NotCVE - vendor:"Cisco" product:"Ios Xe" version:"3.5.6sq"

Page 8 of 142 results (0.008 seconds)

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0

CVE-2018-0188

https://notcve.org/view.php?id=CVE-2018-0188

28 Mar 2018 — Multiple vulnerabilities in the web-based user interface (web UI) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web UI of the affected software. The vulnerabilities are due to insufficient input validation of certain parameters that are passed to the affected software via the web UI. An attacker could exploit these vulnerabilities by persuading a user of the affected UI to access a malicious link or by intercepti... • http://www.securityfocus.com/bid/103551 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 0

CVE-2017-12319 – Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service Vulnerability

https://notcve.org/view.php?id=CVE-2017-12319

27 Mar 2018 — A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service (DoS) condition, or potentially corrupt the BGP routing table, which could result in network instability. The vulnerability exists due to changes in the implementation of the BGP MPLS-Based Ethernet VPN RFC (RFC 7432) draft between IOS XE software releases. When the BGP In... • http://www.securityfocus.com/bid/101676 • CWE-20: Improper Input Validation •

CVSS: 10.0EPSS: 0%CPEs: 17EXPL: 0

CVE-2017-12229

https://notcve.org/view.php?id=CVE-2017-12229

28 Sep 2017 — A vulnerability in the REST API of the web-based user interface (web UI) of Cisco IOS XE 3.1 through 16.5 could allow an unauthenticated, remote attacker to bypass authentication to the REST API of the web UI of the affected software. The vulnerability is due to insufficient input validation for the REST API of the affected software. An attacker could exploit this vulnerability by sending a malicious API request to an affected device. A successful exploit could allow the attacker to bypass authentication an... • http://www.securityfocus.com/bid/101032 • CWE-287: Improper Authentication •

CVSS: 7.8EPSS: 2%CPEs: 491EXPL: 0

CVE-2017-12237 – Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability

https://notcve.org/view.php?id=CVE-2017-12237

28 Sep 2017 — A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS 15.0 through 15.6 and Cisco IOS XE 3.5 through 16.5 could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that leads to a denial of service (DoS) condition. The vulnerability is due to how an affected device processes certain IKEv2 packets. An attacker could exploit this vulnerability by sending specific IKEv2 packets to an affected device to be pr... • http://www.securityfocus.com/bid/101037 • CWE-399: Resource Management Errors CWE-400: Uncontrolled Resource Consumption •

CVSS: 5.9EPSS: 0%CPEs: 581EXPL: 0

CVE-2017-12228

https://notcve.org/view.php?id=CVE-2017-12228

28 Sep 2017 — A vulnerability in the Cisco Network Plug and Play application of Cisco IOS 12.4 through 15.6 and Cisco IOS XE 3.3 through 16.4 could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data by using an invalid certificate. The vulnerability is due to insufficient certificate validation by the affected software. An attacker could exploit this vulnerability by supplying a crafted certificate to an affected device. A successful exploit could allow the attacker to conduct man-in-... • http://www.securityfocus.com/bid/101065 • CWE-20: Improper Input Validation CWE-295: Improper Certificate Validation •

CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0

CVE-2017-12236

https://notcve.org/view.php?id=CVE-2017-12236

28 Sep 2017 — A vulnerability in the implementation of the Locator/ID Separation Protocol (LISP) in Cisco IOS XE 3.2 through 16.5 could allow an unauthenticated, remote attacker using an x tunnel router to bypass authentication checks performed when registering an Endpoint Identifier (EID) to a Routing Locator (RLOC) in the map server/map resolver (MS/MR). The vulnerability is due to a logic error introduced via a code regression for the affected software. An attacker could exploit this vulnerability by sending specific ... • http://www.securityfocus.com/bid/101033 • CWE-287: Improper Authentication •

CVSS: 9.0EPSS: 5%CPEs: 3EXPL: 0

CVE-2017-6737 – Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

https://notcve.org/view.php?id=CVE-2017-6737

17 Jul 2017 — The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 2.2 through 3.17 contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6. Only traffic directed to an affected system can be used to exploit these vulnerabil... • http://www.securityfocus.com/bid/99345 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •