Cisco Identity Services Engine Software vulnerabilities

CVE-2019-15282 [MEDIUM] CWE-306 CVE-2019-15282: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Softwa A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an unauthenticated, remote attacker read tcpdump files generated on an affected device. The vulnerability is due an issue in the authentication logic of the web-based management interface. An attacker could exploit this vulnerability by

CVE-2019-15281 [MEDIUM] CWE-79 CVE-2019-15281: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Softwa A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The attacker must have valid administrator credentials. The vulnerability

CVE-2018-15463 [MEDIUM] CWE-79 CVE-2018-15463: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient input validation of some parameters passed to the web-based management

CVE-2018-15440 [MEDIUM] CWE-79 CVE-2018-15440: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface of an affected system. The vulnerability is due to insufficient sanitization of user-supplied data that is written to log

CVE-2018-0413 [HIGH] CWE-352 CVE-2018-0413: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affe

CVE-2018-0339 [MEDIUM] CWE-79 CVE-2018-0339: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient input validation of some parameters passed to the web-based management interface.

CVE-2018-0289 [MEDIUM] CWE-79 CVE-2018-0289: A vulnerability in the logs component of Cisco Identity Services Engine could allow an unauthenticat A vulnerability in the logs component of Cisco Identity Services Engine could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability is due to improper validation of requests stored in logs in the application management interface. An attacker could exploit this vulnerability by sending malicious requests to

CVE-2018-0327 [MEDIUM] CWE-79 CVE-2018-0327: A vulnerability in the web framework of Cisco Identity Services Engine (ISE) could allow an unauthen A vulnerability in the web framework of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain parameters that are passed to the affected software vi

CVE-2017-12316 [HIGH] CWE-287 CVE-2017-12316: A vulnerability in the Guest Portal login page of Cisco Identity Services Engine (ISE) could allow a A vulnerability in the Guest Portal login page of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to perform multiple login attempts in excess of the configured login attempt limit. The vulnerability is due to insufficient server-side login attempt limit enforcement. An attacker could exploit this vulnerability by

CVE-2017-3835 [HIGH] CWE-89 CVE-2017-3835: A vulnerability in the sponsor portal of Cisco Identity Services Engine (ISE) could allow an authent A vulnerability in the sponsor portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access notices owned by other users, because of SQL Injection. More Information: CSCvb15627. Known Affected Releases: 1.4(0.908).

CVE-2016-9214 [MEDIUM] CWE-79 CVE-2016-9214: Cisco Identity Services Engine (ISE) contains a vulnerability that could allow an unauthenticated, r Cisco Identity Services Engine (ISE) contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of the affected system. More Information: CSCvb86332 CSCvb86760. Known Affected Releases: 2.0(101.130).

CVE-2016-1485 [MEDIUM] CWE-79 CVE-2016-1485: Cross-site scripting (XSS) vulnerability in Cisco Identity Services Engine 1.3(0.876) allows remote Cross-site scripting (XSS) vulnerability in Cisco Identity Services Engine 1.3(0.876) allows remote attackers to inject arbitrary web script or HTML via crafted parameters, aka Bug ID CSCva46497.

CVE-2016-1402 [HIGH] CWE-119 CVE-2016-1402: The Active Directory (AD) integration component in Cisco Identity Service Engine (ISE) before 1.2.0. The Active Directory (AD) integration component in Cisco Identity Service Engine (ISE) before 1.2.0.899 patch 7, when AD group-membership authorization is enabled, allows remote attackers to cause a denial of service (authentication outage) via a crafted Password Authentication Protocol (PAP) authentication request, aka Bug ID CSCun25815.

CVE-2015-6317 [MEDIUM] CWE-284 CVE-2015-6317: Cisco Identity Services Engine (ISE) before 2.0 allows remote authenticated users to bypass intended Cisco Identity Services Engine (ISE) before 2.0 allows remote authenticated users to bypass intended web-resource access restrictions via a direct request, aka Bug ID CSCuu45926.

CVE-2015-6323 [CRITICAL] CVE-2015-6323: The Admin portal in Cisco Identity Services Engine (ISE) 1.1.x, 1.2.0 before patch 17, 1.2.1 before The Admin portal in Cisco Identity Services Engine (ISE) 1.1.x, 1.2.0 before patch 17, 1.2.1 before patch 8, 1.3 before patch 5, and 1.4 before patch 4 allows remote attackers to obtain administrative access via unspecified vectors, aka Bug ID CSCuw34253.

CVE-2015-6266 [MEDIUM] CWE-287 CVE-2015-6266: The guest portal in Cisco Identity Services Engine (ISE) 3300 1.2(0.899) does not restrict access to The guest portal in Cisco Identity Services Engine (ISE) 3300 1.2(0.899) does not restrict access to uploaded HTML documents, which allows remote attackers to obtain sensitive information from customized documents via a direct request, aka Bug ID CSCuo78045.

CVE-2015-4266 [MEDIUM] CWE-20 CVE-2015-4266: The web interface in Cisco Identity Services Engine (ISE) 1.1(4.1), 1.3(106.146), and 1.3(120.135) d The web interface in Cisco Identity Services Engine (ISE) 1.1(4.1), 1.3(106.146), and 1.3(120.135) does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCut04556.

CVE-2015-4267 [MEDIUM] CWE-352 CVE-2015-4267: Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Identity Services Engi Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2(0.793), 1.3(0.876), 1.4(0.109), 2.0(0.147), and 2.0(0.169) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus09940.

CVE-2015-4268 [MEDIUM] CWE-79 CVE-2015-4268: Multiple cross-site scripting (XSS) vulnerabilities in the Infra Admin UI in Cisco Identity Services Multiple cross-site scripting (XSS) vulnerabilities in the Infra Admin UI in Cisco Identity Services Engine (ISE) 1.2(1.198) and 1.3(0.876) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET or (2) POST request, aka Bug ID CSCus16052.

CVE-2015-4219 [MEDIUM] CWE-200 CVE-2015-4219: Cisco Secure Access Control System before 5.4(0.46.2) and 5.5 before 5.5(0.46) and Cisco Identity Se Cisco Secure Access Control System before 5.4(0.46.2) and 5.5 before 5.5(0.46) and Cisco Identity Services Engine 1.0(4.573) do not properly implement access control for support bundles, which allows remote authenticated users to obtain sensitive information via brute-force attempts to send valid credentials, aka Bug IDs CSCue00833 and CSCub40331.