CVSS: 9.1EPSS: 5%CPEs: 25EXPL: 2CVE-2022-20829 – Cisco Adaptive Security Device Manager and Adaptive Security Appliance Software Client-side Arbitrary Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-20829
24 Jun 2022 — A vulnerability in the packaging of Cisco Adaptive Security Device Manager (ASDM) images and the validation of those images by Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker with administrative privileges to upload an ASDM image that contains malicious code to a device that is running Cisco ASA Software. This vulnerability is due to insufficient validation of the authenticity of an ASDM image during its installation on a device that is running Cisco ASA Softwa... • https://github.com/jbaines-r7/theway • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-20651 – Cisco Adaptive Security Device Manager Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2022-20651
22 Jun 2022 — A vulnerability in the logging component of Cisco Adaptive Security Device Manager (ASDM) could allow an authenticated, local attacker to view sensitive information in clear text on an affected system. Cisco ADSM must be deployed in a shared workstation environment for this issue to be exploited. This vulnerability is due to the storage of unencrypted credentials in certain logs. An attacker could exploit this vulnerability by accessing the logs on an affected system. A successful exploit could allow the at... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asdm-logging-jnLOY422 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 9.3EPSS: 32%CPEs: 1EXPL: 2CVE-2021-1585 – Cisco Adaptive Security Device Manager Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-1585
08 Jul 2021 — A vulnerability in the Cisco Adaptive Security Device Manager (ASDM) Launcher could allow an unauthenticated, remote attacker to execute arbitrary code on a user's operating system. This vulnerability is due to a lack of proper signature verification for specific code exchanged between the ASDM and the Launcher. An attacker could exploit this vulnerability by leveraging a man-in-the-middle position on the network to intercept the traffic between the Launcher and the ASDM and then inject arbitrary code. A su... • https://github.com/jbaines-r7/staystaystay • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 0%CPEs: 13EXPL: 0CVE-2019-1715 – Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys Vulnerability
https://notcve.org/view.php?id=CVE-2019-1715
03 May 2019 — A vulnerability in the Deterministic Random Bit Generator (DRBG), also known as Pseudorandom Number Generator (PRNG), used in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a cryptographic collision, enabling the attacker to discover the private key of an affected device. The vulnerability is due to insufficient entropy in the DRBG when generating cryptographic keys. An attacker could exploit this vu... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-asa-ftd-entropy • CWE-332: Insufficient Entropy in PRNG •
CVSS: 9.8EPSS: 0%CPEs: 39EXPL: 0CVE-2013-1192
https://notcve.org/view.php?id=CVE-2013-1192
25 Apr 2013 — The JAR files on Cisco Device Manager for Cisco MDS 9000 devices before 5.2.8, and Cisco Device Manager for Cisco Nexus 5000 devices, allow remote attackers to execute arbitrary commands on Windows client machines via a crafted element-manager.jnlp file, aka Bug IDs CSCty17417 and CSCty10802. Los archivos JAR en Cisco Device Manager de dispositivos Cisco MDS 9000 antes de v5.2.8 y Cisco Device Manager dispositivos Nexus 5000, permite a atacantes remotos ejecutar comandos arbitrarios en los equipos cliente d... • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-fmdm • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2007-0397
https://notcve.org/view.php?id=CVE-2007-0397
20 Jan 2007 — The Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.2.3 and Adaptive Security Device Manager (ASDM) before 5.2(2.54) do not validate the SSL/TLS certificates or SSH public keys when connecting to devices, which allows remote attackers to spoof those devices to obtain sensitive information or generate incorrect information. El Cisco Security Monitoring, Analysis y Response System (CS-MARS) anterior 4.2.3 y Adaptive Security Device Manager (ASDM) anterior 5.2(2.54) no valida los cer... • http://osvdb.org/32720 •