CPEs: 1283EXPL: 0CVE-2020-3204 – Cisco IOS and IOS XE Software Tcl Arbitrary Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-3204
A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker with privileged EXEC credentials to execute arbitrary code on the underlying operating system (OS) with root privileges. The vulnerability is due to insufficient input validation of data passed to the Tcl interpreter. An attacker could exploit this vulnerability by loading malicious Tcl code on an affected device. A successful exploit could allow the attacker to cause memory corruption or execute the code with root privileges on the underlying OS of the affected device. Una vulnerabilidad en el Tool Command Language (Tcl) de Cisco IOS Software y Cisco IOS XE Software, podría permitir a un atacante local autenticado con credenciales EXEC privilegiadas ejecutar código arbitrario en el sistema operativo (SO) subyacente con privilegios root. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tcl-ace-C9KuVKmm • CWE-20: Improper Input Validation •
CVSS: 8.6EPSS: 0%CPEs: 60EXPL: 0CVE-2020-3203 – Cisco IOS XE Software Catalyst 9800 Series Wireless Controllers Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2020-3203
A vulnerability in the locally significant certificate (LSC) provisioning feature of Cisco Catalyst 9800 Series Wireless Controllers that are running Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak that could lead to a denial of service (DoS) condition. The vulnerability is due to incorrect processing of certain public key infrastructure (PKI) packets. An attacker could exploit this vulnerability by sending crafted Secure Sockets Layer (SSL) packets to an affected device. A successful exploit could cause an affected device to continuously consume memory, which could result in a memory allocation failure that leads to a crash and causes a DoS condition. Una vulnerabilidad en la funcionalidad locally significant certificate (LSC) de Cisco Catalyst 9800 Series Wireless Controllers que ejecuta Cisco IOS XE Software, podría permitir a un atacante remoto no autenticado causar una pérdida de memoria que podría conllevar a una condición de denegación de servicio (DoS) . • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-ewlc-dos-TkuPVmZN • CWE-400: Uncontrolled Resource Consumption CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 6.0EPSS: 0%CPEs: 1917EXPL: 0CVE-2020-3201 – Cisco IOS and IOS XE Software Tcl Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2020-3201
A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker with privileged EXEC credentials to cause a denial of service (DoS) condition on an affected system. The vulnerability is due to insufficient input validation of data passed to the Tcl interpreter. An attacker could exploit this vulnerability by executing crafted Tcl arguments on an affected device. An exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Una vulnerabilidad en el intérprete Tool Command Language (Tcl) de Cisco IOS Software y Cisco IOS XE Software, podría permitir a un atacante local autenticado con credenciales EXEC privilegiadas causar una condición de denegación de servicio (DoS) en un sistema afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tcl-dos-MAZQUnMF • CWE-20: Improper Input Validation •
CVSS: 5.8EPSS: 0%CPEs: 23EXPL: 0CVE-2020-3315 – Multiple Cisco Products Snort HTTP Detection Engine File Policy Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2020-3315
Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass the configured file policies on an affected system. The vulnerability is due to errors in how the Snort detection engine handles specific HTTP responses. An attacker could exploit this vulnerability by sending crafted HTTP packets that would flow through an affected system. A successful exploit could allow the attacker to bypass the configured file policies and deliver a malicious payload to the protected network. Múltiples productos de Cisco están afectados por una vulnerabilidad en el motor de detección Snort que podría permitir a un atacante remoto no autenticado omitir las políticas de archivos configuradas sobre un sistema afectado. • https://lists.debian.org/debian-lts-announce/2023/02/msg00011.html https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort_filepolbypass-m4X5DgOP https://www.debian.org/security/2023/dsa-5354 • CWE-668: Exposure of Resource to Wrong Sphere CWE-693: Protection Mechanism Failure •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2019-12669 – Cisco IOS and IOS XE Software Change of Authorization Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2019-12669
A vulnerability in the RADIUS Change of Authorization (CoA) code of Cisco TrustSec, a feature within Cisco IOS XE Software, could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of a malformed packet. An attacker could exploit this vulnerability by sending a malformed packet to an affected device. A successful exploit could allow the attacker to cause a DoS condition on the affected device. Una vulnerabilidad en el código Change of Authorization (CoA) RADIUS de Cisco TrustSec, una funcionalidad dentro del Software Cisco IOS XE, podría permitir a un atacante remoto no autenticado causar una condición de denegación de servicio (DoS) sobre un dispositivo afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-tsec • CWE-20: Improper Input Validation •