CVSS: 8.1EPSS: 0%CPEs: 418EXPL: 0CVE-2021-34739 – Cisco Small Business Series Switches Session Credentials Replay Vulnerability
https://notcve.org/view.php?id=CVE-2021-34739
04 Nov 2021 — A vulnerability in the web-based management interface of multiple Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to replay valid user session credentials and gain unauthorized access to the web-based management interface of an affected device. This vulnerability is due to insufficient expiration of session credentials. An attacker could exploit this vulnerability by conducting a man-in-the-middle attack against an affected device to intercept valid session credentials a... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-switches-tokens-UzwpR4e5 • CWE-613: Insufficient Session Expiration •
CVSS: 6.1EPSS: 0%CPEs: 216EXPL: 0CVE-2019-12718 – Cisco Small Business Smart and Managed Switches Cross-Site Scripting Vulnerability
https://notcve.org/view.php?id=CVE-2019-12718
16 Oct 2019 — A vulnerability in the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface of the affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link and subsequently access a specific web interf... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-sbss-xss • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 216EXPL: 0CVE-2019-12636 – Cisco Small Business Smart and Managed Switches Cross-Site Request Forgery Vulnerability
https://notcve.org/view.php?id=CVE-2019-12636
16 Oct 2019 — A vulnerability in the web-based management interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to pe... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-sbss-csrf • CWE-352: Cross-Site Request Forgery (CSRF) •