Cisco Identity Services Engine Software vulnerabilities
32 known vulnerabilities affecting cisco/identity_services_engine_software.
Total CVEs
32
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL3HIGH4MEDIUM25
Vulnerabilities
Page 2 of 2
CVE-2015-4182MEDIUMCVSS 5.5v1.0.4.573v1.0_base+7 more2015-06-12
CVE-2015-4182 [MEDIUM] CWE-264 CVE-2015-4182: The administrative web interface in Cisco Identity Services Engine (ISE) before 1.3 allows remote au
The administrative web interface in Cisco Identity Services Engine (ISE) before 1.3 allows remote authenticated users to bypass intended access restrictions, and obtain sensitive information or change settings, via unspecified vectors, aka Bug ID CSCui72087.
nvd
CVE-2015-0757MEDIUMCVSS 5.0v1.2\(1.901\)v1.3\(0.722\)2015-05-29
CVE-2015-0757 [MEDIUM] CWE-200 CVE-2015-0757: The web framework in Cisco Identity Services Engine (ISE) 1.2(1.901) and 1.3(0.722) does not properl
The web framework in Cisco Identity Services Engine (ISE) 1.2(1.901) and 1.3(0.722) does not properly implement session handlers, which allows remote attackers to obtain sensitive information by reading web pages, as demonstrated by MnT reports, aka Bug ID CSCuq23140.
nvd
CVE-2014-3276MEDIUMCVSS 4.0≤ 1.2v1.0+1 more2014-05-26
CVE-2014-3276 [MEDIUM] CWE-399 CVE-2014-3276: Cisco Identity Services Engine (ISE) 1.2(.1 patch 2) and earlier does not properly handle deadlock c
Cisco Identity Services Engine (ISE) 1.2(.1 patch 2) and earlier does not properly handle deadlock conditions during reception of crafted RADIUS accounting packets from multiple NAS devices, which allows remote authenticated users to cause a denial of service (RADIUS outage) by sourcing these packets from two origins, aka Bug ID CSCuo56780.
nvd
CVE-2014-3275MEDIUMCVSS 6.5≤ 1.2v1.0+1 more2014-05-26
CVE-2014-3275 [MEDIUM] CWE-89 CVE-2014-3275: SQL injection vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2(.1 patc
SQL injection vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2(.1 patch 2) and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCul21337.
nvd
CVE-2014-0681MEDIUMCVSS 4.3≤ 1.22014-01-29
CVE-2014-0681 [MEDIUM] CWE-79 CVE-2014-0681: Cross-site scripting (XSS) vulnerability in Cisco Identity Services Engine (ISE) 1.2 patch 2 and ear
Cross-site scripting (XSS) vulnerability in Cisco Identity Services Engine (ISE) 1.2 patch 2 and earlier allows remote attackers to inject arbitrary web script or HTML via a report containing a crafted URL that is not properly handled during generation of report-output pages, aka Bug ID CSCui15064.
nvd
CVE-2013-5530CRITICALCVSS 9.0v1.0v1.1+5 more2013-10-25
CVE-2013-5530 [CRITICAL] CWE-78 CVE-2013-5530: The web framework in Cisco Identity Services Engine (ISE) 1.0 and 1.1.0 before 1.1.0.665-5, 1.1.1 be
The web framework in Cisco Identity Services Engine (ISE) 1.0 and 1.1.0 before 1.1.0.665-5, 1.1.1 before 1.1.1.268-7, 1.1.2 before 1.1.2.145-10, 1.1.3 before 1.1.3.124-7, 1.1.4 before 1.1.4.218-7, and 1.2 before 1.2.0.899-2 allows remote authenticated users to execute arbitrary commands via a crafted session on TCP port 443, aka Bug ID CSCuh81511.
nvd
CVE-2013-5531MEDIUMCVSS 5.0v1.0v1.12013-10-25
CVE-2013-5531 [MEDIUM] CWE-287 CVE-2013-5531: Cisco Identity Services Engine (ISE) 1.x before 1.1.1 allows remote attackers to bypass authenticati
Cisco Identity Services Engine (ISE) 1.x before 1.1.1 allows remote attackers to bypass authentication, and read support-bundle configuration and credentials data, via a crafted session on TCP port 443, aka Bug ID CSCty20405.
nvd
CVE-2013-5525MEDIUMCVSS 6.5≤ 1.2v1.0+1 more2013-10-10
CVE-2013-5525 [MEDIUM] CWE-89 CVE-2013-5525: SQL injection vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2 and ear
SQL injection vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCug90502.
nvd
CVE-2013-5523MEDIUMCVSS 4.3≤ 1.2v1.0+1 more2013-10-10
CVE-2013-5523 [MEDIUM] CWE-20 CVE-2013-5523: The Sponsor Portal in Cisco Identity Services Engine (ISE) 1.2 and earlier does not properly restric
The Sponsor Portal in Cisco Identity Services Engine (ISE) 1.2 and earlier does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCui82666.
nvd
CVE-2013-5524MEDIUMCVSS 4.3≤ 1.2v1.0+1 more2013-10-10
CVE-2013-5524 [MEDIUM] CWE-79 CVE-2013-5524: Cross-site scripting (XSS) vulnerability in the troubleshooting page in Cisco Identity Services Engi
Cross-site scripting (XSS) vulnerability in the troubleshooting page in Cisco Identity Services Engine (ISE) 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCug77655.
nvd
CVE-2012-3908MEDIUMCVSS 6.8v1.0v1.0.4+3 more2012-09-16
CVE-2012-3908 [MEDIUM] CWE-352 CVE-2012-3908: Multiple cross-site request forgery (CSRF) vulnerabilities in the ISE Administrator user interface (
Multiple cross-site request forgery (CSRF) vulnerabilities in the ISE Administrator user interface (aka the Apache Tomcat interface) on Cisco Identity Services Engine (ISE) 3300 series appliances before 1.1.0.665 Cumulative Patch 1 allow remote attackers to hijack the authentication of administrators, aka Bug ID CSCty46684.
nvd
CVE-2011-3290CRITICALCVSS 10.0≤ 1.0.4v1.0+1 more2011-09-21
CVE-2011-3290 [CRITICAL] CWE-255 CVE-2011-3290: Cisco Identity Services Engine (ISE) before 1.0.4.MR2 has default Oracle database credentials, which
Cisco Identity Services Engine (ISE) before 1.0.4.MR2 has default Oracle database credentials, which allows remote attackers to modify settings or perform unspecified other administrative actions via unknown vectors, aka Bug ID CSCts59135.
nvd
← Previous2 / 2