CVSS: 8.8EPSS: 0%CPEs: 16EXPL: 0CVE-2023-20003 – Cisco Business Wireless Access Points Social Login Guest User Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2023-20003
A vulnerability in the social login configuration option for the guest users of Cisco Business Wireless Access Points (APs) could allow an unauthenticated, adjacent attacker to bypass social login authentication. This vulnerability is due to a logic error with the social login implementation. An attacker could exploit this vulnerability by attempting to authenticate to an affected device. A successful exploit could allow the attacker to access the Guest Portal without authentication. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cbw-auth-bypass-ggnAfdZ • CWE-288: Authentication Bypass Using an Alternate Path or Channel CWE-306: Missing Authentication for Critical Function •
CVSS: 5.4EPSS: 0%CPEs: 7EXPL: 0CVE-2023-20172 – Cisco Identity Services Engine Arbitrary File Delete and File Read Vulnerabilities
https://notcve.org/view.php?id=CVE-2023-20172
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to delete or read arbitrary files on the underlying operating system. To exploit these vulnerabilities, an attacker must have valid credentials on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-delete-read-PK5ghDDd • CWE-20: Improper Input Validation CWE-602: Client-Side Enforcement of Server-Side Security •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-20077 – Cisco Identity Services Engine Arbitrary File Download Vulnerabilities
https://notcve.org/view.php?id=CVE-2023-20077
Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device. These vulnerabilities are due to insufficient input validation. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to download arbitrary files from the underlying filesystem of the affected device. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-dwnld-Srcdnkd2 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-37: Path Traversal: '/absolute/pathname/here' •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-20087 – Cisco Identity Services Engine Arbitrary File Download Vulnerabilities
https://notcve.org/view.php?id=CVE-2023-20087
Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device. These vulnerabilities are due to insufficient input validation. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to download arbitrary files from the underlying filesystem of the affected device. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-dwnld-Srcdnkd2 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-37: Path Traversal: '/absolute/pathname/here' •
CVSS: 5.4EPSS: 0%CPEs: 7EXPL: 0CVE-2023-20106 – Cisco Identity Services Engine Arbitrary File Delete and File Read Vulnerabilities
https://notcve.org/view.php?id=CVE-2023-20106
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to delete or read arbitrary files on the underlying operating system. To exploit these vulnerabilities, an attacker must have valid credentials on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-delete-read-PK5ghDDd • CWE-602: Client-Side Enforcement of Server-Side Security •