cpe:/o:juniper:junos:12.1x46:d10 cpe:/o:juniper:junos:12.1x46:d15 cpe:/o:juniper:junos:12.1x46:d20 cpe:/o:juniper:junos:12.1x46:d25 cpe:/o:juniper:junos:12.1x46:d30 cpe:/o:juniper:junos:12.1x46:d35 cpe:/o:juniper:junos:12.1x46:d40 cpe:/o:juniper:junos:12.1x46:d45 cpe:/o:juniper:junos:12.1x46:d50 cpe:/o:juniper:junos:12.1x46:d55 cpe:/o:juniper:junos:12.1x46:d60 cpe:/o:juniper:junos:12.1x46:d65 cpe:/o:juniper:junos:12.3 cpe:/o:juniper:junos:12.3:r1 cpe:/o:juniper:junos:12.3:r10 cpe:/o:juniper:junos:12.3:r2 cpe:/o:juniper:junos:12.3:r3 cpe:/o:juniper:junos:12.3:r4 cpe:/o:juniper:junos:12.3:r5 cpe:/o:juniper:junos:12.3:r6 cpe:/o:juniper:junos:12.3:r7 cpe:/o:juniper:junos:12.3:r8 cpe:/o:juniper:junos:12.3:r9 cpe:/o:juniper:junos:12.3x48:d10 cpe:/o:juniper:junos:12.3x48:d15 cpe:/o:juniper:junos:12.3x48:d20 cpe:/o:juniper:junos:12.3x48:d25 cpe:/o:juniper:junos:12.3x48:d30 cpe:/o:juniper:junos:14.1 cpe:/o:juniper:junos:14.1:r1 cpe:/o:juniper:junos:14.1:r2 cpe:/o:juniper:junos:14.1:r3 cpe:/o:juniper:junos:14.1:r4 cpe:/o:juniper:junos:14.1:r8 cpe:/o:juniper:junos:14.1:r9 cpe:/o:juniper:junos:14.1x53 cpe:/o:juniper:junos:14.1x53:d10 cpe:/o:juniper:junos:14.1x53:d15 cpe:/o:juniper:junos:14.1x53:d16 cpe:/o:juniper:junos:14.1x53:d25 cpe:/o:juniper:junos:14.1x53:d26 cpe:/o:juniper:junos:14.1x53:d27 cpe:/o:juniper:junos:14.1x53:d35 cpe:/o:juniper:junos:14.1x53:d50 cpe:/o:juniper:junos:14.2:r1 cpe:/o:juniper:junos:14.2:r2 cpe:/o:juniper:junos:14.2:r3 cpe:/o:juniper:junos:14.2:r4 cpe:/o:juniper:junos:14.2:r5 cpe:/o:juniper:junos:14.2:r7 cpe:/o:juniper:junos:14.2:r8 cpe:/o:juniper:junos:15.1:r1 cpe:/o:juniper:junos:15.1:r2 cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d25 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d60 cpe:/o:juniper:junos:15.1x53:d61 cpe:/o:juniper:junos:15.1x53:d62 cpe:/o:juniper:junos:15.1x53:d63

CVE-2018-0001

2018-01-10T17:29:00.930-05:00

2018-02-22T21:29:02.140-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 103092 SECTRACK 1040180 CONFIRM https://kb.juniper.net/JSA10828 A remote, unauthenticated attacker may be able to execute code by exploiting a use-after-free defect found in older versions of PHP through injection of crafted data via specific PHP URLs within the context of the J-Web process. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D67; 12.3 versions prior to 12.3R12-S5; 12.3X48 versions prior to 12.3X48-D35; 14.1 versions prior to 14.1R8-S5, 14.1R9; 14.1X53 versions prior to 14.1X53-D44, 14.1X53-D50; 14.2 versions prior to 14.2R7-S7, 14.2R8; 15.1 versions prior to 15.1R3; 15.1X49 versions prior to 15.1X49-D30; 15.1X53 versions prior to 15.1X53-D70.

cpe:/o:juniper:junos:12.1x46:d10 cpe:/o:juniper:junos:12.1x46:d15 cpe:/o:juniper:junos:12.1x46:d20 cpe:/o:juniper:junos:12.1x46:d25 cpe:/o:juniper:junos:12.1x46:d30 cpe:/o:juniper:junos:12.1x46:d35 cpe:/o:juniper:junos:12.1x46:d40 cpe:/o:juniper:junos:12.1x46:d45 cpe:/o:juniper:junos:12.1x46:d50 cpe:/o:juniper:junos:12.1x46:d55 cpe:/o:juniper:junos:12.3x48:d10 cpe:/o:juniper:junos:12.3x48:d15 cpe:/o:juniper:junos:12.3x48:d20 cpe:/o:juniper:junos:12.3x48:d25 cpe:/o:juniper:junos:12.3x48:d30 cpe:/o:juniper:junos:14.1:r1 cpe:/o:juniper:junos:14.1:r2 cpe:/o:juniper:junos:14.1:r3 cpe:/o:juniper:junos:14.1:r4 cpe:/o:juniper:junos:14.1:r5 cpe:/o:juniper:junos:14.1:r6 cpe:/o:juniper:junos:14.1:r7 cpe:/o:juniper:junos:14.1:r8 cpe:/o:juniper:junos:14.2:r1 cpe:/o:juniper:junos:14.2:r2 cpe:/o:juniper:junos:14.2:r3 cpe:/o:juniper:junos:14.2:r4 cpe:/o:juniper:junos:14.2:r5 cpe:/o:juniper:junos:14.2:r6 cpe:/o:juniper:junos:14.2:r7 cpe:/o:juniper:junos:15.1:f6-s9 cpe:/o:juniper:junos:15.1:r1 cpe:/o:juniper:junos:15.1:r2 cpe:/o:juniper:junos:15.1:r3 cpe:/o:juniper:junos:15.1:r4 cpe:/o:juniper:junos:15.1:r6-s4 cpe:/o:juniper:junos:15.1:r7 cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d15 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d25 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d55 cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.1:r4 cpe:/o:juniper:junos:16.1:r5 cpe:/o:juniper:junos:16.2:r1 cpe:/o:juniper:junos:16.2:r2 cpe:/o:juniper:junos:17.1:r1 cpe:/o:juniper:junos:17.1:r3

CVE-2018-0002

2018-01-10T17:29:00.963-05:00

2019-10-09T19:30:55.407-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1040178 CONFIRM https://kb.juniper.net/JSA10829 On SRX Series and MX Series devices with a Service PIC with any ALG enabled, a crafted TCP/IP response packet processed through the device results in memory corruption leading to a flowd daemon crash. Sustained crafted response packets lead to repeated crashes of the flowd daemon which results in an extended Denial of Service condition. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D60 on SRX series; 12.3X48 versions prior to 12.3X48-D35 on SRX series; 14.1 versions prior to 14.1R9 on MX series; 14.2 versions prior to 14.2R8 on MX series; 15.1X49 versions prior to 15.1X49-D60 on SRX series; 15.1 versions prior to 15.1R5-S8, 15.1F6-S9, 15.1R6-S4, 15.1R7 on MX series; 16.1 versions prior to 16.1R6 on MX series; 16.2 versions prior to 16.2R3 on MX series; 17.1 versions prior to 17.1R2-S4, 17.1R3 on MX series. No other Juniper Networks products or platforms are affected by this issue.

cpe:/o:juniper:junos:12.1x46 cpe:/o:juniper:junos:12.1x46:d10 cpe:/o:juniper:junos:12.1x46:d15 cpe:/o:juniper:junos:12.1x46:d20 cpe:/o:juniper:junos:12.1x46:d25 cpe:/o:juniper:junos:12.1x46:d30 cpe:/o:juniper:junos:12.1x46:d35 cpe:/o:juniper:junos:12.1x46:d40 cpe:/o:juniper:junos:12.1x46:d45 cpe:/o:juniper:junos:12.1x46:d50 cpe:/o:juniper:junos:12.1x46:d55 cpe:/o:juniper:junos:12.1x46:d60 cpe:/o:juniper:junos:12.1x46:d65 cpe:/o:juniper:junos:12.1x46:d70 cpe:/o:juniper:junos:12.3:r1 cpe:/o:juniper:junos:12.3:r10 cpe:/o:juniper:junos:12.3:r2 cpe:/o:juniper:junos:12.3:r3 cpe:/o:juniper:junos:12.3:r4 cpe:/o:juniper:junos:12.3:r5 cpe:/o:juniper:junos:12.3:r6 cpe:/o:juniper:junos:12.3:r7 cpe:/o:juniper:junos:12.3:r8 cpe:/o:juniper:junos:12.3:r9 cpe:/o:juniper:junos:12.3x48 cpe:/o:juniper:junos:12.3x48:d10 cpe:/o:juniper:junos:12.3x48:d15 cpe:/o:juniper:junos:12.3x48:d20 cpe:/o:juniper:junos:12.3x48:d25 cpe:/o:juniper:junos:12.3x48:d30 cpe:/o:juniper:junos:12.3x48:d35 cpe:/o:juniper:junos:12.3x48:d40 cpe:/o:juniper:junos:12.3x48:d45 cpe:/o:juniper:junos:12.3x48:d50 cpe:/o:juniper:junos:14.1:r1 cpe:/o:juniper:junos:14.1:r2 cpe:/o:juniper:junos:14.1:r3 cpe:/o:juniper:junos:14.1:r4 cpe:/o:juniper:junos:14.1:r5 cpe:/o:juniper:junos:14.1:r6 cpe:/o:juniper:junos:14.1:r7 cpe:/o:juniper:junos:14.1:r9 cpe:/o:juniper:junos:14.1x53:d10 cpe:/o:juniper:junos:14.1x53:d107 cpe:/o:juniper:junos:14.1x53:d15 cpe:/o:juniper:junos:14.1x53:d16 cpe:/o:juniper:junos:14.1x53:d25 cpe:/o:juniper:junos:14.1x53:d26 cpe:/o:juniper:junos:14.1x53:d27 cpe:/o:juniper:junos:14.1x53:d30 cpe:/o:juniper:junos:14.1x53:d35 cpe:/o:juniper:junos:14.2:r1 cpe:/o:juniper:junos:14.2:r2 cpe:/o:juniper:junos:14.2:r3 cpe:/o:juniper:junos:14.2:r4 cpe:/o:juniper:junos:14.2:r7 cpe:/o:juniper:junos:14.2:r8 cpe:/o:juniper:junos:15.1:f1 cpe:/o:juniper:junos:15.1:f2 cpe:/o:juniper:junos:15.1:f3 cpe:/o:juniper:junos:15.1:f4 cpe:/o:juniper:junos:15.1:f6-s8 cpe:/o:juniper:junos:15.1:r5-s6 cpe:/o:juniper:junos:15.1:r6-s3 cpe:/o:juniper:junos:15.1:r7 cpe:/o:juniper:junos:15.1x49 cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d55 cpe:/o:juniper:junos:15.1x49:d60 cpe:/o:juniper:junos:15.1x49:d65 cpe:/o:juniper:junos:15.1x49:d70 cpe:/o:juniper:junos:15.1x49:d75 cpe:/o:juniper:junos:15.1x49:d80 cpe:/o:juniper:junos:15.1x49:d90 cpe:/o:juniper:junos:15.1x53:d10 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d231 cpe:/o:juniper:junos:15.1x53:d25 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r4 cpe:/o:juniper:junos:16.1:r5 cpe:/o:juniper:junos:16.1x65:d20 cpe:/o:juniper:junos:16.1x65:d30 cpe:/o:juniper:junos:16.2:r1 cpe:/o:juniper:junos:16.2:r3 cpe:/o:juniper:junos:17.1:r1 cpe:/o:juniper:junos:17.1:r3 cpe:/o:juniper:junos:17.2 cpe:/o:juniper:junos:17.2:r2 cpe:/o:juniper:junos:17.2x75

CVE-2018-0003

2018-01-10T17:29:01.010-05:00

2019-10-02T20:03:26.223-04:00

6.1

ADJACENT_NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 105715 SECTRACK 1040179 CONFIRM https://kb.juniper.net/JSA10831 A specially crafted MPLS packet received or processed by the system, on an interface configured with MPLS, will store information in the system memory. Subsequently, if this stored information is accessed, this may result in a kernel crash leading to a denial of service. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D71; 12.3 versions prior to 12.3R12-S7; 12.3X48 versions prior to 12.3X48-D55; 14.1 versions prior to 14.1R8-S5, 14.1R9; 14.1X53 versions prior to 14.1X53-D45, 14.1X53-D107; 14.2 versions prior to 14.2R7-S7, 14.2R8; 15.1 versions prior to 15.1F5-S8, 15.1F6-S8, 15.1R5-S6, 15.1R6-S3, 15.1R7; 15.1X49 versions prior to 15.1X49-D100; 15.1X53 versions prior to 15.1X53-D65, 15.1X53-D231; 16.1 versions prior to 16.1R3-S6, 16.1R4-S6, 16.1R5; 16.1X65 versions prior to 16.1X65-D45; 16.2 versions prior to 16.2R2-S1, 16.2R3; 17.1 versions prior to 17.1R2-S2, 17.1R3; 17.2 versions prior to 17.2R1-S3, 17.2R2; 17.2X75 versions prior to 17.2X75-D50. No other Juniper Networks products or platforms are affected by this issue.

CVE-2018-0004

2018-01-10T17:29:01.057-05:00

2019-10-09T19:30:55.987-04:00

7.1

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1040183 CONFIRM https://kb.juniper.net/JSA10832 A sustained sequence of different types of normal transit traffic can trigger a high CPU consumption denial of service condition in the Junos OS register and schedule software interrupt handler subsystem when a specific command is issued to the device. This affects one or more threads and conversely one or more running processes running on the system. Once this occurs, the high CPU event(s) affects either or both the forwarding and control plane. As a result of this condition the device can become inaccessible in either or both the control and forwarding plane and stops forwarding traffic until the device is rebooted. The issue will reoccur after reboot upon receiving further transit traffic. Score: 5.7 MEDIUM (CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) For network designs utilizing layer 3 forwarding agents or other ARP through layer 3 technologies, the score is slightly higher. Score: 6.5 MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) If the following entry exists in the RE message logs then this may indicate the issue is present. This entry may or may not appear when this issue occurs. /kernel: Expensive timeout(9) function: Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D50; 12.3X48 versions prior to 12.3X48-D30; 12.3R versions prior to 12.3R12-S7; 14.1 versions prior to 14.1R8-S4, 14.1R9; 14.1X53 versions prior to 14.1X53-D30, 14.1X53-D34; 14.2 versions prior to 14.2R8; 15.1 versions prior to 15.1F6, 15.1R3; 15.1X49 versions prior to 15.1X49-D40; 15.1X53 versions prior to 15.1X53-D31, 15.1X53-D33, 15.1X53-D60. No other Juniper Networks products or platforms are affected by this issue.

cpe:/o:juniper:junos:14.1x53 cpe:/o:juniper:junos:14.1x53:d10 cpe:/o:juniper:junos:14.1x53:d15 cpe:/o:juniper:junos:14.1x53:d16 cpe:/o:juniper:junos:14.1x53:d25 cpe:/o:juniper:junos:14.1x53:d26 cpe:/o:juniper:junos:14.1x53:d27 cpe:/o:juniper:junos:14.1x53:d30 cpe:/o:juniper:junos:14.1x53:d35 cpe:/o:juniper:junos:15.1:r1 cpe:/o:juniper:junos:15.1:r2 cpe:/o:juniper:junos:15.1:r3 cpe:/o:juniper:junos:15.1:r4 cpe:/o:juniper:junos:15.1:r5 cpe:/o:juniper:junos:15.1:r6 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d50 cpe:/o:juniper:junos:15.1x53:d51 cpe:/o:juniper:junos:15.1x53:d52

CVE-2018-0005

2018-01-10T17:29:01.103-05:00

2019-10-09T19:30:56.410-04:00

5.8

ADJACENT_NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1040182 CONFIRM https://kb.juniper.net/JSA10833 QFX and EX Series switches configured to drop traffic when the MAC move limit is exceeded will forward traffic instead of dropping traffic. This can lead to denials of services or other unintended conditions. Affected releases are Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D40; 15.1X53 versions prior to 15.1X53-D55; 15.1 versions prior to 15.1R7.

CVE-2018-0006

2018-01-10T17:29:01.133-05:00

2019-10-09T19:30:56.783-04:00

2.9

ADJACENT_NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1040184 CONFIRM https://kb.juniper.net/JSA10834 A high rate of VLAN authentication attempts sent from an adjacent host on the local broadcast domain can trigger high memory utilization by the BBE subscriber management daemon (bbe-smgd), and lead to a denial of service condition. The issue was caused by attempting to process an unbounded number of pending VLAN authentication requests, leading to excessive memory allocation. This issue only affects devices configured for DHCPv4/v6 over AE auto-sensed VLANs, utilized in Broadband Edge (BBE) deployments. Other configurations are unaffected by this issue. Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1R6-S2, 15.1R7; 16.1 versions prior to 16.1R5-S1, 16.1R6; 16.2 versions prior to 16.2R2-S2, 16.2R3; 17.1 versions prior to 17.1R2-S5, 17.1R3; 17.2 versions prior to 17.2R2.

cpe:/o:juniper:junos:12.1x46 cpe:/o:juniper:junos:12.1x46:d10 cpe:/o:juniper:junos:12.1x46:d15 cpe:/o:juniper:junos:12.1x46:d20 cpe:/o:juniper:junos:12.1x46:d25 cpe:/o:juniper:junos:12.1x46:d30 cpe:/o:juniper:junos:12.1x46:d35 cpe:/o:juniper:junos:12.1x46:d40 cpe:/o:juniper:junos:12.1x46:d45 cpe:/o:juniper:junos:12.1x46:d50 cpe:/o:juniper:junos:12.1x46:d55 cpe:/o:juniper:junos:12.1x46:d60 cpe:/o:juniper:junos:12.1x46:d65 cpe:/o:juniper:junos:12.3 cpe:/o:juniper:junos:12.3:r1 cpe:/o:juniper:junos:12.3:r10 cpe:/o:juniper:junos:12.3:r11 cpe:/o:juniper:junos:12.3:r12 cpe:/o:juniper:junos:12.3:r2 cpe:/o:juniper:junos:12.3:r3 cpe:/o:juniper:junos:12.3:r4 cpe:/o:juniper:junos:12.3:r5 cpe:/o:juniper:junos:12.3:r6 cpe:/o:juniper:junos:12.3:r7 cpe:/o:juniper:junos:12.3:r8 cpe:/o:juniper:junos:12.3:r9 cpe:/o:juniper:junos:12.3x48:d10 cpe:/o:juniper:junos:12.3x48:d15 cpe:/o:juniper:junos:12.3x48:d20 cpe:/o:juniper:junos:12.3x48:d25 cpe:/o:juniper:junos:12.3x48:d30 cpe:/o:juniper:junos:12.3x48:d35 cpe:/o:juniper:junos:12.3x48:d40 cpe:/o:juniper:junos:12.3x48:d45 cpe:/o:juniper:junos:12.3x48:d50 cpe:/o:juniper:junos:14.1 cpe:/o:juniper:junos:14.1:r1 cpe:/o:juniper:junos:14.1:r2 cpe:/o:juniper:junos:14.1:r3 cpe:/o:juniper:junos:14.1:r4 cpe:/o:juniper:junos:14.1:r5 cpe:/o:juniper:junos:14.1:r6 cpe:/o:juniper:junos:14.1:r7 cpe:/o:juniper:junos:14.1:r8 cpe:/o:juniper:junos:14.1:r9 cpe:/o:juniper:junos:14.1x53 cpe:/o:juniper:junos:14.1x53:d10 cpe:/o:juniper:junos:14.1x53:d15 cpe:/o:juniper:junos:14.1x53:d16 cpe:/o:juniper:junos:14.1x53:d25 cpe:/o:juniper:junos:14.1x53:d26 cpe:/o:juniper:junos:14.1x53:d27 cpe:/o:juniper:junos:14.1x53:d30 cpe:/o:juniper:junos:14.1x53:d35 cpe:/o:juniper:junos:14.1x53:d40 cpe:/o:juniper:junos:14.1x53:d45 cpe:/o:juniper:junos:14.2:r1 cpe:/o:juniper:junos:14.2:r2 cpe:/o:juniper:junos:14.2:r3 cpe:/o:juniper:junos:14.2:r4 cpe:/o:juniper:junos:14.2:r5 cpe:/o:juniper:junos:14.2:r6 cpe:/o:juniper:junos:14.2:r7 cpe:/o:juniper:junos:15.1:f2 cpe:/o:juniper:junos:15.1:f5 cpe:/o:juniper:junos:15.1:f6 cpe:/o:juniper:junos:15.1:f7 cpe:/o:juniper:junos:15.1:r7 cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d55 cpe:/o:juniper:junos:15.1x49:d60 cpe:/o:juniper:junos:15.1x49:d65 cpe:/o:juniper:junos:15.1x49:d70 cpe:/o:juniper:junos:15.1x49:d75 cpe:/o:juniper:junos:15.1x49:d80 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d210 cpe:/o:juniper:junos:15.1x53:d25 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d60 cpe:/o:juniper:junos:15.1x53:d61 cpe:/o:juniper:junos:15.1x53:d62 cpe:/o:juniper:junos:15.1x53:d63 cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.1:r4 cpe:/o:juniper:junos:16.1x65:d30 cpe:/o:juniper:junos:16.1x65:d35 cpe:/o:juniper:junos:16.1x65:d40 cpe:/o:juniper:junos:16.2:r1 cpe:/o:juniper:junos:17.1:r1

CVE-2018-0007

2018-01-10T17:29:01.180-05:00

2018-02-02T14:25:46.457-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-01-29T13:41:34.537-05:00

SECTRACK 1040181 CONFIRM https://kb.juniper.net/JSA10830 An unauthenticated network-based attacker able to send a maliciously crafted LLDP packet to the local segment, through a local segment broadcast, may be able to cause a Junos device to enter an improper boundary check condition allowing a memory corruption to occur, leading to a denial of service. Further crafted packets may be able to sustain the denial of service condition. Score: 6.5 MEDIUM (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Further, if the attacker is authenticated on the target device receiving and processing the malicious LLDP packet, while receiving the crafted packets, the attacker may be able to perform command or arbitrary code injection over the target device thereby elevating their permissions and privileges, and taking control of the device. Score: 7.8 HIGH (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) An unauthenticated network-based attacker able to send a maliciously crafted LLDP packet to one or more local segments, via LLDP proxy / tunneling agents or other LLDP through Layer 3 deployments, through one or more local segment broadcasts, may be able to cause multiple Junos devices to enter an improper boundary check condition allowing a memory corruption to occur, leading to multiple distributed Denials of Services. These Denials of Services attacks may have cascading Denials of Services to adjacent connected devices, impacts network devices, servers, workstations, etc. Further crafted packets may be able to sustain these Denials of Services conditions. Score 6.8 MEDIUM (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H) Further, if the attacker is authenticated on one or more target devices receiving and processing these malicious LLDP packets, while receiving the crafted packets, the attacker may be able to perform command or arbitrary code injection over multiple target devices thereby elevating their permissions and privileges, and taking control multiple devices. Score: 7.8 HIGH (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D71; 12.3 versions prior to 12.3R12-S7; 12.3X48 versions prior to 12.3X48-D55; 14.1 versions prior to 14.1R8-S5, 14.1R9; 14.1X53 versions prior to 14.1X53-D46, 14.1X53-D50, 14.1X53-D107; 14.2 versions prior to 14.2R7-S9, 14.2R8; 15.1 versions prior to 15.1F2-S17, 15.1F5-S8, 15.1F6-S8, 15.1R5-S7, 15.1R7; 15.1X49 versions prior to 15.1X49-D90; 15.1X53 versions prior to 15.1X53-D65; 16.1 versions prior to 16.1R4-S6, 16.1R5; 16.1X65 versions prior to 16.1X65-D45; 16.2 versions prior to 16.2R2; 17.1 versions prior to 17.1R2. No other Juniper Networks products or platforms are affected by this issue.

cpe:/o:juniper:junos:12.1x46 cpe:/o:juniper:junos:12.1x46:d10 cpe:/o:juniper:junos:12.1x46:d15 cpe:/o:juniper:junos:12.1x46:d20 cpe:/o:juniper:junos:12.1x46:d25 cpe:/o:juniper:junos:12.1x46:d30 cpe:/o:juniper:junos:12.1x46:d35 cpe:/o:juniper:junos:12.1x46:d40 cpe:/o:juniper:junos:12.1x46:d45 cpe:/o:juniper:junos:12.1x46:d50 cpe:/o:juniper:junos:12.1x46:d55 cpe:/o:juniper:junos:12.1x46:d60 cpe:/o:juniper:junos:12.1x46:d65 cpe:/o:juniper:junos:12.3x48 cpe:/o:juniper:junos:12.3x48:d10 cpe:/o:juniper:junos:12.3x48:d15 cpe:/o:juniper:junos:12.3x48:d20 cpe:/o:juniper:junos:12.3x48:d25 cpe:/o:juniper:junos:12.3x48:d30 cpe:/o:juniper:junos:12.3x48:d35 cpe:/o:juniper:junos:12.3x48:d40 cpe:/o:juniper:junos:12.3x48:d45 cpe:/o:juniper:junos:12.3x48:d50 cpe:/o:juniper:junos:14.1 cpe:/o:juniper:junos:14.1:r1 cpe:/o:juniper:junos:14.1:r2 cpe:/o:juniper:junos:14.1:r3 cpe:/o:juniper:junos:14.1:r4 cpe:/o:juniper:junos:14.1:r5 cpe:/o:juniper:junos:14.1:r6 cpe:/o:juniper:junos:14.1:r7 cpe:/o:juniper:junos:14.1x53 cpe:/o:juniper:junos:14.1x53:d10 cpe:/o:juniper:junos:14.1x53:d15 cpe:/o:juniper:junos:14.1x53:d16 cpe:/o:juniper:junos:14.1x53:d25 cpe:/o:juniper:junos:14.1x53:d26 cpe:/o:juniper:junos:14.1x53:d27 cpe:/o:juniper:junos:14.1x53:d30 cpe:/o:juniper:junos:14.1x53:d35 cpe:/o:juniper:junos:14.2 cpe:/o:juniper:junos:14.2:r1 cpe:/o:juniper:junos:14.2:r2 cpe:/o:juniper:junos:14.2:r3 cpe:/o:juniper:junos:14.2:r4 cpe:/o:juniper:junos:14.2:r5 cpe:/o:juniper:junos:14.2:r6 cpe:/o:juniper:junos:14.2:r7 cpe:/o:juniper:junos:14.2:r8 cpe:/o:juniper:junos:15.1 cpe:/o:juniper:junos:15.1:a1 cpe:/o:juniper:junos:15.1:f1 cpe:/o:juniper:junos:15.1:f2 cpe:/o:juniper:junos:15.1:f2-s1 cpe:/o:juniper:junos:15.1:f2-s2 cpe:/o:juniper:junos:15.1:f2-s3 cpe:/o:juniper:junos:15.1:f2-s4 cpe:/o:juniper:junos:15.1:f3 cpe:/o:juniper:junos:15.1:f4 cpe:/o:juniper:junos:15.1:f5 cpe:/o:juniper:junos:15.1:f6-s8 cpe:/o:juniper:junos:15.1:r5-s6 cpe:/o:juniper:junos:15.1:r6 cpe:/o:juniper:junos:15.1x49 cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d100 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d55 cpe:/o:juniper:junos:15.1x49:d60 cpe:/o:juniper:junos:15.1x49:d65 cpe:/o:juniper:junos:15.1x49:d70 cpe:/o:juniper:junos:15.1x49:d75 cpe:/o:juniper:junos:15.1x49:d80 cpe:/o:juniper:junos:15.1x49:d90 cpe:/o:juniper:junos:15.1x53 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d210 cpe:/o:juniper:junos:15.1x53:d230 cpe:/o:juniper:junos:15.1x53:d25 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d470 cpe:/o:juniper:junos:15.1x53:d50 cpe:/o:juniper:junos:15.1x53:d51 cpe:/o:juniper:junos:15.1x53:d52 cpe:/o:juniper:junos:15.1x53:d55 cpe:/o:juniper:junos:15.1x53:d57 cpe:/o:juniper:junos:15.1x53:d60 cpe:/o:juniper:junos:15.1x53:d61 cpe:/o:juniper:junos:15.1x53:d62 cpe:/o:juniper:junos:15.1x53:d63 cpe:/o:juniper:junos:15.1x53:d64 cpe:/o:juniper:junos:15.1x53:d70 cpe:/o:juniper:junos:16.1:r1

CVE-2018-0008

2018-01-10T17:29:01.213-05:00

2019-10-09T19:30:56.957-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1040186 CONFIRM https://kb.juniper.net/JSA10835 An unauthenticated root login may allow upon reboot when a commit script is used. A commit script allows a device administrator to execute certain instructions during commit, which is configured under the [system scripts commit] stanza. Certain commit scripts that work without a problem during normal commit may cause unexpected behavior upon reboot which can leave the system in a state where root CLI login is allowed without a password due to the system reverting to a "safe mode" authentication state. Lastly, only logging in physically to the console port as root, with no password, will work. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D71 on SRX; 12.3X48 versions prior to 12.3X48-D55 on SRX; 14.1 versions prior to 14.1R9; 14.1X53 versions prior to 14.1X53-D40 on QFX, EX; 14.2 versions prior to 14.2R7-S9, 14.2R8; 15.1 versions prior to 15.1F5-S7, 15.1F6-S8, 15.1R5-S6, 15.1R6; 15.1X49 versions prior to 15.1X49-D110 on SRX; 15.1X53 versions prior to 15.1X53-D232 on QFX5200/5110; 15.1X53 versions prior to 15.1X53-D49, 15.1X53-D470 on NFX; 15.1X53 versions prior to 15.1X53-D65 on QFX10K; 16.1 versions prior to 16.1R2. No other Juniper Networks products or platforms are affected by this issue.

CVE-2018-0009

2018-01-10T17:29:01.260-05:00

2019-10-09T19:30:57.393-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 102491 SECTRACK 1040187 CONFIRM https://kb.juniper.net/JSA10836 On Juniper Networks SRX series devices, firewall rules configured to match custom application UUIDs starting with zeros can match all TCP traffic. Due to this issue, traffic that should have been blocked by other rules is permitted to flow through the device resulting in a firewall bypass condition. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D71 on SRX series; 12.3X48 versions prior to 12.3X48-D55 on SRX series; 15.1X49 versions prior to 15.1X49-D100 on SRX series.

cpe:/o:juniper:junos_space:13.3:r1 cpe:/o:juniper:junos_space:13.3:r2 cpe:/o:juniper:junos_space:14.1:r1 cpe:/o:juniper:junos_space:14.1:r2 cpe:/o:juniper:junos_space:14.1:r3 cpe:/o:juniper:junos_space:15.1:r1 cpe:/o:juniper:junos_space:15.1:r2 cpe:/o:juniper:junos_space:15.1:r3 cpe:/o:juniper:junos_space:15.1:r4 cpe:/o:juniper:junos_space:15.2:r1 cpe:/o:juniper:junos_space:15.2:r2 cpe:/o:juniper:junos_space:16.1:r1 cpe:/o:juniper:junos_space:16.1:r2 cpe:/o:juniper:junos_space:16.1:r3 cpe:/o:juniper:junos_space:17.1:r1 cpe:/o:juniper:junos_space:17.2:r1

CVE-2018-0010

2018-01-10T17:29:01.290-05:00

2019-10-02T20:03:26.223-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-01-29T12:39:01.893-05:00

CONFIRM https://kb.juniper.net/JSA10840 A vulnerability in the Juniper Networks Junos Space Security Director allows a user who does not have SSH access to a device to reuse the URL that was created for another user to perform SSH access. Affected releases are all versions of Junos Space Security Director prior to 17.2R1.

cpe:/a:juniper:junos_space:13.3:r1 cpe:/a:juniper:junos_space:13.3:r2 cpe:/a:juniper:junos_space:13.3:r4 cpe:/a:juniper:junos_space:14.1:r1 cpe:/a:juniper:junos_space:14.1:r2 cpe:/a:juniper:junos_space:14.1:r3 cpe:/a:juniper:junos_space:15.1:r1 cpe:/a:juniper:junos_space:15.1:r2 cpe:/a:juniper:junos_space:15.1:r3 cpe:/a:juniper:junos_space:15.2:r1 cpe:/a:juniper:junos_space:15.2:r2 cpe:/a:juniper:junos_space:16.1:r1 cpe:/a:juniper:junos_space:16.1:r2 cpe:/a:juniper:junos_space:16.1:r3 cpe:/a:juniper:junos_space:17.1:r1

CVE-2018-0011

2018-01-10T17:29:01.320-05:00

2019-10-09T19:30:57.673-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1040189 CONFIRM https://kb.juniper.net/JSA10838 A reflected cross site scripting (XSS) vulnerability in Junos Space may potentially allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a session, and to perform administrative actions on the Junos Space network management device.

cpe:/o:juniper:junos_space:17.2

CVE-2018-0012

2018-01-10T17:29:01.367-05:00

2019-10-09T19:30:57.830-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1040189 CONFIRM https://kb.juniper.net/JSA10838 Junos Space is affected by a privilege escalation vulnerability that may allow a local authenticated attacker to gain root privileges.

cpe:/o:juniper:junos_space:-

CVE-2018-0013

2018-01-10T17:29:01.417-05:00

2019-10-09T19:30:57.957-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1040189 CONFIRM https://kb.juniper.net/JSA10838 A local file inclusion vulnerability in Juniper Networks Junos Space Network Management Platform may allow an authenticated user to retrieve files from the system.

cpe:/o:juniper:screenos:6.3.0r1 cpe:/o:juniper:screenos:6.3.0r2 cpe:/o:juniper:screenos:6.3.0r3 cpe:/o:juniper:screenos:6.3.0r4 cpe:/o:juniper:screenos:6.3.0r5 cpe:/o:juniper:screenos:6.3.0r6 cpe:/o:juniper:screenos:6.3.0r7 cpe:/o:juniper:screenos:6.3.0r8 cpe:/o:juniper:screenos:6.3.0r9 cpe:/o:juniper:screenos:6.3.0r10 cpe:/o:juniper:screenos:6.3.0r11 cpe:/o:juniper:screenos:6.3.0r12 cpe:/o:juniper:screenos:6.3.0r13 cpe:/o:juniper:screenos:6.3.0r14 cpe:/o:juniper:screenos:6.3.0r15 cpe:/o:juniper:screenos:6.3.0r16 cpe:/o:juniper:screenos:6.3.0r17 cpe:/o:juniper:screenos:6.3.0r18 cpe:/o:juniper:screenos:6.3.0r19 cpe:/o:juniper:screenos:6.3.0r20 cpe:/o:juniper:screenos:6.3.0r21 cpe:/o:juniper:screenos:6.3.0r22 cpe:/o:juniper:screenos:6.3.0r23 cpe:/o:juniper:screenos:6.3.0r24 cpe:/o:juniper:screenos:6.3.0r25

CVE-2018-0014

2018-01-10T17:29:01.463-05:00

2019-10-09T19:30:58.067-04:00

3.3

ADJACENT_NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1040185 CONFIRM https://kb.juniper.net/JSA10841 Juniper Networks ScreenOS devices do not pad Ethernet packets with zeros, and thus some packets can contain fragments of system memory or data from previous packets. This issue is often detected as CVE-2003-0001. The issue affects all versions of Juniper Networks ScreenOS prior to 6.3.0r25.

cpe:/a:juniper:appformix:2.7.3 cpe:/a:juniper:appformix:2.11 cpe:/a:juniper:appformix:2.11.2 cpe:/a:juniper:appformix:2.15 cpe:/a:juniper:appformix:2.15.1

CVE-2018-0015

2018-02-22T17:29:00.207-05:00

2019-10-02T20:03:26.223-04:00

8.5

NETWORK

MEDIUM

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov CONFIRM https://kb.juniper.net/JSA10843 A malicious user with unrestricted access to the AppFormix application management platform may be able to access a Python debug console and execute system commands with root privilege. The AppFormix Agent exposes the debug console on a host where AppFormix Agent is executing. If the host is executing AppFormix Agent, an attacker may access the debug console and execute Python commands with root privilege. Affected AppFormix releases are: All versions up to and including 2.7.3; 2.11 versions prior to 2.11.3; 2.15 versions prior to 2.15.2. Juniper SIRT is not aware of any malicious exploitation of this vulnerability, however, the issue has been seen in a production network. No other Juniper Networks products or platforms are affected by this issue.

cpe:/o:juniper:junos:15.1 cpe:/o:juniper:junos:15.1:r1 cpe:/o:juniper:junos:15.1:r2 cpe:/o:juniper:junos:15.1:r3 cpe:/o:juniper:junos:15.1:r4 cpe:/o:juniper:junos:15.1f cpe:/o:juniper:junos:15.1f2 cpe:/o:juniper:junos:15.1f3 cpe:/o:juniper:junos:15.1f4 cpe:/o:juniper:junos:15.1f5 cpe:/o:juniper:junos:15.1f5:s1 cpe:/o:juniper:junos:15.1f6:s1 cpe:/o:juniper:junos:15.1f6:s2 cpe:/o:juniper:junos:15.1x49 cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d55 cpe:/o:juniper:junos:15.1x53 cpe:/o:juniper:junos:15.1x53:d10 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d50 cpe:/o:juniper:junos:15.1x53:d51 cpe:/o:juniper:junos:15.1x53:d52 cpe:/o:juniper:junos:15.1x53:d55 cpe:/o:juniper:junos:15.1x53:d57 cpe:/o:juniper:junos:15.1x53:d58 cpe:/o:juniper:junos:15.1x53:d60 cpe:/o:juniper:junos:15.1x53:d61 cpe:/o:juniper:junos:15.1x53:d62 cpe:/o:juniper:junos:15.1x53:d63 cpe:/o:juniper:junos:15.1x53:d64 cpe:/o:juniper:junos:15.1x53:d65

CVE-2018-0016

2018-04-11T15:29:00.277-04:00

2019-10-09T19:30:58.330-04:00

8.5

NETWORK

MEDIUM

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov BID 103747 SECTRACK 1040784 CONFIRM https://kb.juniper.net/JSA10844 Receipt of a specially crafted Connectionless Network Protocol (CLNP) datagram destined to an interface of a Junos OS device may result in a kernel crash or lead to remote code execution. Devices are only vulnerable to the specially crafted CLNP datagram if 'clns-routing' or ES-IS is explicitly configured. Devices with without CLNS enabled are not vulnerable to this issue. Devices with IS-IS configured on the interface are not vulnerable to this issue unless CLNS routing is also enabled. This issue only affects devices running Junos OS 15.1. Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1F5-S3, 15.1F6-S8, 15.1F7, 15.1R5; 15.1X49 versions prior to 15.1X49-D60; 15.1X53 versions prior to 15.1X53-D66, 15.1X53-D233, 15.1X53-D471. Earlier releases are unaffected by this vulnerability, and the issue has been resolved in Junos OS 16.1R1 and all subsequent releases.

cpe:/o:juniper:junos:12.1x46 cpe:/o:juniper:junos:12.1x46:- cpe:/o:juniper:junos:12.1x46:d10 cpe:/o:juniper:junos:12.1x46:d15 cpe:/o:juniper:junos:12.1x46:d20 cpe:/o:juniper:junos:12.1x46:d25 cpe:/o:juniper:junos:12.1x46:d30 cpe:/o:juniper:junos:12.1x46:d35 cpe:/o:juniper:junos:12.1x46:d40 cpe:/o:juniper:junos:12.1x46:d45 cpe:/o:juniper:junos:12.1x46:d50 cpe:/o:juniper:junos:12.1x46:d55 cpe:/o:juniper:junos:12.1x46:d73 cpe:/o:juniper:junos:12.3x48:d10 cpe:/o:juniper:junos:12.3x48:d15 cpe:/o:juniper:junos:12.3x48:d25 cpe:/o:juniper:junos:12.3x48:d80 cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d150 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d55 cpe:/o:juniper:junos:15.1x49:d60 cpe:/o:juniper:junos:15.1x49:d65 cpe:/o:juniper:junos:15.1x49:d70 cpe:/o:juniper:junos:15.1x49:d75 cpe:/o:juniper:junos:15.1x49:d80

CVE-2018-0017

2018-04-11T15:29:00.337-04:00

2019-10-09T19:30:58.517-04:00

6.8

NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov BID 103749 SECTRACK 1040785 CONFIRM https://kb.juniper.net/JSA10845 A vulnerability in the Network Address Translation - Protocol Translation (NAT-PT) feature of Junos OS on SRX series devices may allow a certain valid IPv6 packet to crash the flowd daemon. Repeated crashes of the flowd daemon can result in an extended denial of service condition for the SRX device. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D72; 12.3X48 versions prior to 12.3X48-D55; 15.1X49 versions prior to 15.1X49-D90.

CVE-2018-0018

2018-04-11T15:29:00.387-04:00

2019-10-09T19:30:58.643-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103748 SECTRACK 1040786 CONFIRM https://kb.juniper.net/JSA10846 On SRX Series devices during compilation of IDP policies, an attacker sending specially crafted packets may be able to bypass firewall rules, leading to information disclosure which an attacker may use to gain control of the target device or other internal devices, systems or services protected by the SRX Series device. This issue only applies to devices where IDP policies are applied to one or more rules. Customers not using IDP policies are not affected. Depending on if the IDP updates are automatic or not, as well as the interval between available updates, an attacker may have more or less success in performing reconnaissance or bypass attacks on the victim SRX Series device or protected devices. ScreenOS with IDP is not vulnerable to this issue. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D60 on SRX; 12.3X48 versions prior to 12.3X48-D35 on SRX; 15.1X49 versions prior to 15.1X49-D60 on SRX.

cpe:/o:juniper:junos:12.1x46 cpe:/o:juniper:junos:12.1x46:d10 cpe:/o:juniper:junos:12.1x46:d15 cpe:/o:juniper:junos:12.1x46:d20 cpe:/o:juniper:junos:12.1x46:d25 cpe:/o:juniper:junos:12.1x46:d30 cpe:/o:juniper:junos:12.1x46:d35 cpe:/o:juniper:junos:12.1x46:d40 cpe:/o:juniper:junos:12.1x46:d45 cpe:/o:juniper:junos:12.1x46:d50 cpe:/o:juniper:junos:12.1x46:d55 cpe:/o:juniper:junos:12.1x46:d60 cpe:/o:juniper:junos:12.1x46:d65 cpe:/o:juniper:junos:12.3:r1 cpe:/o:juniper:junos:12.3:r10 cpe:/o:juniper:junos:12.3:r11 cpe:/o:juniper:junos:12.3:r12 cpe:/o:juniper:junos:12.3:r2 cpe:/o:juniper:junos:12.3:r3 cpe:/o:juniper:junos:12.3:r4 cpe:/o:juniper:junos:12.3:r5 cpe:/o:juniper:junos:12.3:r6 cpe:/o:juniper:junos:12.3:r7 cpe:/o:juniper:junos:12.3:r8 cpe:/o:juniper:junos:12.3:r9 cpe:/o:juniper:junos:12.3x48 cpe:/o:juniper:junos:12.3x48:d10 cpe:/o:juniper:junos:12.3x48:d15 cpe:/o:juniper:junos:12.3x48:d20 cpe:/o:juniper:junos:12.3x48:d25 cpe:/o:juniper:junos:12.3x48:d30 cpe:/o:juniper:junos:12.3x48:d35 cpe:/o:juniper:junos:12.3x48:d40 cpe:/o:juniper:junos:12.3x48:d45 cpe:/o:juniper:junos:12.3x48:d50 cpe:/o:juniper:junos:12.3x48:d55 cpe:/o:juniper:junos:12.3x48:d60 cpe:/o:juniper:junos:14.1 cpe:/o:juniper:junos:14.1:r1 cpe:/o:juniper:junos:14.1:r2 cpe:/o:juniper:junos:14.1:r3 cpe:/o:juniper:junos:14.1:r4 cpe:/o:juniper:junos:14.1:r5 cpe:/o:juniper:junos:14.1:r6 cpe:/o:juniper:junos:14.1:r7 cpe:/o:juniper:junos:14.1:r8 cpe:/o:juniper:junos:14.1x53 cpe:/o:juniper:junos:14.1x53:d121 cpe:/o:juniper:junos:14.1x53:d15 cpe:/o:juniper:junos:14.1x53:d16 cpe:/o:juniper:junos:14.1x53:d25 cpe:/o:juniper:junos:14.1x53:d26 cpe:/o:juniper:junos:14.1x53:d27 cpe:/o:juniper:junos:14.1x53:d30 cpe:/o:juniper:junos:14.1x53:d35 cpe:/o:juniper:junos:14.1x53:d40 cpe:/o:juniper:junos:14.1x53:d42 cpe:/o:juniper:junos:14.1x53:d43 cpe:/o:juniper:junos:14.1x53:d44 cpe:/o:juniper:junos:14.1x53:d45 cpe:/o:juniper:junos:14.1x53:d46 cpe:/o:juniper:junos:14.2 cpe:/o:juniper:junos:14.2:r1 cpe:/o:juniper:junos:14.2:r2 cpe:/o:juniper:junos:14.2:r3 cpe:/o:juniper:junos:14.2:r4 cpe:/o:juniper:junos:14.2:r5 cpe:/o:juniper:junos:14.2:r6 cpe:/o:juniper:junos:14.2:r7 cpe:/o:juniper:junos:15.1 cpe:/o:juniper:junos:15.1:f1 cpe:/o:juniper:junos:15.1:f2 cpe:/o:juniper:junos:15.1:f3 cpe:/o:juniper:junos:15.1:f4 cpe:/o:juniper:junos:15.1:f6 cpe:/o:juniper:junos:15.1:r1 cpe:/o:juniper:junos:15.1:r2 cpe:/o:juniper:junos:15.1:r3 cpe:/o:juniper:junos:15.1:r4 cpe:/o:juniper:junos:15.1:r6 cpe:/o:juniper:junos:15.1x49 cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d100 cpe:/o:juniper:junos:15.1x49:d110 cpe:/o:juniper:junos:15.1x49:d120 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d55 cpe:/o:juniper:junos:15.1x49:d60 cpe:/o:juniper:junos:15.1x49:d65 cpe:/o:juniper:junos:15.1x49:d70 cpe:/o:juniper:junos:15.1x49:d75 cpe:/o:juniper:junos:15.1x49:d80 cpe:/o:juniper:junos:15.1x49:d90 cpe:/o:juniper:junos:15.1x53 cpe:/o:juniper:junos:15.1x53:d10 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d210 cpe:/o:juniper:junos:15.1x53:d230 cpe:/o:juniper:junos:15.1x53:d231 cpe:/o:juniper:junos:15.1x53:d232 cpe:/o:juniper:junos:15.1x53:d233 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d470 cpe:/o:juniper:junos:15.1x53:d50 cpe:/o:juniper:junos:15.1x53:d51 cpe:/o:juniper:junos:15.1x53:d52 cpe:/o:juniper:junos:15.1x53:d55 cpe:/o:juniper:junos:15.1x53:d57 cpe:/o:juniper:junos:15.1x53:d58 cpe:/o:juniper:junos:15.1x53:d60 cpe:/o:juniper:junos:15.1x53:d61 cpe:/o:juniper:junos:15.1x53:d62 cpe:/o:juniper:junos:15.1x53:d63 cpe:/o:juniper:junos:15.1x53:d64 cpe:/o:juniper:junos:15.1x53:d65 cpe:/o:juniper:junos:15.1x53:d66 cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.1:r4 cpe:/o:juniper:junos:16.1:r5 cpe:/o:juniper:junos:16.1x65:d30 cpe:/o:juniper:junos:16.1x65:d35 cpe:/o:juniper:junos:16.1x65:d40 cpe:/o:juniper:junos:16.1x70 cpe:/o:juniper:junos:16.2:r1 cpe:/o:juniper:junos:16.2:r2 cpe:/o:juniper:junos:16.2:r3 cpe:/o:juniper:junos:17.1:r1 cpe:/o:juniper:junos:17.1:r2 cpe:/o:juniper:junos:17.1:r3 cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.2:r2

CVE-2018-0019

2018-04-11T15:29:00.447-04:00

2019-10-09T19:30:58.877-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1040787 CONFIRM https://kb.juniper.net/JSA10847 A vulnerability in Junos OS SNMP MIB-II subagent daemon (mib2d) may allow a remote network based attacker to cause the mib2d process to crash resulting in a denial of service condition (DoS) for the SNMP subsystem. While a mib2d process crash can disrupt the network monitoring via SNMP, it does not impact routing, switching or firewall functionalities. SNMP is disabled by default on devices running Junos OS. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D76; 12.3 versions prior to 12.3R12-S7, 12.3R13; 12.3X48 versions prior to 12.3X48-D65; 14.1 versions prior to 14.1R9; 14.1X53 versions prior to 14.1X53-D130; 15.1 versions prior to 15.1F2-S20, 15.1F6-S10, 15.1R7; 15.1X49 versions prior to 15.1X49-D130; 15.1X53 versions prior to 15.1X53-D233, 15.1X53-D471, 15.1X53-D472, 15.1X53-D58, 15.1X53-D66; 16.1 versions prior to 16.1R5-S3, 16.1R7; 16.1X65 versions prior to 16.1X65-D47; 16.1X70 versions prior to 16.1X70-D10; 16.2 versions prior to 16.2R1-S6, 16.2R2-S5, 16.2R3; 17.1 versions prior to 17.1R2-S6, 17.1R3;

cpe:/o:juniper:junos:14.1x53 cpe:/o:juniper:junos:14.1x53:d15 cpe:/o:juniper:junos:14.1x53:d16 cpe:/o:juniper:junos:14.1x53:d25 cpe:/o:juniper:junos:14.1x53:d26 cpe:/o:juniper:junos:14.1x53:d27 cpe:/o:juniper:junos:14.1x53:d30 cpe:/o:juniper:junos:14.1x53:d35 cpe:/o:juniper:junos:14.1x53:d40 cpe:/o:juniper:junos:14.1x53:d42 cpe:/o:juniper:junos:14.1x53:d43 cpe:/o:juniper:junos:14.1x53:d44 cpe:/o:juniper:junos:14.1x53:d45 cpe:/o:juniper:junos:14.1x53:d46 cpe:/o:juniper:junos:15.1 cpe:/o:juniper:junos:15.1:f1 cpe:/o:juniper:junos:15.1:f2 cpe:/o:juniper:junos:15.1:f3 cpe:/o:juniper:junos:15.1:f4 cpe:/o:juniper:junos:15.1:f6 cpe:/o:juniper:junos:15.1:r1 cpe:/o:juniper:junos:15.1:r2 cpe:/o:juniper:junos:15.1:r3 cpe:/o:juniper:junos:15.1:r4 cpe:/o:juniper:junos:15.1:r6 cpe:/o:juniper:junos:15.1x49 cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d100 cpe:/o:juniper:junos:15.1x49:d110 cpe:/o:juniper:junos:15.1x49:d120 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d55 cpe:/o:juniper:junos:15.1x49:d60 cpe:/o:juniper:junos:15.1x49:d65 cpe:/o:juniper:junos:15.1x49:d70 cpe:/o:juniper:junos:15.1x49:d75 cpe:/o:juniper:junos:15.1x49:d80 cpe:/o:juniper:junos:15.1x49:d90 cpe:/o:juniper:junos:15.1x53 cpe:/o:juniper:junos:15.1x53:d10 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d210 cpe:/o:juniper:junos:15.1x53:d230 cpe:/o:juniper:junos:15.1x53:d231 cpe:/o:juniper:junos:15.1x53:d232 cpe:/o:juniper:junos:15.1x53:d233 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d470 cpe:/o:juniper:junos:15.1x53:d50 cpe:/o:juniper:junos:15.1x53:d51 cpe:/o:juniper:junos:15.1x53:d52 cpe:/o:juniper:junos:15.1x53:d55 cpe:/o:juniper:junos:15.1x53:d57 cpe:/o:juniper:junos:15.1x53:d58 cpe:/o:juniper:junos:15.1x53:d60 cpe:/o:juniper:junos:15.1x53:d61 cpe:/o:juniper:junos:15.1x53:d62 cpe:/o:juniper:junos:15.1x53:d63 cpe:/o:juniper:junos:15.1x53:d64 cpe:/o:juniper:junos:15.1x53:d65 cpe:/o:juniper:junos:15.1x53:d66 cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.1:r4 cpe:/o:juniper:junos:16.1:r5 cpe:/o:juniper:junos:16.1:r6 cpe:/o:juniper:junos:16.1x65:d30 cpe:/o:juniper:junos:16.1x65:d35 cpe:/o:juniper:junos:16.1x65:d40 cpe:/o:juniper:junos:16.2:r1 cpe:/o:juniper:junos:16.2:r2 cpe:/o:juniper:junos:16.2:r3 cpe:/o:juniper:junos:17.1:r1 cpe:/o:juniper:junos:17.1:r2 cpe:/o:juniper:junos:17.1:r3 cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.2:r2 cpe:/o:juniper:junos:17.2:r3 cpe:/o:juniper:junos:17.2x75

CVE-2018-0020

2018-04-11T15:29:00.510-04:00

2019-10-09T19:30:59.347-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1040788 CONFIRM https://kb.juniper.net/JSA10848 Junos OS may be impacted by the receipt of a malformed BGP UPDATE which can lead to a routing process daemon (rpd) crash and restart. Receipt of a repeated malformed BGP UPDATEs can result in an extended denial of service condition for the device. This malformed BGP UPDATE does not propagate to other BGP peers. Affected releases are Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D47; 15.1 versions prior to 15.1F6-S10, 15.1R4-S9, 15.1R6-S6, 15.1R7; 15.1X49 versions prior to 15.1X49-D130 on SRX; 15.1X53 versions prior to 15.1X53-D66 on QFX10K; 15.1X53 versions prior to 15.1X53-D58 on EX2300/EX3400; 15.1X53 versions prior to 15.1X53-D233 on QFX5200/QFX5110; 15.1X53 versions prior to 15.1X53-D471 on NFX; 16.1 versions prior to 16.1R3-S8, 16.1R4-S9, 16.1R5-S3, 16.1R6-S3, 16.1R7; 16.1X65 versions prior to 16.1X65-D47; 16.2 versions prior to 16.2R1-S6, 16.2R2-S5, 16.2R3; 17.1 versions prior to 17.1R2-S3, 17.1R3; 17.2 versions prior to 17.2R1-S3, 17.2R2-S1, 17.2R3; 17.2X75 versions prior to 17.2X75-D70; 13.2 versions above and including 13.2R1. Versions prior to 13.2R1 are not affected. Juniper SIRT is not aware of any malicious exploitation of this vulnerability. No other Juniper Networks products or platforms are affected by this issue.

cpe:/o:juniper:junos:14.1 cpe:/o:juniper:junos:14.1:r1 cpe:/o:juniper:junos:14.1:r2 cpe:/o:juniper:junos:14.1:r3 cpe:/o:juniper:junos:14.1:r4 cpe:/o:juniper:junos:14.1:r5 cpe:/o:juniper:junos:14.1:r6 cpe:/o:juniper:junos:14.1:r7 cpe:/o:juniper:junos:14.1:r9 cpe:/o:juniper:junos:14.1x53 cpe:/o:juniper:junos:14.1x53:d10 cpe:/o:juniper:junos:14.1x53:d15 cpe:/o:juniper:junos:14.1x53:d16 cpe:/o:juniper:junos:14.1x53:d25 cpe:/o:juniper:junos:14.1x53:d26 cpe:/o:juniper:junos:14.1x53:d27 cpe:/o:juniper:junos:14.1x53:d30 cpe:/o:juniper:junos:14.1x53:d35 cpe:/o:juniper:junos:14.1x53:d40 cpe:/o:juniper:junos:14.1x53:d45 cpe:/o:juniper:junos:15.1 cpe:/o:juniper:junos:15.1:r1 cpe:/o:juniper:junos:15.1:r2 cpe:/o:juniper:junos:15.1:r3 cpe:/o:juniper:junos:15.1:r4 cpe:/o:juniper:junos:15.1:r6 cpe:/o:juniper:junos:15.1x49 cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d55 cpe:/o:juniper:junos:15.1x49:d60 cpe:/o:juniper:junos:15.1x49:d65 cpe:/o:juniper:junos:15.1x49:d70 cpe:/o:juniper:junos:15.1x49:d75 cpe:/o:juniper:junos:15.1x49:d80 cpe:/o:juniper:junos:15.1x49:d90 cpe:/o:juniper:junos:15.1x53 cpe:/o:juniper:junos:15.1x53:d10 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d50 cpe:/o:juniper:junos:15.1x53:d51 cpe:/o:juniper:junos:15.1x53:d52 cpe:/o:juniper:junos:15.1x53:d55 cpe:/o:juniper:junos:15.1x53:d57 cpe:/o:juniper:junos:15.1x53:d58 cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.1:r4 cpe:/o:juniper:junos:16.2:r1 cpe:/o:juniper:junos:17.1:r1

CVE-2018-0021

2018-04-11T15:29:00.587-04:00

2019-10-09T19:30:59.720-04:00

3.3

ADJACENT_NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1040789 CONFIRM https://kb.juniper.net/JSA10854 If all 64 digits of the connectivity association name (CKN) key or all 32 digits of the connectivity association key (CAK) key are not configured, all remaining digits will be auto-configured to 0. Hence, Juniper devices configured with short MacSec keys are at risk to an increased likelihood that an attacker will discover the secret passphrases configured for these keys through dictionary-based and brute-force-based attacks using spoofed packets. Affected releases are Juniper Networks Junos OS: 14.1 versions prior to 14.1R10, 14.1R9; 14.1X53 versions prior to 14.1X53-D47; 15.1 versions prior to 15.1R4-S9, 15.1R6-S6, 15.1R7; 15.1X49 versions prior to 15.1X49-D100; 15.1X53 versions prior to 15.1X53-D59; 16.1 versions prior to 16.1R3-S8, 16.1R4-S8, 16.1R5; 16.2 versions prior to 16.2R1-S6, 16.2R2; 17.1 versions prior to 17.1R2.

cpe:/o:juniper:junos:12.1x46 cpe:/o:juniper:junos:12.1x46:d10 cpe:/o:juniper:junos:12.1x46:d15 cpe:/o:juniper:junos:12.1x46:d20 cpe:/o:juniper:junos:12.1x46:d25 cpe:/o:juniper:junos:12.1x46:d30 cpe:/o:juniper:junos:12.1x46:d35 cpe:/o:juniper:junos:12.1x46:d40 cpe:/o:juniper:junos:12.1x46:d45 cpe:/o:juniper:junos:12.1x46:d50 cpe:/o:juniper:junos:12.1x46:d55 cpe:/o:juniper:junos:12.1x46:d60 cpe:/o:juniper:junos:12.1x46:d65 cpe:/o:juniper:junos:12.3x48 cpe:/o:juniper:junos:12.3x48:d10 cpe:/o:juniper:junos:12.3x48:d15 cpe:/o:juniper:junos:12.3x48:d20 cpe:/o:juniper:junos:12.3x48:d25 cpe:/o:juniper:junos:12.3x48:d30 cpe:/o:juniper:junos:12.3x48:d35 cpe:/o:juniper:junos:12.3x48:d40 cpe:/o:juniper:junos:12.3x48:d45 cpe:/o:juniper:junos:12.3x48:d50 cpe:/o:juniper:junos:12.3x48:d55 cpe:/o:juniper:junos:12.3x48:d60 cpe:/o:juniper:junos:12.3x48:d65 cpe:/o:juniper:junos:14.1 cpe:/o:juniper:junos:14.1:r1 cpe:/o:juniper:junos:14.1:r2 cpe:/o:juniper:junos:14.1:r3 cpe:/o:juniper:junos:14.1:r4 cpe:/o:juniper:junos:14.1:r5 cpe:/o:juniper:junos:14.1:r6 cpe:/o:juniper:junos:14.1:r7 cpe:/o:juniper:junos:14.1:r8 cpe:/o:juniper:junos:14.1x53 cpe:/o:juniper:junos:14.1x53:d15 cpe:/o:juniper:junos:14.1x53:d16 cpe:/o:juniper:junos:14.1x53:d25 cpe:/o:juniper:junos:14.1x53:d26 cpe:/o:juniper:junos:14.1x53:d27 cpe:/o:juniper:junos:14.1x53:d30 cpe:/o:juniper:junos:14.1x53:d35 cpe:/o:juniper:junos:14.1x53:d40 cpe:/o:juniper:junos:14.1x53:d42 cpe:/o:juniper:junos:14.1x53:d43 cpe:/o:juniper:junos:14.1x53:d44 cpe:/o:juniper:junos:14.1x53:d45 cpe:/o:juniper:junos:14.1x53:d46 cpe:/o:juniper:junos:14.2 cpe:/o:juniper:junos:14.2:r1 cpe:/o:juniper:junos:14.2:r2 cpe:/o:juniper:junos:14.2:r3 cpe:/o:juniper:junos:14.2:r4 cpe:/o:juniper:junos:14.2:r5 cpe:/o:juniper:junos:14.2:r6 cpe:/o:juniper:junos:14.2:r7 cpe:/o:juniper:junos:15.1 cpe:/o:juniper:junos:15.1:f1 cpe:/o:juniper:junos:15.1:f2 cpe:/o:juniper:junos:15.1:f3 cpe:/o:juniper:junos:15.1:f4 cpe:/o:juniper:junos:15.1:f6 cpe:/o:juniper:junos:15.1:r1 cpe:/o:juniper:junos:15.1:r2 cpe:/o:juniper:junos:15.1:r3 cpe:/o:juniper:junos:15.1:r4 cpe:/o:juniper:junos:15.1:r6 cpe:/o:juniper:junos:15.1x49 cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d100 cpe:/o:juniper:junos:15.1x49:d110 cpe:/o:juniper:junos:15.1x49:d120 cpe:/o:juniper:junos:15.1x49:d130 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d55 cpe:/o:juniper:junos:15.1x49:d60 cpe:/o:juniper:junos:15.1x49:d65 cpe:/o:juniper:junos:15.1x49:d70 cpe:/o:juniper:junos:15.1x49:d75 cpe:/o:juniper:junos:15.1x49:d80 cpe:/o:juniper:junos:15.1x49:d90 cpe:/o:juniper:junos:15.1x53 cpe:/o:juniper:junos:15.1x53:d10 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d210 cpe:/o:juniper:junos:15.1x53:d230 cpe:/o:juniper:junos:15.1x53:d231 cpe:/o:juniper:junos:15.1x53:d232 cpe:/o:juniper:junos:15.1x53:d233 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d470 cpe:/o:juniper:junos:15.1x53:d50 cpe:/o:juniper:junos:15.1x53:d51 cpe:/o:juniper:junos:15.1x53:d52 cpe:/o:juniper:junos:15.1x53:d55 cpe:/o:juniper:junos:15.1x53:d57 cpe:/o:juniper:junos:15.1x53:d58 cpe:/o:juniper:junos:15.1x53:d60 cpe:/o:juniper:junos:15.1x53:d61 cpe:/o:juniper:junos:15.1x53:d62 cpe:/o:juniper:junos:15.1x53:d63 cpe:/o:juniper:junos:15.1x53:d64 cpe:/o:juniper:junos:15.1x53:d65 cpe:/o:juniper:junos:15.1x53:d66 cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.1:r4 cpe:/o:juniper:junos:16.1:r5 cpe:/o:juniper:junos:16.2:r1 cpe:/o:juniper:junos:16.2:r2 cpe:/o:juniper:junos:16.2:r3 cpe:/o:juniper:junos:17.1:r1 cpe:/o:juniper:junos:17.1:r2 cpe:/o:juniper:junos:17.1:r3 cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.2:r2

CVE-2018-0022

2018-04-11T15:29:00.650-04:00

2019-10-09T19:30:59.957-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103740 SECTRACK 1040790 CONFIRM https://kb.juniper.net/JSA10855 A Junos device with VPLS routing-instances configured on one or more interfaces may be susceptible to an mbuf leak when processing a specific MPLS packet. Approximately 1 mbuf is leaked per each packet processed. The number of mbufs is platform dependent. The following command provides the number of mbufs that are currently in use and maximum number of mbufs that can be allocated on a platform: > show system buffers 2437/3143/5580 mbufs in use (current/cache/total) Once the device runs out of mbufs it will become inaccessible and a restart will be required. This issue only affects end devices, transit devices are not affected. Affected releases are Juniper Networks Junos OS with VPLS configured running: 12.1X46 versions prior to 12.1X46-D76; 12.3X48 versions prior to 12.3X48-D66, 12.3X48-D70; 14.1 versions prior to 14.1R9; 14.1X53 versions prior to 14.1X53-D47; 14.2 versions prior to 14.2R8; 15.1 versions prior to 15.1F2-S19, 15.1F6-S10, 15.1R4-S9, 15.1R5-S7, 15.1R6-S4, 15.1R7; 15.1X49 versions prior to 15.1X49-D131, 15.1X49-D140; 15.1X53 versions prior to 15.1X53-D58 on EX2300/EX3400; 15.1X53 versions prior to 15.1X53-D233 on QFX5200/QFX5110; 15.1X53 versions prior to 15.1X53-D471 on NFX; 15.1X53 versions prior to 15.1X53-D66 on QFX10; 16.1 versions prior to 16.1R3-S8, 16.1R4-S6, 16.1R5; 16.2 versions prior to 16.2R1-S6, 16.2R2-S5, 16.2R3; 17.1 versions prior to 17.1R1-S7, 17.1R2-S6, 17.1R3; 17.2 versions prior to 17.2R1-S5, 17.2R2.

cpe:/a:juniper:jsnapy:0.1:beta cpe:/a:juniper:jsnapy:0.1.1:beta cpe:/a:juniper:jsnapy:0.1.2:beta cpe:/a:juniper:jsnapy:0.1.3:beta cpe:/a:juniper:jsnapy:0.1.4:beta cpe:/a:juniper:jsnapy:0.1.5:beta cpe:/a:juniper:jsnapy:0.1.6:beta cpe:/a:juniper:jsnapy:0.1.7:beta cpe:/a:juniper:jsnapy:0.1.8:beta cpe:/a:juniper:jsnapy:0.1.9:beta cpe:/a:juniper:jsnapy:1.0.0 cpe:/a:juniper:jsnapy:1.1.0 cpe:/a:juniper:jsnapy:1.2.0 cpe:/a:juniper:jsnapy:1.2.1 cpe:/a:juniper:jsnapy:1.2.2

CVE-2018-0023

2018-04-11T15:29:00.697-04:00

2019-10-09T19:31:00.423-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103745 CONFIRM https://kb.juniper.net/JSA10856 JSNAPy is an open source python version of Junos Snapshot Administrator developed by Juniper available through github. The default configuration and sample files of JSNAPy automation tool versions prior to 1.3.0 are created world writable. This insecure file and directory permission allows unprivileged local users to alter the files under this directory including inserting operations not intended by the package maintainer, system administrator, or other users. This issue only affects users who downloaded and installed JSNAPy from github.

CVE-2018-0024

2018-07-11T14:29:00.167-04:00

2019-10-09T19:31:00.550-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 104718 SECTRACK 1041314 CONFIRM https://kb.juniper.net/JSA10857 An Improper Privilege Management vulnerability in a shell session of Juniper Networks Junos OS allows an authenticated unprivileged attacker to gain full control of the system. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D45 on SRX Series; 12.3X48 versions prior to 12.3X48-D20 on SRX Series; 12.3 versions prior to 12.3R11 on EX Series; 14.1X53 versions prior to 14.1X53-D30 on EX2200/VC, EX3200, EX3300/VC, EX4200, EX4300, EX4550/VC, EX4600, EX6200, EX8200/VC (XRE), QFX3500, QFX3600, QFX5100;; 15.1X49 versions prior to 15.1X49-D20 on SRX Series.

CVE-2018-0025

2018-07-11T14:29:00.230-04:00

2019-10-09T19:31:00.847-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104719 SECTRACK 1041316 CONFIRM https://kb.juniper.net/JSA10858 MISC https://www.juniper.net/documentation/en_US/junos/topics/concept/firewall-user-authentication-pass-through-understanding.html MISC https://www.juniper.net/documentation/en_US/junos/topics/example/firewall-user-authentication-pass-through-configuring-cli.html MISC https://www.juniper.net/documentation/en_US/junos/topics/example/security-https-traffic-to-trigger-pass-through-authentication-configuring.html When an SRX Series device is configured to use HTTP/HTTPS pass-through authentication services, a client sending authentication credentials in the initial HTTP/HTTPS session is at risk that these credentials may be captured during follow-on HTTP/HTTPS requests by a malicious actor through a man-in-the-middle attack or by authentic servers subverted by malicious actors. FTP, and Telnet pass-through authentication services are not affected. Affected releases are Juniper Networks SRX Series: 12.1X46 versions prior to 12.1X46-D67 on SRX Series; 12.3X48 versions prior to 12.3X48-D25 on SRX Series; 15.1X49 versions prior to 15.1X49-D35 on SRX Series.

cpe:/o:juniper:junos:15.1:r4 cpe:/o:juniper:junos:15.1:r5 cpe:/o:juniper:junos:15.1:r6 cpe:/o:juniper:junos:15.1x8

CVE-2018-0026

2018-07-11T14:29:00.293-04:00

2019-10-09T19:31:01.127-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104720 SECTRACK 1041315 CONFIRM https://kb.juniper.net/JSA10859 After Junos OS device reboot or upgrade, the stateless firewall filter configuration may not take effect. This issue can be verified by running the command: user@re0> show interfaces <interface_name> extensive | match filters" CAM destination filters: 0, CAM source filters: 0 Note: when the issue occurs, it does not show the applied firewall filter. The correct output should show the applied firewall filter, for example: user@re0> show interfaces <interface_name> extensive | match filters" CAM destination filters: 0, CAM source filters: 0 Input Filters: FIREWAL_FILTER_NAME-<interface_name> This issue affects firewall filters for every address family. Affected releases are Juniper Networks Junos OS: 15.1R4, 15.1R5, 15.1R6 and SRs based on these MRs. 15.1X8 versions prior to 15.1X8.3.

cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2

CVE-2018-0027

2018-07-11T14:29:00.340-04:00

2019-10-09T19:31:01.267-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 104721 SECTRACK 1041318 CONFIRM https://kb.juniper.net/JSA10861 Receipt of a crafted or malformed RSVP PATH message may cause the routing protocol daemon (RPD) to hang or crash. When RPD is unavailable, routing updates cannot be processed which can lead to an extended network outage. If RSVP is not enabled on an interface, then the issue cannot be triggered via that interface. This issue only affects Juniper Networks Junos OS 16.1 versions prior to 16.1R3. This issue does not affect Junos releases prior to 16.1R1.

cpe:/o:juniper:junos:15.1 cpe:/o:juniper:junos:15.1:a1 cpe:/o:juniper:junos:15.1:f1 cpe:/o:juniper:junos:15.1:f2 cpe:/o:juniper:junos:15.1:f2-s1 cpe:/o:juniper:junos:15.1:f2-s2 cpe:/o:juniper:junos:15.1:f2-s3 cpe:/o:juniper:junos:15.1:f2-s4 cpe:/o:juniper:junos:15.1:f3 cpe:/o:juniper:junos:15.1:f4 cpe:/o:juniper:junos:15.1:f5 cpe:/o:juniper:junos:15.1:f6 cpe:/o:juniper:junos:15.1:r4-s9 cpe:/o:juniper:junos:15.1:r6-s6 cpe:/o:juniper:junos:15.1:r7 cpe:/o:juniper:junos:15.1x49 cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d100 cpe:/o:juniper:junos:15.1x49:d110 cpe:/o:juniper:junos:15.1x49:d120 cpe:/o:juniper:junos:15.1x49:d130 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d55 cpe:/o:juniper:junos:15.1x49:d60 cpe:/o:juniper:junos:15.1x49:d65 cpe:/o:juniper:junos:15.1x49:d70 cpe:/o:juniper:junos:15.1x49:d75 cpe:/o:juniper:junos:15.1x49:d80 cpe:/o:juniper:junos:15.1x49:d90 cpe:/o:juniper:junos:15.1x53 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d210 cpe:/o:juniper:junos:15.1x53:d230 cpe:/o:juniper:junos:15.1x53:d231 cpe:/o:juniper:junos:15.1x53:d232 cpe:/o:juniper:junos:15.1x53:d25 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d40 cpe:/o:juniper:junos:15.1x53:d45 cpe:/o:juniper:junos:15.1x53:d50 cpe:/o:juniper:junos:15.1x53:d51 cpe:/o:juniper:junos:15.1x53:d52 cpe:/o:juniper:junos:15.1x53:d55 cpe:/o:juniper:junos:15.1x53:d56 cpe:/o:juniper:junos:15.1x53:d57 cpe:/o:juniper:junos:15.1x53:d58 cpe:/o:juniper:junos:15.1x53:d60 cpe:/o:juniper:junos:15.1x53:d61 cpe:/o:juniper:junos:15.1x53:d62 cpe:/o:juniper:junos:15.1x53:d63 cpe:/o:juniper:junos:15.1x53:d64 cpe:/o:juniper:junos:15.1x53:d65 cpe:/o:juniper:junos:15.1x53:d66 cpe:/o:juniper:junos:16.1 cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.1:r5-s4 cpe:/o:juniper:junos:16.1:r6-s1 cpe:/o:juniper:junos:16.1:r7 cpe:/o:juniper:junos:16.2 cpe:/o:juniper:junos:16.2:r1 cpe:/o:juniper:junos:16.2:r2-s5 cpe:/o:juniper:junos:16.2:r3 cpe:/o:juniper:junos:17.1 cpe:/o:juniper:junos:17.1:r1 cpe:/o:juniper:junos:17.1:r2 cpe:/o:juniper:junos:17.1:r2-s7 cpe:/o:juniper:junos:17.1:r3 cpe:/o:juniper:junos:17.2 cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.2:r2 cpe:/o:juniper:junos:17.2:r2-s4 cpe:/o:juniper:junos:17.2:r3 cpe:/o:juniper:junos:17.2x75 cpe:/o:juniper:junos:17.2x75:d110 cpe:/o:juniper:junos:17.3 cpe:/o:juniper:junos:17.3:r1 cpe:/o:juniper:junos:17.3:r2 cpe:/o:juniper:junos:17.4 cpe:/o:juniper:junos:17.4:r1 cpe:/o:juniper:junos:17.4:r2

CVE-2018-0029

2018-07-11T14:29:00.370-04:00

2019-10-09T19:31:01.440-04:00

6.1

ADJACENT_NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1041319 CONFIRM https://kb.juniper.net/JSA10863 While experiencing a broadcast storm, placing the fxp0 interface into promiscuous mode via the 'monitor traffic interface fxp0' can cause the system to crash and restart (vmcore). This issue only affects Junos OS 15.1 and later releases, and affects both single core and multi-core REs. Releases prior to Junos OS 15.1 are unaffected by this vulnerability. Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1F6-S11, 15.1R4-S9, 15.1R6-S6, 15.1R7; 15.1X49 versions prior to 15.1X49-D140; 15.1X53 versions prior to 15.1X53-D59 on EX2300/EX3400; 15.1X53 versions prior to 15.1X53-D67 on QFX10K; 15.1X53 versions prior to 15.1X53-D233 on QFX5200/QFX5110; 15.1X53 versions prior to 15.1X53-D471, 15.1X53-D490 on NFX; 16.1 versions prior to 16.1R3-S8, 16.1R5-S4, 16.1R6-S1, 16.1R7; 16.2 versions prior to 16.2R1-S6, 16.2R2-S5, 16.2R3; 17.1 versions prior to 17.1R1-S7, 17.1R2-S7, 17.1R3; 17.2 versions prior to 17.2R1-S6, 17.2R2-S4, 17.2R3; 17.2X75 versions prior to 17.2X75-D90, 17.2X75-D110; 17.3 versions prior to 17.3R1-S4, 17.3R2; 17.4 versions prior to 17.4R1-S3, 17.4R2.

cpe:/o:juniper:junos:15.1 cpe:/o:juniper:junos:15.1:f cpe:/o:juniper:junos:15.1:f2 cpe:/o:juniper:junos:15.1:f3 cpe:/o:juniper:junos:15.1:f4 cpe:/o:juniper:junos:15.1:f5 cpe:/o:juniper:junos:15.1:f6 cpe:/o:juniper:junos:15.1:r1 cpe:/o:juniper:junos:15.1:r2 cpe:/o:juniper:junos:15.1:r6-s6 cpe:/o:juniper:junos:15.1:r7 cpe:/o:juniper:junos:16.1 cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.1:r4-s9 cpe:/o:juniper:junos:16.1:r5-s4 cpe:/o:juniper:junos:16.1:r6-s3 cpe:/o:juniper:junos:16.1:r7 cpe:/o:juniper:junos:16.1x65 cpe:/o:juniper:junos:16.1x65:d30 cpe:/o:juniper:junos:16.1x65:d35 cpe:/o:juniper:junos:16.1x65:d40 cpe:/o:juniper:junos:16.2 cpe:/o:juniper:junos:16.2:r1 cpe:/o:juniper:junos:16.2:r2-s5 cpe:/o:juniper:junos:16.2:r3 cpe:/o:juniper:junos:17.1 cpe:/o:juniper:junos:17.1:r1 cpe:/o:juniper:junos:17.1:r2-s7 cpe:/o:juniper:junos:17.1:r3 cpe:/o:juniper:junos:17.2 cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.2:r2-s4 cpe:/o:juniper:junos:17.2:r3 cpe:/o:juniper:junos:17.2x75 cpe:/o:juniper:junos:17.2x75:d90 cpe:/o:juniper:junos:17.3 cpe:/o:juniper:junos:17.3:r1 cpe:/o:juniper:junos:17.3:r2 cpe:/o:juniper:junos:17.4 cpe:/o:juniper:junos:17.4:r1 cpe:/o:juniper:junos:17.4:r2

CVE-2018-0030

2018-07-11T14:29:00.467-04:00

2019-10-09T19:31:01.737-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1041325 CONFIRM https://kb.juniper.net/JSA10864 MISC https://kb.juniper.net/KB25385 Receipt of a specific MPLS packet may cause MPC7/8/9, PTX-FPC3 (FPC-P1, FPC-P2) line cards or PTX1K to crash and restart. By continuously sending specific MPLS packets, an attacker can repeatedly crash the line cards or PTX1K causing a sustained Denial of Service. Affected releases are Juniper Networks Junos OS with MPC7/8/9 or PTX-FPC3 (FPC-P1, FPC-P2) installed and PTX1K: 15.1F versions prior to 15.1F6-S10; 15.1 versions prior to 15.1R4-S9, 15.1R6-S6, 15.1R7; 16.1 versions prior to 16.1R3-S8, 16.1R4-S9, 16.1R5-S4, 16.1R6-S3, 16.1R7; 16.1X65 versions prior to 16.1X65-D46; 16.2 versions prior to 16.2R1-S6, 16.2R2-S5, 16.2R3; 17.1 versions prior to 17.1R1-S7, 17.1R2-S7, 17.1R3; 17.2 versions prior to 17.2R1-S4, 17.2R2-S4, 17.2R3; 17.2X75 versions prior to 17.2X75-D70, 17.2X75-D90; 17.3 versions prior to 17.3R1-S4, 17.3R2, 17.4 versions prior to 17.4R1-S2, 17.4R2. Refer to KB25385 for more information about PFE line cards.

cpe:/o:juniper:junos:12.1x46 cpe:/o:juniper:junos:12.1x46:d10 cpe:/o:juniper:junos:12.1x46:d15 cpe:/o:juniper:junos:12.1x46:d20 cpe:/o:juniper:junos:12.1x46:d25 cpe:/o:juniper:junos:12.1x46:d30 cpe:/o:juniper:junos:12.1x46:d35 cpe:/o:juniper:junos:12.1x46:d40 cpe:/o:juniper:junos:12.1x46:d45 cpe:/o:juniper:junos:12.1x46:d50 cpe:/o:juniper:junos:12.1x46:d55 cpe:/o:juniper:junos:12.1x46:d60 cpe:/o:juniper:junos:12.3 cpe:/o:juniper:junos:12.3:r1 cpe:/o:juniper:junos:12.3:r11 cpe:/o:juniper:junos:12.3:r12 cpe:/o:juniper:junos:12.3:r2 cpe:/o:juniper:junos:12.3:r3 cpe:/o:juniper:junos:12.3:r4 cpe:/o:juniper:junos:12.3:r5 cpe:/o:juniper:junos:12.3:r6 cpe:/o:juniper:junos:12.3:r7 cpe:/o:juniper:junos:12.3:r8 cpe:/o:juniper:junos:12.3:r9 cpe:/o:juniper:junos:12.3x48 cpe:/o:juniper:junos:12.3x48:d10 cpe:/o:juniper:junos:12.3x48:d15 cpe:/o:juniper:junos:12.3x48:d25 cpe:/o:juniper:junos:12.3x48:d30 cpe:/o:juniper:junos:12.3x48:d35 cpe:/o:juniper:junos:12.3x48:d40 cpe:/o:juniper:junos:12.3x48:d45 cpe:/o:juniper:junos:12.3x48:d50 cpe:/o:juniper:junos:12.3x48:d55 cpe:/o:juniper:junos:12.3x48:d60 cpe:/o:juniper:junos:12.3x48:d65 cpe:/o:juniper:junos:12.3x48:d70 cpe:/o:juniper:junos:14.1x53 cpe:/o:juniper:junos:14.1x53:d10 cpe:/o:juniper:junos:14.1x53:d15 cpe:/o:juniper:junos:14.1x53:d16 cpe:/o:juniper:junos:14.1x53:d25 cpe:/o:juniper:junos:14.1x53:d26 cpe:/o:juniper:junos:14.1x53:d27 cpe:/o:juniper:junos:14.1x53:d30 cpe:/o:juniper:junos:14.1x53:d35 cpe:/o:juniper:junos:14.1x53:d40 cpe:/o:juniper:junos:14.1x53:d45 cpe:/o:juniper:junos:15.1 cpe:/o:juniper:junos:15.1:f4 cpe:/o:juniper:junos:15.1:f6 cpe:/o:juniper:junos:15.1:r1 cpe:/o:juniper:junos:15.1:r2 cpe:/o:juniper:junos:15.1:r3 cpe:/o:juniper:junos:15.1:r4-s9 cpe:/o:juniper:junos:15.1:r6-s6 cpe:/o:juniper:junos:15.1:r7 cpe:/o:juniper:junos:15.1x49 cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d140 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d55 cpe:/o:juniper:junos:15.1x49:d60 cpe:/o:juniper:junos:15.1x49:d65 cpe:/o:juniper:junos:15.1x49:d70 cpe:/o:juniper:junos:15.1x49:d75 cpe:/o:juniper:junos:15.1x49:d80 cpe:/o:juniper:junos:15.1x53 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d210 cpe:/o:juniper:junos:15.1x53:d230 cpe:/o:juniper:junos:15.1x53:d231 cpe:/o:juniper:junos:15.1x53:d232 cpe:/o:juniper:junos:15.1x53:d25 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d40 cpe:/o:juniper:junos:15.1x53:d45 cpe:/o:juniper:junos:15.1x53:d490 cpe:/o:juniper:junos:15.1x53:d60 cpe:/o:juniper:junos:15.1x53:d61 cpe:/o:juniper:junos:15.1x53:d62 cpe:/o:juniper:junos:15.1x53:d63 cpe:/o:juniper:junos:15.1x53:d64 cpe:/o:juniper:junos:15.1x53:d65 cpe:/o:juniper:junos:15.1x53:d66 cpe:/o:juniper:junos:16.1 cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.1:r5-s4 cpe:/o:juniper:junos:16.1:r6-s1 cpe:/o:juniper:junos:16.1:r7 cpe:/o:juniper:junos:16.2 cpe:/o:juniper:junos:16.2:r1 cpe:/o:juniper:junos:16.2:r2-s5 cpe:/o:juniper:junos:16.2:r3 cpe:/o:juniper:junos:17.1 cpe:/o:juniper:junos:17.1:r1 cpe:/o:juniper:junos:17.1:r2-s7 cpe:/o:juniper:junos:17.1:r3 cpe:/o:juniper:junos:17.2 cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.2:r2 cpe:/o:juniper:junos:17.2:r2-s4 cpe:/o:juniper:junos:17.2:r3 cpe:/o:juniper:junos:17.2x75 cpe:/o:juniper:junos:17.2x75:d110 cpe:/o:juniper:junos:17.3 cpe:/o:juniper:junos:17.3:r1 cpe:/o:juniper:junos:17.3:r2 cpe:/o:juniper:junos:17.3:r2-s2 cpe:/o:juniper:junos:17.3:r3 cpe:/o:juniper:junos:17.4 cpe:/o:juniper:junos:17.4:r1 cpe:/o:juniper:junos:17.4:r2 cpe:/o:juniper:junos:18.1 cpe:/o:juniper:junos:18.1:r1 cpe:/o:juniper:junos:18.2x75

CVE-2018-0031

2018-07-11T14:29:00.510-04:00

2019-10-09T19:31:02.050-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1041326 CONFIRM https://kb.juniper.net/JSA10865 Receipt of specially crafted UDP/IP packets over MPLS may be able to bypass a stateless firewall filter. The crafted UDP packets must be encapsulated and meet a very specific packet format to be classified in a way that bypasses IP firewall filter rules. The packets themselves do not cause a service interruption (e.g. RPD crash), but receipt of a high rate of UDP packets may be able to contribute to a denial of service attack. This issue only affects processing of transit UDP/IP packets over MPLS, received on an interface with MPLS enabled. TCP packet processing and non-MPLS encapsulated UDP packet processing are unaffected by this issue. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D76; 12.3 versions prior to 12.3R12-S10; 12.3X48 versions prior to 12.3X48-D66, 12.3X48-D70; 14.1X53 versions prior to 14.1X53-D47; 15.1 versions prior to 15.1F6-S10, 15.1R4-S9, 15.1R6-S6, 15.1R7; 15.1X49 versions prior to 15.1X49-D131, 15.1X49-D140; 15.1X53 versions prior to 15.1X53-D59 on EX2300/EX3400; 15.1X53 versions prior to 15.1X53-D67 on QFX10K; 15.1X53 versions prior to 15.1X53-D233 on QFX5200/QFX5110; 15.1X53 versions prior to 15.1X53-D471, 15.1X53-D490 on NFX; 16.1 versions prior to 16.1R3-S8, 16.1R4-S9, 16.1R5-S4, 16.1R6-S3, 16.1R7; 16.2 versions prior to 16.2R1-S6, 16.2R2-S5, 16.2R3; 17.1 versions prior to 17.1R1-S7, 17.1R2-S7, 17.1R3; 17.2 versions prior to 17.2R1-S6, 17.2R2-S4, 17.2R3; 17.2X75 versions prior to 17.2X75-D100; 17.3 versions prior to 17.3R1-S4, 17.3R2-S2, 17.3R3; 17.4 versions prior to 17.4R1-S3, 17.4R2; 18.1 versions prior to 18.1R2; 18.2X75 versions prior to 18.2X75-D5.

cpe:/o:juniper:junos:16.1x65 cpe:/o:juniper:junos:16.1x65:d30 cpe:/o:juniper:junos:16.1x65:d35 cpe:/o:juniper:junos:16.1x65:d40 cpe:/o:juniper:junos:17.2x75 cpe:/o:juniper:junos:17.3 cpe:/o:juniper:junos:17.3:r1 cpe:/o:juniper:junos:17.4 cpe:/o:juniper:junos:17.4:r1

CVE-2018-0032

2018-07-11T14:29:00.573-04:00

2019-10-09T19:31:02.533-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1041337 CONFIRM https://kb.juniper.net/JSA10866 The receipt of a crafted BGP UPDATE can lead to a routing process daemon (RPD) crash and restart. Repeated receipt of the same crafted BGP UPDATE can result in an extended denial of service condition for the device. This issue only affects the specific versions of Junos OS listed within this advisory. Earlier releases are unaffected by this vulnerability. This crafted BGP UPDATE does not propagate to other BGP peers. Affected releases are Juniper Networks Junos OS: 16.1X65 versions prior to 16.1X65-D47; 17.2X75 versions prior to 17.2X75-D91, 17.2X75-D110; 17.3 versions prior to 17.3R1-S4, 17.3R2; 17.4 versions prior to 17.4R1-S3, 17.4R2.

cpe:/o:juniper:junos:12.3 cpe:/o:juniper:junos:12.3:r1 cpe:/o:juniper:junos:12.3:r10 cpe:/o:juniper:junos:12.3:r11 cpe:/o:juniper:junos:12.3:r12 cpe:/o:juniper:junos:12.3:r2 cpe:/o:juniper:junos:12.3:r3 cpe:/o:juniper:junos:12.3:r4 cpe:/o:juniper:junos:12.3:r5 cpe:/o:juniper:junos:12.3:r6 cpe:/o:juniper:junos:12.3:r7 cpe:/o:juniper:junos:12.3:r8 cpe:/o:juniper:junos:12.3:r9 cpe:/o:juniper:junos:12.3x48 cpe:/o:juniper:junos:12.3x48:d10 cpe:/o:juniper:junos:12.3x48:d15 cpe:/o:juniper:junos:12.3x48:d20 cpe:/o:juniper:junos:12.3x48:d25 cpe:/o:juniper:junos:12.3x48:d30 cpe:/o:juniper:junos:12.3x48:d35 cpe:/o:juniper:junos:12.3x48:d40 cpe:/o:juniper:junos:12.3x48:d45 cpe:/o:juniper:junos:12.3x48:d50 cpe:/o:juniper:junos:12.3x48:d55 cpe:/o:juniper:junos:12.3x48:d60 cpe:/o:juniper:junos:12.3x48:d65 cpe:/o:juniper:junos:14.1x53 cpe:/o:juniper:junos:14.1x53:d10 cpe:/o:juniper:junos:14.1x53:d121 cpe:/o:juniper:junos:14.1x53:d15 cpe:/o:juniper:junos:14.1x53:d16 cpe:/o:juniper:junos:14.1x53:d20 cpe:/o:juniper:junos:14.1x53:d25 cpe:/o:juniper:junos:14.1x53:d26 cpe:/o:juniper:junos:14.1x53:d27 cpe:/o:juniper:junos:14.1x53:d30 cpe:/o:juniper:junos:14.1x53:d35 cpe:/o:juniper:junos:14.1x53:d40 cpe:/o:juniper:junos:14.1x53:d42 cpe:/o:juniper:junos:14.1x53:d43 cpe:/o:juniper:junos:14.1x53:d44 cpe:/o:juniper:junos:14.1x53:d45 cpe:/o:juniper:junos:14.1x53:d46 cpe:/o:juniper:junos:14.1x53:d47 cpe:/o:juniper:junos:15.1 cpe:/o:juniper:junos:15.1:f2 cpe:/o:juniper:junos:15.1:f3 cpe:/o:juniper:junos:15.1:f4 cpe:/o:juniper:junos:15.1:f5 cpe:/o:juniper:junos:15.1:r1 cpe:/o:juniper:junos:15.1:r2 cpe:/o:juniper:junos:15.1:r3 cpe:/o:juniper:junos:15.1:r4 cpe:/o:juniper:junos:15.1:r6-s6 cpe:/o:juniper:junos:15.1:r7 cpe:/o:juniper:junos:15.1x49 cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d100 cpe:/o:juniper:junos:15.1x49:d110 cpe:/o:juniper:junos:15.1x49:d120 cpe:/o:juniper:junos:15.1x49:d130 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d60 cpe:/o:juniper:junos:15.1x49:d65 cpe:/o:juniper:junos:15.1x49:d70 cpe:/o:juniper:junos:15.1x49:d75 cpe:/o:juniper:junos:15.1x49:d80 cpe:/o:juniper:junos:15.1x49:d90 cpe:/o:juniper:junos:15.1x53 cpe:/o:juniper:junos:15.1x53:d10 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d210 cpe:/o:juniper:junos:15.1x53:d230 cpe:/o:juniper:junos:15.1x53:d231 cpe:/o:juniper:junos:15.1x53:d232 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d40 cpe:/o:juniper:junos:15.1x53:d45 cpe:/o:juniper:junos:15.1x53:d50 cpe:/o:juniper:junos:15.1x53:d51 cpe:/o:juniper:junos:15.1x53:d52 cpe:/o:juniper:junos:15.1x53:d55 cpe:/o:juniper:junos:15.1x53:d56 cpe:/o:juniper:junos:15.1x53:d57 cpe:/o:juniper:junos:15.1x53:d58 cpe:/o:juniper:junos:15.1x53:d59 cpe:/o:juniper:junos:15.1x53:d60 cpe:/o:juniper:junos:15.1x53:d61 cpe:/o:juniper:junos:15.1x53:d62 cpe:/o:juniper:junos:15.1x53:d63 cpe:/o:juniper:junos:15.1x53:d64 cpe:/o:juniper:junos:15.1x53:d65 cpe:/o:juniper:junos:15.1x53:d66 cpe:/o:juniper:junos:15.1x53:d67 cpe:/o:juniper:junos:16.1 cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.1:r4-s8 cpe:/o:juniper:junos:16.1:r5-s4 cpe:/o:juniper:junos:16.1:r6-s3 cpe:/o:juniper:junos:16.1:r7 cpe:/o:juniper:junos:16.2 cpe:/o:juniper:junos:16.2:r1 cpe:/o:juniper:junos:16.2:r2 cpe:/o:juniper:junos:16.2:r3 cpe:/o:juniper:junos:17.1 cpe:/o:juniper:junos:17.1:r1 cpe:/o:juniper:junos:17.1:r2-s7 cpe:/o:juniper:junos:17.1:r3 cpe:/o:juniper:junos:17.2 cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.2:r2-s4 cpe:/o:juniper:junos:17.2:r3 cpe:/o:juniper:junos:17.3 cpe:/o:juniper:junos:17.3:r1 cpe:/o:juniper:junos:17.3:r2-s2 cpe:/o:juniper:junos:17.3:r3 cpe:/o:juniper:junos:17.4 cpe:/o:juniper:junos:17.4:r1 cpe:/o:juniper:junos:17.4:r2

CVE-2018-0034

2018-07-11T14:29:00.607-04:00

2019-10-09T19:31:02.707-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1041338 MISC https://apps.juniper.net/feature-explorer/search.html#q=dhcp CONFIRM https://kb.juniper.net/JSA10868 A Denial of Service vulnerability exists in the Juniper Networks Junos OS JDHCPD daemon which allows an attacker to core the JDHCPD daemon by sending a crafted IPv6 packet to the system. This issue is limited to systems which receives IPv6 DHCP packets on a system configured for DHCP processing using the JDHCPD daemon. This issue does not affect IPv4 DHCP packet processing. Affected releases are Juniper Networks Junos OS: 12.3 versions prior to 12.3R12-S10 on EX Series; 12.3X48 versions prior to 12.3X48-D70 on SRX Series; 14.1X53 versions prior to 14.1X53-D47 on EX2200/VC, EX3200, EX3300/VC, EX4200, EX4300, EX4550/VC, EX4600, EX6200, EX8200/VC (XRE), QFX3500, QFX3600, QFX5100; 14.1X53 versions prior to 14.1X53-D130 on QFabric; 15.1 versions prior to 15.1R4-S9, 15.1R6-S6, 15.1R7; 15.1X49 versions prior to 15.1X49-D140 on SRX Series; 15.1X53 versions prior to 15.1X53-D67 on QFX10000 Series; 15.1X53 versions prior to 15.1X53-D233 on QFX5110, QFX5200; 15.1X53 versions prior to 15.1X53-D471 on NFX 150, NFX 250; 16.1 versions prior to 16.1R3-S9, 16.1R4-S8, 16.1R5-S4, 16.1R6-S3, 16.1R7; 16.2 versions prior to 16.2R2-S5, 16.2R3; 17.1 versions prior to 17.1R1-S7, 17.1R2-S7, 17.1R3; 17.2 versions prior to 17.2R1-S6, 17.2R2-S4, 17.2R3; 17.3 versions prior to 17.3R1-S4, 17.3R2-S2, 17.3R3; 17.4 versions prior to 17.4R1-S3, 17.4R2.

cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d31 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d60

CVE-2018-0035

2018-07-11T14:29:00.683-04:00

2019-10-09T19:31:03.363-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1041336 CONFIRM https://kb.juniper.net/JSA10869 QFX5200 and QFX10002 devices that have been shipped with Junos OS 15.1X53-D21, 15.1X53-D30, 15.1X53-D31, 15.1X53-D32, 15.1X53-D33 and 15.1X53-D60 or have been upgraded to these releases using the .bin or .iso images may contain an unintended additional Open Network Install Environment (ONIE) partition. This additional partition allows the superuser to reboot to the ONIE partition which will wipe out the content of the Junos partition and its configuration. Once rebooted, the ONIE partition will not have root password configured, thus any user can access the console or SSH, using an IP address acquired from DHCP, as root without password. Once the device has been shipped or upgraded with the ONIE partition installed, the issue will persist. Simply upgrading to higher release via the CLI will not resolve the issue. No other Juniper Networks products or platforms are affected by this issue.

cpe:/o:juniper:junos:15.1:f2 cpe:/o:juniper:junos:15.1:f5-s7 cpe:/o:juniper:junos:15.1:f6 cpe:/o:juniper:junos:15.1:f6-s3 cpe:/o:juniper:junos:15.1:f7 cpe:/o:juniper:junos:15.1:r3 cpe:/o:juniper:junos:15.1:r5 cpe:/o:juniper:junos:15.1:r7

CVE-2018-0037

2018-07-11T14:29:00.717-04:00

2019-10-09T19:31:03.517-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1041339 CONFIRM https://kb.juniper.net/JSA10871 Junos OS routing protocol daemon (RPD) process may crash and restart or may lead to remote code execution while processing specific BGP NOTIFICATION messages. By continuously sending crafted BGP NOTIFICATION messages, an attacker can repeatedly crash the RPD process causing a sustained Denial of Service. Due to design improvements, this issue does not affect Junos OS 16.1R1, and all subsequent releases. This issue only affects the receiving BGP device and is non-transitive in nature. Affected releases are Juniper Networks Junos OS: 15.1F5 versions starting from 15.1F5-S7 and all subsequent releases; 15.1F6 versions starting from 15.1F6-S3 and later releases prior to 15.1F6-S10; 15.1F7 versions 15.1 versions starting from 15.1R5 and later releases, including the Service Releases based on 15.1R5 and on 15.1R6 prior to 15.1R6-S6 and 15.1R7;

CVE-2018-0038

2018-07-11T14:29:00.793-04:00

2018-09-06T09:54:09.077-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2018-09-05T13:07:45.677-04:00

CONFIRM https://kb.juniper.net/JSA10872 Juniper Networks Contrail Service Orchestration releases prior to 3.3.0 have Cassandra service enabled by default with hardcoded credentials. These credentials allow network based attackers unauthorized access to information stored in Cassandra.

CVE-2018-0039

2018-07-11T14:29:00.823-04:00

2019-10-09T19:31:03.673-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://kb.juniper.net/JSA10872 Juniper Networks Contrail Service Orchestration releases prior to 4.0.0 have Grafana service enabled by default with hardcoded credentials. These credentials allow network based attackers unauthorized access to information stored in Grafana or exploit other weaknesses or vulnerabilities in Grafana.

CVE-2018-0040

2018-07-11T14:29:00.917-04:00

2019-10-09T19:31:03.847-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM https://kb.juniper.net/JSA10872 Juniper Networks Contrail Service Orchestrator versions prior to 4.0.0 use hardcoded cryptographic certificates and keys in some cases, which may allow network based attackers to gain unauthorized access to services.

CVE-2018-0041

2018-07-11T14:29:00.950-04:00

2019-10-09T19:31:04.003-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://kb.juniper.net/JSA10872 Juniper Networks Contrail Service Orchestration releases prior to 3.3.0 use hardcoded credentials to access Keystone service. These credentials allow network based attackers unauthorized access to information stored in keystone.

CVE-2018-0042

2018-07-11T14:29:00.997-04:00

2019-10-02T20:03:26.223-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-09-05T12:35:35.143-04:00

CONFIRM https://kb.juniper.net/JSA10872 Juniper Networks CSO versions prior to 4.0.0 may log passwords in log files leading to an information disclosure vulnerability.

cpe:/o:juniper:junos:12.1x46 cpe:/o:juniper:junos:12.1x46:d10 cpe:/o:juniper:junos:12.1x46:d15 cpe:/o:juniper:junos:12.1x46:d20 cpe:/o:juniper:junos:12.1x46:d25 cpe:/o:juniper:junos:12.1x46:d30 cpe:/o:juniper:junos:12.1x46:d35 cpe:/o:juniper:junos:12.1x46:d40 cpe:/o:juniper:junos:12.1x46:d45 cpe:/o:juniper:junos:12.1x46:d50 cpe:/o:juniper:junos:12.1x46:d55 cpe:/o:juniper:junos:12.3 cpe:/o:juniper:junos:12.3:r1 cpe:/o:juniper:junos:12.3:r10 cpe:/o:juniper:junos:12.3:r11 cpe:/o:juniper:junos:12.3:r2 cpe:/o:juniper:junos:12.3:r3 cpe:/o:juniper:junos:12.3:r4 cpe:/o:juniper:junos:12.3:r5 cpe:/o:juniper:junos:12.3:r6 cpe:/o:juniper:junos:12.3:r7 cpe:/o:juniper:junos:12.3:r8 cpe:/o:juniper:junos:12.3:r9 cpe:/o:juniper:junos:12.3x48 cpe:/o:juniper:junos:12.3x48:d10 cpe:/o:juniper:junos:12.3x48:d15 cpe:/o:juniper:junos:12.3x48:d20 cpe:/o:juniper:junos:12.3x48:d25 cpe:/o:juniper:junos:12.3x48:d30 cpe:/o:juniper:junos:12.3x48:d35 cpe:/o:juniper:junos:12.3x48:d40 cpe:/o:juniper:junos:12.3x48:d45 cpe:/o:juniper:junos:12.3x48:d50 cpe:/o:juniper:junos:12.3x48:d55 cpe:/o:juniper:junos:12.3x48:d60 cpe:/o:juniper:junos:12.3x48:d65 cpe:/o:juniper:junos:12.3x48:d70 cpe:/o:juniper:junos:14.1x53 cpe:/o:juniper:junos:14.1x53:d10 cpe:/o:juniper:junos:14.1x53:d121 cpe:/o:juniper:junos:14.1x53:d15 cpe:/o:juniper:junos:14.1x53:d16 cpe:/o:juniper:junos:14.1x53:d20 cpe:/o:juniper:junos:14.1x53:d25 cpe:/o:juniper:junos:14.1x53:d26 cpe:/o:juniper:junos:14.1x53:d27 cpe:/o:juniper:junos:14.1x53:d30 cpe:/o:juniper:junos:14.1x53:d35 cpe:/o:juniper:junos:14.1x53:d40 cpe:/o:juniper:junos:14.1x53:d42 cpe:/o:juniper:junos:14.1x53:d43 cpe:/o:juniper:junos:14.1x53:d44 cpe:/o:juniper:junos:14.1x53:d45 cpe:/o:juniper:junos:14.1x53:d46 cpe:/o:juniper:junos:14.1x53:d47 cpe:/o:juniper:junos:15.1 cpe:/o:juniper:junos:15.1:f3 cpe:/o:juniper:junos:15.1:f4 cpe:/o:juniper:junos:15.1:f5 cpe:/o:juniper:junos:15.1:f6 cpe:/o:juniper:junos:15.1:r1 cpe:/o:juniper:junos:15.1:r2 cpe:/o:juniper:junos:15.1:r3 cpe:/o:juniper:junos:15.1x49 cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d100 cpe:/o:juniper:junos:15.1x49:d110 cpe:/o:juniper:junos:15.1x49:d120 cpe:/o:juniper:junos:15.1x49:d130 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d60 cpe:/o:juniper:junos:15.1x49:d65 cpe:/o:juniper:junos:15.1x49:d70 cpe:/o:juniper:junos:15.1x49:d75 cpe:/o:juniper:junos:15.1x49:d80 cpe:/o:juniper:junos:15.1x49:d90 cpe:/o:juniper:junos:15.1x53 cpe:/o:juniper:junos:15.1x53:d10 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d210 cpe:/o:juniper:junos:15.1x53:d230 cpe:/o:juniper:junos:15.1x53:d231 cpe:/o:juniper:junos:15.1x53:d232 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d40 cpe:/o:juniper:junos:15.1x53:d45 cpe:/o:juniper:junos:15.1x53:d50 cpe:/o:juniper:junos:15.1x53:d51 cpe:/o:juniper:junos:15.1x53:d52 cpe:/o:juniper:junos:15.1x53:d55 cpe:/o:juniper:junos:15.1x53:d56 cpe:/o:juniper:junos:15.1x53:d57 cpe:/o:juniper:junos:15.1x53:d58 cpe:/o:juniper:junos:15.1x53:d59 cpe:/o:juniper:junos:15.1x53:d60 cpe:/o:juniper:junos:15.1x53:d61 cpe:/o:juniper:junos:15.1x53:d62 cpe:/o:juniper:junos:15.1x53:d63 cpe:/o:juniper:junos:15.1x53:d64 cpe:/o:juniper:junos:15.1x53:d65 cpe:/o:juniper:junos:15.1x53:d66 cpe:/o:juniper:junos:15.1x53:d67 cpe:/o:juniper:junos:16.1 cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1x65:d30 cpe:/o:juniper:junos:16.1x65:d35 cpe:/o:juniper:junos:16.1x65:d40 cpe:/o:juniper:junos:16.2 cpe:/o:juniper:junos:16.2:r1 cpe:/o:juniper:junos:17.1 cpe:/o:juniper:junos:17.2x75 cpe:/o:juniper:junos:17.3 cpe:/o:juniper:junos:17.4

CVE-2018-0043

2018-10-10T14:29:00.327-04:00

2019-10-09T19:31:04.177-04:00

5.8

ADJACENT_NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1041847 CONFIRM https://kb.juniper.net/JSA10877 Receipt of a specific MPLS packet may cause the routing protocol daemon (RPD) process to crash and restart or may lead to remote code execution. By continuously sending specific MPLS packets, an attacker can repeatedly crash the RPD process causing a sustained Denial of Service. This issue affects both IPv4 and IPv6. This issue can only be exploited from within the MPLS domain. End-users connected to the CE device cannot cause this crash. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D77 on SRX Series; 12.3 versions prior to 12.3R12-S10; 12.3X48 versions prior to 12.3X48-D75 on SRX Series; 14.1X53 versions prior to 14.1X53-D47 on QFX/EX Series; 14.1X53 versions prior to 14.1X53-D130 on QFabric Series; 15.1F6 versions prior to 15.1F6-S10; 15.1 versions prior to 15.1R4-S9 15.1R7; 15.1X49 versions prior to 15.1X49-D140 on SRX Series; 15.1X53 versions prior to 15.1X53-D59 on EX2300/EX3400 Series; 15.1X53 versions prior to 15.1X53-D67 on QFX10K Series; 15.1X53 versions prior to 15.1X53-D233 on QFX5200/QFX5110 Series; 15.1X53 versions prior to 15.1X53-D471 15.1X53-D490 on NFX Series; 16.1 versions prior to 16.1R3-S8 16.1R4-S8 16.1R5-S4 16.1R6-S4 16.1R7; 16.1X65 versions prior to 16.1X65-D48; 16.2 versions prior to 16.2R1-S6 16.2R3; 17.1 versions prior to 17.1R1-S7 17.1R2-S6 17.1R3; 17.2 versions prior to 17.2R1-S6 17.2R2-S3 17.2R3; 17.2X75 versions prior to 17.2X75-D100 17.2X75-D42 17.2X75-D91; 17.3 versions prior to 17.3R1-S4 17.3R2-S2 17.3R3; 17.4 versions prior to 17.4R1-S3 17.4R2 . No other Juniper Networks products or platforms are affected by this issue.

CVE-2018-0044

2018-10-10T14:29:00.530-04:00

2019-10-09T19:31:04.783-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 105565 CONFIRM https://kb.juniper.net/JSA10878 An insecure SSHD configuration in Juniper Device Manager (JDM) and host OS on Juniper NFX Series devices may allow remote unauthenticated access if any of the passwords on the system are empty. The affected SSHD configuration has the PermitEmptyPasswords option set to "yes". Affected releases are Juniper Networks Junos OS: 18.1 versions prior to 18.1R4 on NFX Series.

cpe:/o:juniper:junos:12.1x46 cpe:/o:juniper:junos:12.1x46:d10 cpe:/o:juniper:junos:12.1x46:d15 cpe:/o:juniper:junos:12.1x46:d20 cpe:/o:juniper:junos:12.1x46:d25 cpe:/o:juniper:junos:12.1x46:d30 cpe:/o:juniper:junos:12.1x46:d35 cpe:/o:juniper:junos:12.1x46:d40 cpe:/o:juniper:junos:12.1x46:d45 cpe:/o:juniper:junos:12.1x46:d50 cpe:/o:juniper:junos:12.1x46:d55 cpe:/o:juniper:junos:12.1x46:d60 cpe:/o:juniper:junos:12.3 cpe:/o:juniper:junos:12.3:r1 cpe:/o:juniper:junos:12.3:r11 cpe:/o:juniper:junos:12.3:r2 cpe:/o:juniper:junos:12.3:r3 cpe:/o:juniper:junos:12.3:r4 cpe:/o:juniper:junos:12.3:r5 cpe:/o:juniper:junos:12.3:r6 cpe:/o:juniper:junos:12.3:r7 cpe:/o:juniper:junos:12.3:r8 cpe:/o:juniper:junos:12.3:r9 cpe:/o:juniper:junos:12.3x48 cpe:/o:juniper:junos:12.3x48:d10 cpe:/o:juniper:junos:12.3x48:d15 cpe:/o:juniper:junos:12.3x48:d25 cpe:/o:juniper:junos:12.3x48:d30 cpe:/o:juniper:junos:12.3x48:d35 cpe:/o:juniper:junos:12.3x48:d40 cpe:/o:juniper:junos:12.3x48:d45 cpe:/o:juniper:junos:12.3x48:d50 cpe:/o:juniper:junos:12.3x48:d55 cpe:/o:juniper:junos:12.3x48:d60 cpe:/o:juniper:junos:12.3x48:d65 cpe:/o:juniper:junos:15.1 cpe:/o:juniper:junos:15.1:f3 cpe:/o:juniper:junos:15.1:f4 cpe:/o:juniper:junos:15.1:f5 cpe:/o:juniper:junos:15.1:f6 cpe:/o:juniper:junos:15.1:r1 cpe:/o:juniper:junos:15.1:r2 cpe:/o:juniper:junos:15.1:r3 cpe:/o:juniper:junos:15.1x49 cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d100 cpe:/o:juniper:junos:15.1x49:d110 cpe:/o:juniper:junos:15.1x49:d120 cpe:/o:juniper:junos:15.1x49:d130 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d55 cpe:/o:juniper:junos:15.1x49:d60 cpe:/o:juniper:junos:15.1x49:d65 cpe:/o:juniper:junos:15.1x49:d70 cpe:/o:juniper:junos:15.1x49:d75 cpe:/o:juniper:junos:15.1x49:d80 cpe:/o:juniper:junos:15.1x49:d90 cpe:/o:juniper:junos:15.1x53 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d210 cpe:/o:juniper:junos:15.1x53:d230 cpe:/o:juniper:junos:15.1x53:d231 cpe:/o:juniper:junos:15.1x53:d232 cpe:/o:juniper:junos:15.1x53:d25 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d40 cpe:/o:juniper:junos:15.1x53:d45 cpe:/o:juniper:junos:15.1x53:d490 cpe:/o:juniper:junos:15.1x53:d50 cpe:/o:juniper:junos:15.1x53:d51 cpe:/o:juniper:junos:15.1x53:d52 cpe:/o:juniper:junos:15.1x53:d55 cpe:/o:juniper:junos:15.1x53:d57 cpe:/o:juniper:junos:15.1x53:d58 cpe:/o:juniper:junos:15.1x53:d60 cpe:/o:juniper:junos:15.1x53:d61 cpe:/o:juniper:junos:15.1x53:d62 cpe:/o:juniper:junos:15.1x53:d63 cpe:/o:juniper:junos:15.1x53:d64 cpe:/o:juniper:junos:15.1x53:d65 cpe:/o:juniper:junos:15.1x53:d66 cpe:/o:juniper:junos:16.1 cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.2 cpe:/o:juniper:junos:16.2:r1 cpe:/o:juniper:junos:17.1 cpe:/o:juniper:junos:17.2 cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.2:r2 cpe:/o:juniper:junos:17.3 cpe:/o:juniper:junos:17.3:r1 cpe:/o:juniper:junos:17.4 cpe:/o:juniper:junos:18.1 cpe:/o:juniper:junos:18.1:r1

CVE-2018-0045

2018-10-10T14:29:00.670-04:00

2019-10-09T19:31:04.957-04:00

5.8

ADJACENT_NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1041848 CONFIRM https://kb.juniper.net/JSA10879 Receipt of a specific Draft-Rosen MVPN control packet may cause the routing protocol daemon (RPD) process to crash and restart or may lead to remote code execution. By continuously sending the same specific Draft-Rosen MVPN control packet, an attacker can repeatedly crash the RPD process causing a prolonged denial of service. This issue may occur when the Junos OS device is configured for Draft-Rosen multicast virtual private network (MVPN). The VPN is multicast-enabled and configured to use Protocol Independent Multicast (PIM) protocol within the VPN. This issue can only be exploited from the PE device within the MPLS domain which is capable of forwarding IP multicast traffic in core. End-users connected to the CE device cannot cause this crash. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D77 on SRX Series; 12.3 versions prior to 12.3R12-S10; 12.3X48 versions prior to 12.3X48-D70 on SRX Series; 15.1 versions prior to 15.1R4-S9, 15.1R6-S6, 15.1R7; 15.1F6; 15.1X49 versions prior to 15.1X49-D140 on SRX Series; 15.1X53 versions prior to 15.1X53-D59 on EX2300/EX3400 Series; 15.1X53 versions prior to 15.1X53-D67 on QFX10K Series; 15.1X53 versions prior to 15.1X53-D233 on QFX5200/QFX5110 Series; 15.1X53 versions prior to 15.1X53-D471, 15.1X53-D490 on NFX Series; 16.1 versions prior to 16.1R4-S9, 16.1R5-S4, 16.1R6-S3, 16.1R7; 16.2 versions prior to 16.2R1-S6, 16.2R2-S6, 16.2R3; 17.1 versions prior to 17.1R1-S7, 17.1R2-S7, 17.1R3; 17.2 versions prior to 17.2R2-S4, 17.2R3; 17.3 versions prior to 17.3R2-S2, 17.3R3; 17.4 versions prior to 17.4R1-S3, 17.4R2; 18.1 versions prior to 18.1R2. No other Juniper Networks products or platforms are affected by this issue.

cpe:/a:juniper:junos_space:18.1r1

CVE-2018-0046

2018-10-10T14:29:00.780-04:00

2019-10-09T19:31:05.440-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 105566 SECTRACK 1041862 CONFIRM https://github.com/OpenNMS/opennms/commit/8710463077c10034fcfa06556a98fb1a1a64fd0d CONFIRM https://kb.juniper.net/JSA10880 A reflected cross-site scripting vulnerability in OpenNMS included with Juniper Networks Junos Space may allow the stealing of sensitive information or session credentials from Junos Space administrators or perform administrative actions. This issue affects Juniper Networks Junos Space versions prior to 18.2R1.

CVE-2018-0047

2018-10-10T14:29:01.517-04:00

2019-10-09T19:31:05.580-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1041863 CONFIRM https://kb.juniper.net/JSA10881 A persistent cross-site scripting vulnerability in the UI framework used by Junos Space Security Director may allow authenticated users to inject persistent and malicious scripts. This may allow stealing of information or performing actions as a different user when other users access the Security Director web interface. This issue affects all versions of Juniper Networks Junos Space Security Director prior to 17.2R2.

cpe:/o:juniper:junos:17.2 cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.2x75 cpe:/o:juniper:junos:17.3 cpe:/o:juniper:junos:17.3:r1 cpe:/o:juniper:junos:17.3:r2 cpe:/o:juniper:junos:17.4 cpe:/o:juniper:junos:17.4:r1 cpe:/o:juniper:junos:18.1 cpe:/o:juniper:junos:18.1:r1

CVE-2018-0048

2018-10-10T14:29:01.873-04:00

2019-10-09T19:31:05.767-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 105564 SECTRACK 1041849 CONFIRM https://kb.juniper.net/JSA10882 A vulnerability in the Routing Protocols Daemon (RPD) with Juniper Extension Toolkit (JET) support can allow a network based unauthenticated attacker to cause a severe memory exhaustion condition on the device. This can have an adverse impact on the system performance and availability. This issue only affects devices with JET support running Junos OS 17.2R1 and subsequent releases. Other versions of Junos OS are unaffected by this vulnerability. Affected releases are Juniper Networks Junos OS: 17.2 versions prior to 17.2R1-S7, 17.2R2-S6, 17.2R3; 17.2X75 versions prior to 17.2X75-D102, 17.2X75-D110; 17.3 versions prior to 17.3R2-S4, 17.3R3; 17.4 versions prior to 17.4R1-S5, 17.4R2; 18.1 versions prior to 18.1R2-S3, 18.1R3;

cpe:/o:juniper:junos:12.1x46 cpe:/o:juniper:junos:12.1x46:d10 cpe:/o:juniper:junos:12.1x46:d15 cpe:/o:juniper:junos:12.1x46:d20 cpe:/o:juniper:junos:12.1x46:d25 cpe:/o:juniper:junos:12.1x46:d30 cpe:/o:juniper:junos:12.1x46:d35 cpe:/o:juniper:junos:12.1x46:d40 cpe:/o:juniper:junos:12.1x46:d45 cpe:/o:juniper:junos:12.1x46:d50 cpe:/o:juniper:junos:12.1x46:d55 cpe:/o:juniper:junos:12.1x46:d60 cpe:/o:juniper:junos:12.1x46:d65 cpe:/o:juniper:junos:12.1x46:d76 cpe:/o:juniper:junos:12.3:r12-s10 cpe:/o:juniper:junos:12.3x48 cpe:/o:juniper:junos:12.3x48:d10 cpe:/o:juniper:junos:12.3x48:d15 cpe:/o:juniper:junos:12.3x48:d20 cpe:/o:juniper:junos:12.3x48:d25 cpe:/o:juniper:junos:12.3x48:d30 cpe:/o:juniper:junos:12.3x48:d35 cpe:/o:juniper:junos:12.3x48:d40 cpe:/o:juniper:junos:12.3x48:d45 cpe:/o:juniper:junos:12.3x48:d50 cpe:/o:juniper:junos:12.3x48:d55 cpe:/o:juniper:junos:12.3x48:d60 cpe:/o:juniper:junos:12.3x48:d65 cpe:/o:juniper:junos:12.3x48:d66 cpe:/o:juniper:junos:12.3x48:d70 cpe:/o:juniper:junos:14.1x53:d47 cpe:/o:juniper:junos:15.1 cpe:/o:juniper:junos:15.1:f2 cpe:/o:juniper:junos:15.1:f3 cpe:/o:juniper:junos:15.1:f4 cpe:/o:juniper:junos:15.1:f5 cpe:/o:juniper:junos:15.1:f6 cpe:/o:juniper:junos:15.1:f6-s10 cpe:/o:juniper:junos:15.1:f7 cpe:/o:juniper:junos:15.1:r1 cpe:/o:juniper:junos:15.1:r2 cpe:/o:juniper:junos:15.1:r3 cpe:/o:juniper:junos:15.1:r4 cpe:/o:juniper:junos:15.1:r4-s9 cpe:/o:juniper:junos:15.1:r6 cpe:/o:juniper:junos:15.1:r6-s6 cpe:/o:juniper:junos:15.1:r7 cpe:/o:juniper:junos:15.1x49 cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d100 cpe:/o:juniper:junos:15.1x49:d110 cpe:/o:juniper:junos:15.1x49:d120 cpe:/o:juniper:junos:15.1x49:d131 cpe:/o:juniper:junos:15.1x49:d140 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d55 cpe:/o:juniper:junos:15.1x49:d60 cpe:/o:juniper:junos:15.1x49:d65 cpe:/o:juniper:junos:15.1x49:d70 cpe:/o:juniper:junos:15.1x49:d75 cpe:/o:juniper:junos:15.1x49:d80 cpe:/o:juniper:junos:15.1x49:d90 cpe:/o:juniper:junos:15.1x53 cpe:/o:juniper:junos:15.1x53:d210 cpe:/o:juniper:junos:15.1x53:d230 cpe:/o:juniper:junos:15.1x53:d231 cpe:/o:juniper:junos:15.1x53:d232 cpe:/o:juniper:junos:15.1x53:d233 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d40 cpe:/o:juniper:junos:15.1x53:d45 cpe:/o:juniper:junos:15.1x53:d471 cpe:/o:juniper:junos:15.1x53:d59 cpe:/o:juniper:junos:15.1x53:d67 cpe:/o:juniper:junos:16.1 cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.1:r3-s8 cpe:/o:juniper:junos:16.1:r4-s9 cpe:/o:juniper:junos:16.1:r5-s4 cpe:/o:juniper:junos:16.1:r6-s3 cpe:/o:juniper:junos:16.1:r7 cpe:/o:juniper:junos:16.2 cpe:/o:juniper:junos:16.2:r1 cpe:/o:juniper:junos:16.2:r1-s6 cpe:/o:juniper:junos:16.2:r2-s5 cpe:/o:juniper:junos:17.1 cpe:/o:juniper:junos:17.1:r1 cpe:/o:juniper:junos:17.1:r1-s7 cpe:/o:juniper:junos:17.1:r2-s7 cpe:/o:juniper:junos:17.2 cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.2:r1-s6 cpe:/o:juniper:junos:17.2:r2-s4 cpe:/o:juniper:junos:17.2x75 cpe:/o:juniper:junos:17.2x75:d100 cpe:/o:juniper:junos:17.2x75:d50 cpe:/o:juniper:junos:17.2x75:d90 cpe:/o:juniper:junos:17.3 cpe:/o:juniper:junos:17.3:r1 cpe:/o:juniper:junos:17.3:r1-s4 cpe:/o:juniper:junos:17.3:r2-s2 cpe:/o:juniper:junos:17.3:r3 cpe:/o:juniper:junos:17.4 cpe:/o:juniper:junos:17.4:r1 cpe:/o:juniper:junos:17.4:r1-s3 cpe:/o:juniper:junos:17.4:r2 cpe:/o:juniper:junos:18.1 cpe:/o:juniper:junos:18.1:r1 cpe:/o:juniper:junos:18.1:r2 cpe:/o:juniper:junos:18.2 cpe:/o:juniper:junos:18.2:r1 cpe:/o:juniper:junos:18.2x75 cpe:/o:juniper:junos:18.2x75:d5

CVE-2018-0049

2018-10-10T14:29:02.030-04:00

2019-10-09T19:31:05.957-04:00

7.1

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 105701 SECTRACK 1041850 CONFIRM https://kb.juniper.net/JSA10883 MISC https://kb.juniper.net/KB30092 A NULL Pointer Dereference vulnerability in Juniper Networks Junos OS allows an attacker to cause the Junos OS kernel to crash. Continued receipt of this specifically crafted malicious MPLS packet will cause a sustained Denial of Service condition. This issue require it to be received on an interface configured to receive this type of traffic. Affected releases are Juniper Networks Junos OS: 12.1X46 versions above and including 12.1X46-D76 prior to 12.1X46-D81 on SRX100, SRX110, SRX210, SRX220, SRX240m, SRX550m SRX650, SRX300, SRX320, SRX340, SRX345, SRX1500, SRX4100, SRX4200, SRX4600 and vSRX; 12.3R12-S10; 12.3X48 versions above and including 12.3X48-D66 prior to 12.3X48-D75 on SRX100, SRX110, SRX210, SRX220, SRX240m, SRX550m SRX650, SRX300, SRX320, SRX340, SRX345, SRX1500, SRX4100, SRX4200, SRX4600 and vSRX; 14.1X53-D47 on EX2200/VC, EX3200, EX3300/VC, EX4200, EX4300, EX4550/VC, EX4600, EX6200, EX8200/VC (XRE), QFX3500, QFX3600, QFX5100; 14.1X53 versions above and including 14.1X53-D115 prior to 14.1X53-D130 on QFabric System; 15.1 versions above and including 15.1F6-S10; 15.1R4-S9; 15.1R6-S6; 15.1 versions above and including 15.1R7 prior to 15.1R7-S2; 15.1X49 versions above and including 15.1X49-D131 prior to 15.1X49-D150 on SRX100, SRX110, SRX210, SRX220, SRX240m, SRX550m SRX650, SRX300, SRX320, SRX340, SRX345, SRX1500, SRX4100, SRX4200, SRX4600 and vSRX; 15.1X53 versions above 15.1X53-D233 prior to 15.1X53-D235 on QFX5200/QFX5110; 15.1X53 versions up to and including 15.1X53-D471 prior to 15.1X53-D590 on NFX150, NFX250; 15.1X53-D67 on QFX10000 Series; 15.1X53-D59 on EX2300/EX3400; 16.1 versions above and including 16.1R3-S8; 16.1 versions above and including 16.1R4-S9 prior to 16.1R4-S12; 16.1 versions above and including 16.1R5-S4; 16.1 versions above and including 16.1R6-S3 prior to 16.1R6-S6; 16.1 versions above and including 16.1R7 prior to 16.1R7-S2; 16.2 versions above and including 16.2R1-S6; 16.2 versions above and including 16.2R2-S5 prior to 16.2R2-S7; 17.1R1-S7; 17.1 versions above and including 17.1R2-S7 prior to 17.1R2-S9; 17.2R1-S6; 17.2 versions above and including 17.2R2-S4 prior to 17.2R2-S6; 17.2X75 versions above and including 17.2X75-D100 prior to X17.2X75-D101, 17.2X75-D110; 17.3 versions above and including 17.3R1-S4 on All non-SRX Series and SRX100, SRX110, SRX210, SRX220, SRX240m, SRX550m SRX650, SRX300, SRX320, SRX340, SRX345, SRX1500, SRX4100, SRX4200, SRX4600 and vSRX; 17.3 versions above and including 17.3R2-S2 prior to 17.3R2-S4 on All non-SRX Series and SRX100, SRX110, SRX210, SRX220, SRX240m, SRX550m SRX650, SRX300, SRX320, SRX340, SRX345, SRX1500, SRX4100, SRX4200, SRX4600 and vSRX; 17.3R3 on All non-SRX Series and SRX100, SRX110, SRX210, SRX220, SRX240m, SRX550m SRX650, SRX300, SRX320, SRX340, SRX345, SRX1500, SRX4100, SRX4200, SRX4600 and vSRX; 17.4 versions above and including 17.4R1-S3 prior to 17.4R1-S5 on All non-SRX Series and SRX100, SRX110, SRX210, SRX220, SRX240m, SRX550m SRX650, SRX300, SRX320, SRX340, SRX345, SRX1500, SRX4100, SRX4200, SRX4600 and vSRX; 17.4R2 on All non-SRX Series and SRX100, SRX110, SRX210, SRX220, SRX240m, SRX550m SRX650, SRX300, SRX320, SRX340, SRX345, SRX1500, SRX4100, SRX4200, SRX4600 and vSRX; 18.1 versions above and including 18.1R2 prior to 18.1R2-S3, 18.1R3 on All non-SRX Series and SRX100, SRX110, SRX210, SRX220, SRX240m, SRX550m SRX650, SRX300, SRX320, SRX340, SRX345, SRX1500, SRX4100, SRX4200, SRX4600 and vSRX; 18.2 versions above and including 18.2R1 prior to 18.2R1-S2, 18.2R1-S3, 18.2R2 on All non-SRX Series and SRX100, SRX110, SRX210, SRX220, SRX240m, SRX550m SRX650, SRX300, SRX320, SRX340, SRX345, SRX1500, SRX4100, SRX4200, SRX4600 and vSRX; 18.2X75 versions above and including 18.2X75-D5 prior to 18.2X75-D20.

CVE-2018-0050

2018-10-10T14:29:02.203-04:00

2019-10-09T19:31:07.550-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 106206 SECTRACK 1041851 CONFIRM https://kb.juniper.net/JSA10884 An error handling vulnerability in Routing Protocols Daemon (RPD) of Juniper Networks Junos OS allows an attacker to cause RPD to crash. Continued receipt of this malformed MPLS RSVP packet will cause a sustained Denial of Service condition. Affected releases are Juniper Networks Junos OS: 14.1 versions prior to 14.1R8-S5, 14.1R9; 14.1X53 versions prior to 14.1X53-D48 on QFX Switching; 14.2 versions prior to 14.1X53-D130 on QFabric System; 14.2 versions prior to 14.2R4. This issue does not affect versions of Junos OS before 14.1R1. Junos OS RSVP only supports IPv4. IPv6 is not affected by this issue. This issue require it to be received on an interface configured to receive this type of traffic.

CVE-2018-0051

2018-10-10T14:29:02.313-04:00

2019-10-09T19:31:07.783-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1041852 CONFIRM https://kb.juniper.net/JSA10885 A Denial of Service vulnerability in the SIP application layer gateway (ALG) component of Junos OS based platforms allows an attacker to crash MS-PIC, MS-MIC, MS-MPC, MS-DPC or SRX flow daemon (flowd) process. This issue affects Junos OS devices with NAT or stateful firewall configuration in combination with the SIP ALG enabled. SIP ALG is enabled by default on SRX Series devices except for SRX-HE devices. SRX-HE devices have SIP ALG disabled by default. The status of ALGs in SRX device can be obtained by executing the command: show security alg status Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D77; 12.3X48 versions prior to 12.3X48-D70; 15.1X49 versions prior to 15.1X49-D140; 15.1 versions prior to 15.1R4-S9, 15.1R7-S1; 15.1F6; 16.1 versions prior to 16.1R4-S9, 16.1R6-S1, 16.1R7; 16.2 versions prior to 16.2R2-S7, 16.2R3; 17.1 versions prior to 17.1R2-S7, 17.1R3; 17.2 versions prior to 17.2R1-S6, 17.2R2-S4, 17.2R3; 17.3 versions prior to 17.3R1-S5, 17.3R2-S2, 17.3R3; 17.4 versions prior to 17.4R2. No other Juniper Networks products or platforms are affected by this issue.

cpe:/o:juniper:junos:12.1x46 cpe:/o:juniper:junos:12.1x46:d10 cpe:/o:juniper:junos:12.1x46:d15 cpe:/o:juniper:junos:12.1x46:d20 cpe:/o:juniper:junos:12.1x46:d25 cpe:/o:juniper:junos:12.1x46:d30 cpe:/o:juniper:junos:12.1x46:d35 cpe:/o:juniper:junos:12.1x46:d40 cpe:/o:juniper:junos:12.1x46:d45 cpe:/o:juniper:junos:12.1x46:d50 cpe:/o:juniper:junos:12.1x46:d55 cpe:/o:juniper:junos:12.1x46:d60 cpe:/o:juniper:junos:12.1x46:d65 cpe:/o:juniper:junos:12.3 cpe:/o:juniper:junos:12.3:r1 cpe:/o:juniper:junos:12.3:r11 cpe:/o:juniper:junos:12.3:r2 cpe:/o:juniper:junos:12.3:r3 cpe:/o:juniper:junos:12.3:r4 cpe:/o:juniper:junos:12.3:r5 cpe:/o:juniper:junos:12.3:r6 cpe:/o:juniper:junos:12.3:r7 cpe:/o:juniper:junos:12.3:r8 cpe:/o:juniper:junos:12.3:r9 cpe:/o:juniper:junos:12.3x48 cpe:/o:juniper:junos:12.3x48:d10 cpe:/o:juniper:junos:12.3x48:d15 cpe:/o:juniper:junos:12.3x48:d20 cpe:/o:juniper:junos:12.3x48:d25 cpe:/o:juniper:junos:12.3x48:d30 cpe:/o:juniper:junos:12.3x48:d35 cpe:/o:juniper:junos:12.3x48:d40 cpe:/o:juniper:junos:12.3x48:d45 cpe:/o:juniper:junos:12.3x48:d50 cpe:/o:juniper:junos:12.3x48:d55 cpe:/o:juniper:junos:12.3x48:d60 cpe:/o:juniper:junos:12.3x48:d65 cpe:/o:juniper:junos:12.3x48:d70 cpe:/o:juniper:junos:14.1x53 cpe:/o:juniper:junos:14.1x53:d10 cpe:/o:juniper:junos:14.1x53:d121 cpe:/o:juniper:junos:14.1x53:d15 cpe:/o:juniper:junos:14.1x53:d16 cpe:/o:juniper:junos:14.1x53:d25 cpe:/o:juniper:junos:14.1x53:d26 cpe:/o:juniper:junos:14.1x53:d27 cpe:/o:juniper:junos:14.1x53:d30 cpe:/o:juniper:junos:14.1x53:d35 cpe:/o:juniper:junos:14.1x53:d40 cpe:/o:juniper:junos:14.1x53:d42 cpe:/o:juniper:junos:14.1x53:d43 cpe:/o:juniper:junos:14.1x53:d44 cpe:/o:juniper:junos:14.1x53:d45 cpe:/o:juniper:junos:14.1x53:d46 cpe:/o:juniper:junos:15.1 cpe:/o:juniper:junos:15.1:r1 cpe:/o:juniper:junos:15.1:r2 cpe:/o:juniper:junos:15.1:r3 cpe:/o:juniper:junos:15.1:r6-s6 cpe:/o:juniper:junos:15.1:r7 cpe:/o:juniper:junos:15.1x49 cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d100 cpe:/o:juniper:junos:15.1x49:d110 cpe:/o:juniper:junos:15.1x49:d120 cpe:/o:juniper:junos:15.1x49:d140 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d55 cpe:/o:juniper:junos:15.1x49:d60 cpe:/o:juniper:junos:15.1x49:d65 cpe:/o:juniper:junos:15.1x49:d70 cpe:/o:juniper:junos:15.1x49:d75 cpe:/o:juniper:junos:15.1x49:d80 cpe:/o:juniper:junos:15.1x49:d90 cpe:/o:juniper:junos:15.1x53 cpe:/o:juniper:junos:15.1x53:d10 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d210 cpe:/o:juniper:junos:15.1x53:d230 cpe:/o:juniper:junos:15.1x53:d231 cpe:/o:juniper:junos:15.1x53:d232 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d40 cpe:/o:juniper:junos:15.1x53:d45 cpe:/o:juniper:junos:15.1x53:d490 cpe:/o:juniper:junos:15.1x53:d50 cpe:/o:juniper:junos:15.1x53:d51 cpe:/o:juniper:junos:15.1x53:d52 cpe:/o:juniper:junos:15.1x53:d55 cpe:/o:juniper:junos:15.1x53:d57 cpe:/o:juniper:junos:15.1x53:d58 cpe:/o:juniper:junos:15.1x53:d60 cpe:/o:juniper:junos:15.1x53:d61 cpe:/o:juniper:junos:15.1x53:d62 cpe:/o:juniper:junos:15.1x53:d63 cpe:/o:juniper:junos:15.1x53:d64 cpe:/o:juniper:junos:15.1x53:d65 cpe:/o:juniper:junos:15.1x53:d66 cpe:/o:juniper:junos:16.1 cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.1:r4-s9 cpe:/o:juniper:junos:16.1:r5-s4 cpe:/o:juniper:junos:16.1:r6-s4 cpe:/o:juniper:junos:16.1:r7 cpe:/o:juniper:junos:16.2 cpe:/o:juniper:junos:16.2:r1 cpe:/o:juniper:junos:17.1 cpe:/o:juniper:junos:17.1:r2-s7 cpe:/o:juniper:junos:17.1:r3 cpe:/o:juniper:junos:17.2 cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.2:r2 cpe:/o:juniper:junos:17.2x75 cpe:/o:juniper:junos:17.2x75:d91 cpe:/o:juniper:junos:17.3 cpe:/o:juniper:junos:17.3:r2-s2 cpe:/o:juniper:junos:17.3:r3 cpe:/o:juniper:junos:17.4 cpe:/o:juniper:junos:17.4:r2 cpe:/o:juniper:junos:18.2x75

CVE-2018-0052

2018-10-10T14:29:02.407-04:00

2019-10-09T19:31:08.033-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1041853 CONFIRM https://kb.juniper.net/JSA10886 If RSH service is enabled on Junos OS and if the PAM authentication is disabled, a remote unauthenticated attacker can obtain root access to the device. RSH service is disabled by default on Junos. There is no documented CLI command to enable this service. However, an undocumented CLI command allows a privileged Junos user to enable RSH service and disable PAM, and hence expose the system to unauthenticated root access. When RSH is enabled, the device is listing to RSH connections on port 514. This issue is not exploitable on platforms where Junos release is based on FreeBSD 10+. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D77 on SRX Series; 12.3 versions prior to 12.3R12-S10; 12.3X48 versions prior to 12.3X48-D75 on SRX Series; 14.1X53 versions prior to 14.1X53-D47 on QFX/EX Series; 15.1 versions prior to 15.1R4-S9, 15.1R6-S6, 15.1R7; 15.1X49 versions prior to 15.1X49-D131, 15.1X49-D140 on SRX Series; 15.1X53 versions prior to 15.1X53-D59 on EX2300/EX3400 Series; 15.1X53 versions prior to 15.1X53-D67 on QFX10K Series; 15.1X53 versions prior to 15.1X53-D233 on QFX5200/QFX5110 Series; 15.1X53 versions prior to 15.1X53-D471, 15.1X53-D490 on NFX Series; 16.1 versions prior to 16.1R3-S9, 16.1R4-S9, 16.1R5-S4, 16.1R6-S4, 16.1R7; 16.2 versions prior to 16.2R2-S5; 17.1 versions prior to 17.1R1-S7, 17.1R2-S7, 17.1R3; 17.2 versions prior to 17.2R1-S6, 17.2R2-S4, 17.2R3; 17.2X75 versions prior to 17.2X75-D110, 17.2X75-D91; 17.3 versions prior to 17.3R1-S4, 17.3R2-S2, 17.3R3; 17.4 versions prior to 17.4R1-S3, 17.4R2; 18.2X75 versions prior to 18.2X75-D5.

cpe:/o:juniper:junos:15.1x49 cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d20

CVE-2018-0053

2018-10-10T14:29:02.530-04:00

2019-10-09T19:31:08.533-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1041854 CONFIRM https://kb.juniper.net/JSA10887 An authentication bypass vulnerability in the initial boot sequence of Juniper Networks Junos OS on vSRX Series may allow an attacker to gain full control of the system without authentication when the system is initially booted up. Affected releases are Juniper Networks Junos OS: 15.1X49 versions prior to 15.1X49-D30 on vSRX.

cpe:/o:juniper:junos:14.1x53 cpe:/o:juniper:junos:14.1x53:d10 cpe:/o:juniper:junos:14.1x53:d121 cpe:/o:juniper:junos:14.1x53:d15 cpe:/o:juniper:junos:14.1x53:d16 cpe:/o:juniper:junos:14.1x53:d25 cpe:/o:juniper:junos:14.1x53:d26 cpe:/o:juniper:junos:14.1x53:d27 cpe:/o:juniper:junos:14.1x53:d30 cpe:/o:juniper:junos:14.1x53:d35 cpe:/o:juniper:junos:14.1x53:d40 cpe:/o:juniper:junos:14.1x53:d42 cpe:/o:juniper:junos:14.1x53:d43 cpe:/o:juniper:junos:14.1x53:d44 cpe:/o:juniper:junos:14.1x53:d45 cpe:/o:juniper:junos:14.1x53:d46 cpe:/o:juniper:junos:15.1:f2 cpe:/o:juniper:junos:15.1:f3 cpe:/o:juniper:junos:15.1:f4 cpe:/o:juniper:junos:15.1:f5 cpe:/o:juniper:junos:15.1:f6 cpe:/o:juniper:junos:15.1:f7 cpe:/o:juniper:junos:15.1:r1 cpe:/o:juniper:junos:15.1:r2 cpe:/o:juniper:junos:15.1:r3 cpe:/o:juniper:junos:15.1:r4 cpe:/o:juniper:junos:15.1:r5 cpe:/o:juniper:junos:15.1:r6 cpe:/o:juniper:junos:15.1x53 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d210 cpe:/o:juniper:junos:15.1x53:d230 cpe:/o:juniper:junos:15.1x53:d231 cpe:/o:juniper:junos:15.1x53:d232 cpe:/o:juniper:junos:15.1x53:d25 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d40 cpe:/o:juniper:junos:15.1x53:d45 cpe:/o:juniper:junos:16.1 cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.1:r4 cpe:/o:juniper:junos:16.1:r5 cpe:/o:juniper:junos:16.1:r6 cpe:/o:juniper:junos:16.2 cpe:/o:juniper:junos:16.2:r1 cpe:/o:juniper:junos:16.2:r2 cpe:/o:juniper:junos:17.1 cpe:/o:juniper:junos:17.1:r1 cpe:/o:juniper:junos:17.2 cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.2x75 cpe:/o:juniper:junos:17.2x75:d50 cpe:/o:juniper:junos:17.3 cpe:/o:juniper:junos:17.3:r1 cpe:/o:juniper:junos:17.3:r2 cpe:/o:juniper:junos:17.4 cpe:/o:juniper:junos:17.4:r1 cpe:/o:juniper:junos:18.1 cpe:/o:juniper:junos:18.1:r1

CVE-2018-0054

2018-10-10T14:29:02.623-04:00

2019-10-09T19:31:08.690-04:00

3.3

ADJACENT_NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1041855 CONFIRM https://kb.juniper.net/JSA10888 On QFX5000 Series and EX4600 switches, a high rate of Ethernet pause frames or an ARP packet storm received on the management interface (fxp0) can cause egress interface congestion, resulting in routing protocol packet drops, such as BGP, leading to peering flaps. The following log message may also be displayed: fpc0 dcbcm_check_stuck_buffers: Buffers are stuck on queue 7 of port 45 This issue only affects the QFX5000 Series products (QFX5100, QFX5110, QFX5200, QFX5210) and the EX4600 switch. No other platforms are affected by this issue. Affected releases are Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D47 on QFX5000 Series and EX4600; 15.1 versions prior to 15.1R7, 15.1R8 on QFX5000 Series and EX4600; 15.1X53 versions prior to 15.1X53-D233 on QFX5000 Series and EX4600; 16.1 versions prior to 16.1R7 on QFX5000 Series and EX4600; 16.2 versions prior to 16.2R3 on QFX5000 Series and EX4600; 17.1 versions prior to 17.1R2-S9, 17.1R3 on QFX5000 Series and EX4600; 17.2 versions prior to 17.2R2-S6, 17.2R3 on QFX5000 Series and EX4600; 17.2X75 versions prior to 17.2X75-D42 on QFX5000 Series and EX4600; 17.3 versions prior to 17.3R3 on QFX5000 Series and EX4600; 17.4 versions prior to 17.4R2 on QFX5000 Series and EX4600; 18.1 versions prior to 18.1R2 on QFX5000 Series and EX4600.

cpe:/o:juniper:junos:15.1 cpe:/o:juniper:junos:15.1:f2 cpe:/o:juniper:junos:15.1:f3 cpe:/o:juniper:junos:15.1:f4 cpe:/o:juniper:junos:15.1:f5 cpe:/o:juniper:junos:15.1:f6 cpe:/o:juniper:junos:15.1:f7 cpe:/o:juniper:junos:15.1:r1 cpe:/o:juniper:junos:15.1:r2 cpe:/o:juniper:junos:15.1:r3 cpe:/o:juniper:junos:15.1:r6 cpe:/o:juniper:junos:15.1x49 cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d100 cpe:/o:juniper:junos:15.1x49:d110 cpe:/o:juniper:junos:15.1x49:d120 cpe:/o:juniper:junos:15.1x49:d140 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d55 cpe:/o:juniper:junos:15.1x49:d60 cpe:/o:juniper:junos:15.1x49:d65 cpe:/o:juniper:junos:15.1x49:d70 cpe:/o:juniper:junos:15.1x49:d75 cpe:/o:juniper:junos:15.1x49:d80 cpe:/o:juniper:junos:15.1x49:d90 cpe:/o:juniper:junos:15.1x53 cpe:/o:juniper:junos:15.1x53:d10 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d210 cpe:/o:juniper:junos:15.1x53:d230 cpe:/o:juniper:junos:15.1x53:d231 cpe:/o:juniper:junos:15.1x53:d232 cpe:/o:juniper:junos:15.1x53:d233 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d40 cpe:/o:juniper:junos:15.1x53:d45 cpe:/o:juniper:junos:15.1x53:d50 cpe:/o:juniper:junos:15.1x53:d51 cpe:/o:juniper:junos:15.1x53:d52 cpe:/o:juniper:junos:15.1x53:d55 cpe:/o:juniper:junos:15.1x53:d57 cpe:/o:juniper:junos:15.1x53:d58 cpe:/o:juniper:junos:15.1x53:d59 cpe:/o:juniper:junos:15.1x53:d60 cpe:/o:juniper:junos:15.1x53:d62 cpe:/o:juniper:junos:15.1x53:d63 cpe:/o:juniper:junos:15.1x53:d64 cpe:/o:juniper:junos:15.1x53:d65 cpe:/o:juniper:junos:15.1x53:d66 cpe:/o:juniper:junos:15.1x53:d67 cpe:/o:juniper:junos:16.1 cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.2 cpe:/o:juniper:junos:16.2:r1 cpe:/o:juniper:junos:17.1 cpe:/o:juniper:junos:17.1:r1 cpe:/o:juniper:junos:17.2 cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.3 cpe:/o:juniper:junos:17.3:r1 cpe:/o:juniper:junos:17.3:r2 cpe:/o:juniper:junos:17.4 cpe:/o:juniper:junos:18.2 cpe:/o:juniper:junos:18.2x75

CVE-2018-0055

2018-10-10T14:29:02.750-04:00

2019-10-09T19:31:09.097-04:00

2.9

ADJACENT_NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1041856 CONFIRM https://kb.juniper.net/JSA10889 Receipt of a specially crafted DHCPv6 message destined to a Junos OS device configured as a DHCP server in a Broadband Edge (BBE) environment may result in a jdhcpd daemon crash. The daemon automatically restarts without intervention, but a continuous receipt of crafted DHCPv6 packets could leaded to an extended denial of service condition. This issue only affects Junos OS 15.1 and later. Earlier releases are unaffected by this issue. Devices are only vulnerable to the specially crafted DHCPv6 message if DHCP services are configured. Devices not configured to act as a DHCP server are not vulnerable to this issue. Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1R7-S2; 15.1X49 versions prior to 15.1X49-D160; 15.1X53 versions prior to 15.1X53-D235, 15.1X53-D495; 16.1 versions prior to 16.1R4-S11, 16.1R6-S6, 16.1R7-S2; 16.2 versions prior to 16.2R2-S7; 17.1 versions prior to 17.1R2-S9; 17.2 versions prior to 17.2R2-S6; 17.3 versions prior to 17.3R3-S1; 17.4 versions prior to 17.4R1-S5; 18.1 versions prior to 18.1R2-S3; 18.2 versions prior to 18.2R1-S2; 18.2X75 versions prior to 18.2X75-D20.

CVE-2018-0056

2018-10-10T14:29:02.873-04:00

2019-10-09T19:31:09.363-04:00

2.9

ADJACENT_NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1041857 CONFIRM https://kb.juniper.net/JSA10890 If a duplicate MAC address is learned by two different interfaces on an MX Series device, the MAC address learning function correctly flaps between the interfaces. However, the Layer 2 Address Learning Daemon (L2ALD) daemon might crash when attempting to delete the duplicate MAC address when the particular entry is not found in the internal MAC address table. This issue only occurs on MX Series devices with l2-backhaul VPN configured. No other products or platforms are affected by this issue. Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1R7-S1 on MX Series; 16.1 versions prior to 16.1R4-S12, 16.1R6-S6 on MX Series; 16.2 versions prior to 16.2R2-S7 on MX Series; 17.1 versions prior to 17.1R2-S9 on MX Series; 17.2 versions prior to 17.2R1-S7, 17.2R2-S6 on MX Series; 17.3 versions prior to 17.3R2-S4, 17.3R3-S1 on MX Series; 17.4 versions prior to 17.4R1-S5 on MX Series; 18.1 versions prior to 18.1R2 on MX Series.

CVE-2018-0057

2018-10-10T14:29:02.983-04:00

2019-10-09T19:31:09.567-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://kb.juniper.net/JSA10892 On MX Series and M120/M320 platforms configured in a Broadband Edge (BBE) environment, subscribers logging in with DHCP Option 50 to request a specific IP address will be assigned the requested IP address, even if there is a static MAC to IP address binding in the access profile. In the problem scenario, with a hardware-address and IP address configured under address-assignment pool, if a subscriber logging in with DHCP Option 50, the subscriber will not be assigned an available address from the matched pool, but will still get the requested IP address. A malicious DHCP subscriber may be able to utilize this vulnerability to create duplicate IP address assignments, leading to a denial of service for valid subscribers or unauthorized information disclosure via IP address assignment spoofing. Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1R7-S2, 15.1R8; 16.1 versions prior to 16.1R4-S12, 16.1R7-S2, 16.1R8; 16.2 versions prior to 16.2R2-S7, 16.2R3; 17.1 versions prior to 17.1R2-S9, 17.1R3; 17.2 versions prior to 17.2R1-S7, 17.2R2-S6, 17.2R3; 17.3 versions prior to 17.3R2-S4, 17.3R3; 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R2-S3, 18.1R3.

CVE-2018-0058

2018-10-10T14:29:03.077-04:00

2019-10-09T19:31:09.770-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM https://kb.juniper.net/JSA10893 MISC https://kb.juniper.net/KB31899 Receipt of a specially crafted IPv6 exception packet may be able to trigger a kernel crash (vmcore), causing the device to reboot. The issue is specific to the processing of Broadband Edge (BBE) client route processing on MX Series subscriber management platforms, introduced by the Tomcat (Next Generation Subscriber Management) functionality in Junos OS 15.1. This issue affects no other platforms or configurations. Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1R7-S2, 15.1R8 on MX Series; 16.1 versions prior to 16.1R4-S11, 16.1R7-S2, 16.1R8 on MX Series; 16.2 versions prior to 16.2R3 on MX Series; 17.1 versions prior to 17.1R2-S9, 17.1R3 on MX Series; 17.2 versions prior to 17.2R2-S6, 17.2R3 on MX Series; 17.3 versions prior to 17.3R2-S4, 17.3R3-S2, 17.3R4 on MX Series; 17.4 versions prior to 17.4R2 on MX Series; 18.1 versions prior to 18.1R2-S3, 18.1R3 on MX Series; 18.2 versions prior to 18.2R1-S1, 18.2R2 on MX Series.

cpe:/o:juniper:netscreen_screenos:6.3.0 cpe:/o:juniper:netscreen_screenos:6.3.0r1 cpe:/o:juniper:netscreen_screenos:6.3.0r2 cpe:/o:juniper:netscreen_screenos:6.3.0r3 cpe:/o:juniper:netscreen_screenos:6.3.0r4 cpe:/o:juniper:netscreen_screenos:6.3.0r5 cpe:/o:juniper:netscreen_screenos:6.3.0r6 cpe:/o:juniper:netscreen_screenos:6.3.0r7 cpe:/o:juniper:netscreen_screenos:6.3.0r8 cpe:/o:juniper:netscreen_screenos:6.3.0r9 cpe:/o:juniper:netscreen_screenos:6.3.0r10 cpe:/o:juniper:netscreen_screenos:6.3.0r11 cpe:/o:juniper:netscreen_screenos:6.3.0r12 cpe:/o:juniper:netscreen_screenos:6.3.0r13 cpe:/o:juniper:netscreen_screenos:6.3.0r14 cpe:/o:juniper:netscreen_screenos:6.3.0r15 cpe:/o:juniper:netscreen_screenos:6.3.0r16 cpe:/o:juniper:netscreen_screenos:6.3.0r17 cpe:/o:juniper:netscreen_screenos:6.3.0r18 cpe:/o:juniper:netscreen_screenos:6.3.0r19 cpe:/o:juniper:netscreen_screenos:6.3.0r21 cpe:/o:juniper:netscreen_screenos:6.3.0r22 cpe:/o:juniper:netscreen_screenos:6.3.0r23 cpe:/o:juniper:netscreen_screenos:6.3.0r23b1 cpe:/o:juniper:netscreen_screenos:6.3.0r24 cpe:/o:juniper:netscreen_screenos:6.3.0r24b1 cpe:/o:juniper:netscreen_screenos:6.3.0r25

CVE-2018-0059

2018-10-10T14:29:03.250-04:00

2019-10-09T19:31:09.973-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM https://kb.juniper.net/JSA10894 A persistent cross-site scripting vulnerability in the graphical user interface of ScreenOS may allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. Affected releases are Juniper Networks ScreenOS 6.3.0 versions prior to 6.3.0r26.

CVE-2018-0060

2018-10-10T14:29:03.373-04:00

2019-10-09T19:31:10.143-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1041858 CONFIRM https://kb.juniper.net/JSA10895 An improper input validation weakness in the device control daemon process (dcd) of Juniper Networks Junos OS allows an attacker to cause a Denial of Service to the dcd process and interfaces and connected clients when the Junos device is requesting an IP address for itself. Junos devices are not vulnerable to this issue when not configured to use DHCP. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D40 on SRX Series; 12.3X48 versions prior to 12.3X48-D20 on SRX Series; 14.1X53 versions prior to 14.1X53-D40 on EX2200/VC, EX3200, EX3300/VC, EX4200, EX4300, EX4550/VC, EX4600, EX6200, EX8200/VC (XRE), QFX3500, QFX3600, QFX5100; 15.1X49 versions prior to 15.1X49-D20 on SRX Series; 15.1X53 versions prior to 15.1X53-D68 on QFX10000 Series; 15.1X53 versions prior to 15.1X53-D235 on QFX5200/QFX5110; 15.1X53 versions prior to 15.1X53-D495 on NFX150, NFX250; 15.1X53 versions prior to 15.1X53-D590 on EX2300/EX3400; 15.1 versions prior to 15.1R7-S2.

cpe:/o:juniper:junos:12.1x46 cpe:/o:juniper:junos:12.1x46:d10 cpe:/o:juniper:junos:12.1x46:d15 cpe:/o:juniper:junos:12.1x46:d20 cpe:/o:juniper:junos:12.1x46:d25 cpe:/o:juniper:junos:12.1x46:d30 cpe:/o:juniper:junos:12.1x46:d35 cpe:/o:juniper:junos:12.1x46:d40 cpe:/o:juniper:junos:12.1x46:d45 cpe:/o:juniper:junos:12.1x46:d50 cpe:/o:juniper:junos:12.1x46:d55 cpe:/o:juniper:junos:12.1x46:d60 cpe:/o:juniper:junos:12.1x46:d65 cpe:/o:juniper:junos:12.3 cpe:/o:juniper:junos:12.3:r1 cpe:/o:juniper:junos:12.3:r11 cpe:/o:juniper:junos:12.3:r2 cpe:/o:juniper:junos:12.3:r3 cpe:/o:juniper:junos:12.3:r4 cpe:/o:juniper:junos:12.3:r5 cpe:/o:juniper:junos:12.3:r6 cpe:/o:juniper:junos:12.3:r7 cpe:/o:juniper:junos:12.3:r8 cpe:/o:juniper:junos:12.3:r9 cpe:/o:juniper:junos:12.3x48 cpe:/o:juniper:junos:12.3x48:d10 cpe:/o:juniper:junos:12.3x48:d15 cpe:/o:juniper:junos:12.3x48:d20 cpe:/o:juniper:junos:12.3x48:d25 cpe:/o:juniper:junos:12.3x48:d30 cpe:/o:juniper:junos:12.3x48:d35 cpe:/o:juniper:junos:12.3x48:d40 cpe:/o:juniper:junos:12.3x48:d45 cpe:/o:juniper:junos:12.3x48:d50 cpe:/o:juniper:junos:12.3x48:d55 cpe:/o:juniper:junos:12.3x48:d60 cpe:/o:juniper:junos:12.3x48:d65 cpe:/o:juniper:junos:12.3x48:d70 cpe:/o:juniper:junos:12.3x48:d75 cpe:/o:juniper:junos:15.1 cpe:/o:juniper:junos:15.1:f2 cpe:/o:juniper:junos:15.1:f3 cpe:/o:juniper:junos:15.1:f4 cpe:/o:juniper:junos:15.1:f5 cpe:/o:juniper:junos:15.1:f6 cpe:/o:juniper:junos:15.1:f7 cpe:/o:juniper:junos:15.1:r1 cpe:/o:juniper:junos:15.1:r2 cpe:/o:juniper:junos:15.1:r3 cpe:/o:juniper:junos:15.1:r6 cpe:/o:juniper:junos:15.1x49 cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d100 cpe:/o:juniper:junos:15.1x49:d110 cpe:/o:juniper:junos:15.1x49:d120 cpe:/o:juniper:junos:15.1x49:d140 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d55 cpe:/o:juniper:junos:15.1x49:d60 cpe:/o:juniper:junos:15.1x49:d65 cpe:/o:juniper:junos:15.1x49:d70 cpe:/o:juniper:junos:15.1x49:d75 cpe:/o:juniper:junos:15.1x49:d80 cpe:/o:juniper:junos:15.1x49:d90 cpe:/o:juniper:junos:15.1x53 cpe:/o:juniper:junos:15.1x53:d10 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d210 cpe:/o:juniper:junos:15.1x53:d230 cpe:/o:juniper:junos:15.1x53:d231 cpe:/o:juniper:junos:15.1x53:d232 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d40 cpe:/o:juniper:junos:15.1x53:d45 cpe:/o:juniper:junos:15.1x53:d490 cpe:/o:juniper:junos:15.1x53:d50 cpe:/o:juniper:junos:15.1x53:d51 cpe:/o:juniper:junos:15.1x53:d52 cpe:/o:juniper:junos:15.1x53:d55 cpe:/o:juniper:junos:15.1x53:d57 cpe:/o:juniper:junos:15.1x53:d58 cpe:/o:juniper:junos:15.1x53:d60 cpe:/o:juniper:junos:15.1x53:d61 cpe:/o:juniper:junos:15.1x53:d62 cpe:/o:juniper:junos:15.1x53:d63 cpe:/o:juniper:junos:15.1x53:d64 cpe:/o:juniper:junos:15.1x53:d65 cpe:/o:juniper:junos:15.1x53:d66 cpe:/o:juniper:junos:16.1 cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.1:r4 cpe:/o:juniper:junos:16.1:r5 cpe:/o:juniper:junos:16.2 cpe:/o:juniper:junos:16.2:r1 cpe:/o:juniper:junos:17.1 cpe:/o:juniper:junos:17.1:r1 cpe:/o:juniper:junos:17.2 cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.2x75 cpe:/o:juniper:junos:17.2x75:d50 cpe:/o:juniper:junos:17.2x75:d90 cpe:/o:juniper:junos:17.3 cpe:/o:juniper:junos:17.3:r1 cpe:/o:juniper:junos:17.4 cpe:/o:juniper:junos:18.2x75

CVE-2018-0061

2018-10-10T14:29:03.483-04:00

2019-10-09T19:31:10.457-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1041859 CONFIRM https://kb.juniper.net/JSA10896 A denial of service vulnerability in the telnetd service on Junos OS allows remote unauthenticated users to cause high CPU usage which may affect system performance. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D81 on SRX Series; 12.3 versions prior to 12.3R12-S11; 12.3X48 versions prior to 12.3X48-D80 on SRX Series; 15.1 versions prior to 15.1R7; 15.1X49 versions prior to 15.1X49-D150, 15.1X49-D160 on SRX Series; 15.1X53 versions prior to 15.1X53-D59 on EX2300/EX3400 Series; 15.1X53 versions prior to 15.1X53-D68 on QFX10K Series; 15.1X53 versions prior to 15.1X53-D235 on QFX5200/QFX5110 Series; 15.1X53 versions prior to 15.1X53-D495 on NFX Series; 16.1 versions prior to 16.1R4-S12, 16.1R6-S6, 16.1R7; 16.2 versions prior to 16.2R2-S7, 16.2R3; 17.1 versions prior to 17.1R2-S9, 17.1R3; 17.2 versions prior to 17.2R2-S6, 17.2R3; 17.2X75 versions prior to 17.2X75-D100; 17.3 versions prior to 17.3R2-S4, 17.3R3; 17.4 versions prior to 17.4R1-S5, 17.4R2; 18.2X75 versions prior to 18.2X75-D5.

cpe:/o:juniper:junos:12.1x46 cpe:/o:juniper:junos:12.1x46:d10 cpe:/o:juniper:junos:12.1x46:d15 cpe:/o:juniper:junos:12.1x46:d20 cpe:/o:juniper:junos:12.1x46:d25 cpe:/o:juniper:junos:12.1x46:d30 cpe:/o:juniper:junos:12.1x46:d35 cpe:/o:juniper:junos:12.1x46:d40 cpe:/o:juniper:junos:12.1x46:d45 cpe:/o:juniper:junos:12.1x46:d50 cpe:/o:juniper:junos:12.1x46:d55 cpe:/o:juniper:junos:12.1x46:d60 cpe:/o:juniper:junos:12.1x46:d65 cpe:/o:juniper:junos:12.3 cpe:/o:juniper:junos:12.3:r1 cpe:/o:juniper:junos:12.3:r11 cpe:/o:juniper:junos:12.3:r2 cpe:/o:juniper:junos:12.3:r3 cpe:/o:juniper:junos:12.3:r4 cpe:/o:juniper:junos:12.3:r5 cpe:/o:juniper:junos:12.3:r6 cpe:/o:juniper:junos:12.3:r7 cpe:/o:juniper:junos:12.3:r8 cpe:/o:juniper:junos:12.3:r9 cpe:/o:juniper:junos:12.3x48 cpe:/o:juniper:junos:12.3x48:d10 cpe:/o:juniper:junos:12.3x48:d15 cpe:/o:juniper:junos:12.3x48:d20 cpe:/o:juniper:junos:12.3x48:d25 cpe:/o:juniper:junos:12.3x48:d30 cpe:/o:juniper:junos:12.3x48:d35 cpe:/o:juniper:junos:12.3x48:d40 cpe:/o:juniper:junos:12.3x48:d45 cpe:/o:juniper:junos:12.3x48:d50 cpe:/o:juniper:junos:12.3x48:d55 cpe:/o:juniper:junos:12.3x48:d60 cpe:/o:juniper:junos:15.1 cpe:/o:juniper:junos:15.1:f2 cpe:/o:juniper:junos:15.1:f3 cpe:/o:juniper:junos:15.1:f4 cpe:/o:juniper:junos:15.1:f5 cpe:/o:juniper:junos:15.1:f6 cpe:/o:juniper:junos:15.1:f7 cpe:/o:juniper:junos:15.1:r1 cpe:/o:juniper:junos:15.1:r2 cpe:/o:juniper:junos:15.1:r3 cpe:/o:juniper:junos:15.1:r4 cpe:/o:juniper:junos:15.1:r5 cpe:/o:juniper:junos:15.1:r6 cpe:/o:juniper:junos:15.1x49 cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d100 cpe:/o:juniper:junos:15.1x49:d110 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d55 cpe:/o:juniper:junos:15.1x49:d60 cpe:/o:juniper:junos:15.1x49:d65 cpe:/o:juniper:junos:15.1x49:d70 cpe:/o:juniper:junos:15.1x49:d75 cpe:/o:juniper:junos:15.1x49:d80 cpe:/o:juniper:junos:15.1x49:d90 cpe:/o:juniper:junos:15.1x53 cpe:/o:juniper:junos:15.1x53:d10 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d210 cpe:/o:juniper:junos:15.1x53:d230 cpe:/o:juniper:junos:15.1x53:d231 cpe:/o:juniper:junos:15.1x53:d232 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d40 cpe:/o:juniper:junos:15.1x53:d45 cpe:/o:juniper:junos:15.1x53:d495 cpe:/o:juniper:junos:15.1x53:d50 cpe:/o:juniper:junos:15.1x53:d51 cpe:/o:juniper:junos:15.1x53:d52 cpe:/o:juniper:junos:15.1x53:d55 cpe:/o:juniper:junos:15.1x53:d57 cpe:/o:juniper:junos:15.1x53:d58 cpe:/o:juniper:junos:15.1x53:d60 cpe:/o:juniper:junos:15.1x53:d61 cpe:/o:juniper:junos:15.1x53:d62 cpe:/o:juniper:junos:15.1x53:d63 cpe:/o:juniper:junos:15.1x53:d64 cpe:/o:juniper:junos:15.1x53:d65 cpe:/o:juniper:junos:15.1x53:d66 cpe:/o:juniper:junos:16.1 cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.1:r4 cpe:/o:juniper:junos:16.1:r5 cpe:/o:juniper:junos:16.2 cpe:/o:juniper:junos:16.2:r1 cpe:/o:juniper:junos:16.2:r3 cpe:/o:juniper:junos:17.1 cpe:/o:juniper:junos:17.1:r1 cpe:/o:juniper:junos:17.1:r3 cpe:/o:juniper:junos:17.2 cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.2:r2 cpe:/o:juniper:junos:17.3 cpe:/o:juniper:junos:17.3:r1

CVE-2018-0062

2018-10-10T14:29:03.593-04:00

2019-10-09T19:31:10.817-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1041860 CONFIRM https://kb.juniper.net/JSA10897 A Denial of Service vulnerability in J-Web service may allow a remote unauthenticated user to cause Denial of Service which may prevent other users to authenticate or to perform J-Web operations. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D77 on SRX Series; 12.3 versions prior to 12.3R12-S10; 12.3X48 versions prior to 12.3X48-D60 on SRX Series; 15.1 versions prior to 15.1R7; 15.1F6; 15.1X49 versions prior to 15.1X49-D120 on SRX Series; 15.1X53 versions prior to 15.1X53-D59 on EX2300/EX3400 Series; 15.1X53 versions prior to 15.1X53-D67 on QFX10K Series; 15.1X53 versions prior to 15.1X53-D234 on QFX5200/QFX5110 Series; 15.1X53 versions prior to 15.1X53-D470, 15.1X53-D495 on NFX Series; 16.1 versions prior to 16.1R6; 16.2 versions prior to 16.2R2-S6, 16.2R3; 17.1 versions prior to 17.1R2-S6, 17.1R3; 17.2 versions prior to 17.2R3; 17.3 versions prior to 17.3R2. No other Juniper Networks products or platforms are affected by this issue.

cpe:/o:juniper:junos:17.3r3

CVE-2018-0063

2018-10-10T14:29:03.703-04:00

2019-10-09T19:31:11.160-04:00

3.3

ADJACENT_NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1041861 CONFIRM https://kb.juniper.net/JSA10899 A vulnerability in the IP next-hop index database in Junos OS 17.3R3 may allow a flood of ARP requests, sent to the management interface, to exhaust the private Internal routing interfaces (IRIs) next-hop limit. Once the IRI next-hop database is full, no further next hops can be learned and existing entries cannot be cleared, leading to a sustained denial of service (DoS) condition. An indicator of compromise for this issue is the report of the following error message: %KERN-4: Nexthop index allocation failed: private index space exhausted This issue only affects the management interface, and does not impact regular transit traffic through the FPCs. This issue also only affects Junos OS 17.3R3. No prior versions of Junos OS are affected by this issue. Affected releases are Juniper Networks Junos OS: 17.3R3.

cpe:/a:cisco:unified_customer_voice_portal:11.5

CVE-2018-0086

2018-01-18T01:29:00.317-05:00

2019-10-09T19:31:12.097-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 102745 SECTRACK 1040220 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-cvp A vulnerability in the application server of the Cisco Unified Customer Voice Portal (CVP) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the affected device. The vulnerability is due to malformed SIP INVITE traffic received on the CVP during communications with the Cisco Virtualized Voice Browser (VVB). An attacker could exploit this vulnerability by sending malformed SIP INVITE traffic to the targeted appliance. An exploit could allow the attacker to impact the availability of services and data on the device, causing a DoS condition. This vulnerability affects Cisco Unified CVP running any software release prior to 11.6(1). Cisco Bug IDs: CSCve85840.

cpe:/o:cisco:asyncos:10.5.1-296

CVE-2018-0087

2018-03-08T02:29:00.223-05:00

2019-10-09T19:31:12.223-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 103407 SECTRACK 1040464 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-wsa A vulnerability in the FTP server of the Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to log in to the FTP server of the device without a valid password. The attacker does need to have a valid username. The vulnerability is due to incorrect FTP user credential validation. An attacker could exploit this vulnerability by using FTP to connect to the management IP address of the targeted device. A successful exploit could allow the attacker to log in to the FTP server of the Cisco WSA without having a valid password. This vulnerability affects Cisco AsyncOS for WSA Software on both virtual and hardware appliances that are running any release of Cisco AsyncOS 10.5.1 for WSA Software. The device is vulnerable only if FTP is enabled on the management interface. FTP is disabled by default. Cisco Bug IDs: CSCvf74281.

cpe:/o:cisco:industrial_ethernet_4010_series_firmware

CVE-2018-0088

2018-01-18T01:29:00.377-05:00

2019-10-09T19:31:12.377-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1040240 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-iess A vulnerability in one of the diagnostic test CLI commands on Cisco Industrial Ethernet 4010 Series Switches running Cisco IOS Software could allow an authenticated, local attacker to impact the stability of the device. This could result in arbitrary code execution or a denial of service (DoS) condition. The attacker has to have valid user credentials at privilege level 15. The vulnerability is due to a diagnostic test CLI command that allows the attacker to write to the device memory. An attacker could exploit this vulnerability by authenticating to the targeted device and issuing a specific diagnostic test command at the CLI. An exploit could allow the attacker to overwrite system memory locations, which could have a negative impact on the stability of the device. Cisco Bug IDs: CSCvf71150.

cpe:/a:cisco:policy_suite:10.0.0 cpe:/a:cisco:policy_suite:11.0.0 cpe:/a:cisco:policy_suite:11.1.0

CVE-2018-0089

2018-01-18T01:29:00.440-05:00

2019-10-09T19:31:12.503-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 102758 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-cps A vulnerability in the Policy and Charging Rules Function (PCRF) of the Cisco Policy Suite (CPS) could allow an unauthenticated, remote attacker to access sensitive data. The attacker could use this information to conduct additional reconnaissance attacks. The attacker would also have to have access to the internal VLAN where CPS is deployed. The vulnerability is due to incorrect permissions of certain system files and not sufficiently protecting sensitive data that is at rest. An attacker could exploit the vulnerability by using certain tools available on the internal network interface to request and view system files. An exploit could allow the attacker to find out sensitive information about the application. Cisco Bug IDs: CSCvf77666.

cpe:/o:cisco:nx-os:7.3%282%29n1%280.6%29 cpe:/o:cisco:nx-os:8.3%280%29kms%280.31%29 cpe:/o:cisco:nx-os:8.8%283.5%29s0

CVE-2018-0090

2018-01-18T01:29:00.470-05:00

2019-10-09T19:31:12.627-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 102753 SECTRACK 1040247 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-nxos A vulnerability in management interface access control list (ACL) configuration of Cisco NX-OS System Software could allow an unauthenticated, remote attacker to bypass configured ACLs on the management interface. This could allow traffic to be forwarded to the NX-OS CPU for processing, leading to high CPU utilization and a denial of service (DoS) condition. The vulnerability is due to a bad code fix in the 7.3.2 code train that could allow traffic to the management interface to be misclassified and not match the proper configured ACLs. An attacker could exploit this vulnerability by sending crafted traffic to the management interface. An exploit could allow the attacker to bypass the configured management interface ACLs and impact the CPU of the targeted device, resulting in a DoS condition. This vulnerability affects the following Cisco products running Cisco NX-OS System Software: Multilayer Director Switches, Nexus 2000 Series Switches, Nexus 3000 Series Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Switches in standalone NX-OS mode. Cisco Bug IDs: CSCvf31132.

cpe:/a:cisco:identity_services_engine

CVE-2018-0091

2018-01-18T01:29:00.533-05:00

2019-10-09T19:31:12.753-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 102756 SECTRACK 1040241 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-ise A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a Document Object Model (DOM) cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvf73922.

cpe:/o:cisco:nx-os:7.0%283%29i5%282%29 cpe:/o:cisco:nx-os:7.0%283%29i6%281%29 cpe:/o:cisco:nx-os:7.0%283%29i7%281%29

CVE-2018-0092

2018-01-18T01:29:00.597-05:00

2019-10-09T19:31:12.877-04:00

3.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 102750 SECTRACK 1040248 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-nxos1 A vulnerability in the network-operator user role implementation for Cisco NX-OS System Software could allow an authenticated, local attacker to improperly delete valid user accounts. The network-operator role should not be able to delete other configured users on the device. The vulnerability is due to a lack of proper role-based access control (RBAC) checks for the actions that a user with the network-operator role is allowed to perform. An attacker could exploit this vulnerability by authenticating to the device with user credentials that give that user the network-operator role. Successful exploitation could allow the attacker to impact the integrity of the device by deleting configured user credentials. The attacker would need valid user credentials for the device. This vulnerability affects the following Cisco products running Cisco NX-OS System Software: Nexus 3000 Series Switches, Nexus 3600 Platform Switches, Nexus 9000 Series Switches in standalone NX-OS mode, Nexus 9500 R-Series Line Cards and Fabric Modules. Cisco Bug IDs: CSCvg21120.

cpe:/a:cisco:web_security_appliance

CVE-2018-0093

2018-01-18T01:29:00.660-05:00

2019-10-09T19:31:13.020-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 102735 SECTRACK 1040250 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-wsa1 A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvf37392.

cpe:/a:cisco:unified_computing_system_central_software:1.4%281a%29

CVE-2018-0094

2018-01-18T01:29:00.707-05:00

2019-10-09T19:31:13.143-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 102787 SECTRACK 1040249 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-ucs A vulnerability in IPv6 ingress packet processing for Cisco UCS Central Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition due to high CPU utilization on the targeted device. The vulnerability is due to insufficient rate limiting protection for IPv6 ingress traffic. An attacker could exploit this vulnerability by sending the affected device a high rate of IPv6 packets. Successful exploitation could allow the attacker to cause a DoS condition due to CPU and resource constraints. Cisco Bug IDs: CSCuv34544.

cpe:/o:cisco:asyncos:9.1.1-005 cpe:/o:cisco:asyncos:9.7.2-065

CVE-2018-0095

2018-01-18T01:29:00.753-05:00

2019-10-09T19:31:13.270-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 102729 SECTRACK 1040221 SECTRACK 1040222 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-esasma A vulnerability in the administrative shell of Cisco AsyncOS on Cisco Email Security Appliance (ESA) and Content Security Management Appliance (SMA) could allow an authenticated, local attacker to escalate their privilege level and gain root access. The attacker has to have a valid user credential with at least a privilege level of a guest user. The vulnerability is due to an incorrect networking configuration at the administrative shell CLI. An attacker could exploit this vulnerability by authenticating to the targeted device and issuing a set of crafted, malicious commands at the administrative shell. An exploit could allow the attacker to gain root access on the device. Cisco Bug IDs: CSCvb34303, CSCvb35726.

cpe:/a:cisco:prime_infrastructure:3.2%280.0%29 cpe:/a:cisco:prime_infrastructure:3.3%280.0%29

CVE-2018-0096

2018-01-18T01:29:00.817-05:00

2019-10-09T19:31:13.377-04:00

4.9

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov BID 102727 SECTRACK 1040242 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-cpi A vulnerability in the role-based access control (RBAC) functionality of Cisco Prime Infrastructure could allow an authenticated, remote attacker to perform a privilege escalation in which one virtual domain user can view and modify another virtual domain configuration. The vulnerability is due to a failure to properly enforce RBAC for virtual domains. An attacker could exploit this vulnerability by sending an authenticated, crafted HTTP request to a targeted application. An exploit could allow the attacker to bypass RBAC policies on the targeted system to modify a virtual domain and access resources that are not normally accessible. Cisco Bug IDs: CSCvg36875.

cpe:/a:cisco:prime_infrastructure

CVE-2018-0097

2018-01-18T01:29:00.877-05:00

2019-10-09T19:31:13.503-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 102724 SECTRACK 1040243 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-prime-infrastructure A vulnerability in the web interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to redirect a user to a malicious web page, aka an Open Redirect. The vulnerability is due to improper input validation of the parameters in the HTTP request. An attacker could exploit this vulnerability by crafting an HTTP request that could cause the web application to redirect the request to a specific malicious URL. This vulnerability is known as an open redirect attack and is used in phishing attacks to get users to visit malicious sites without their knowledge. Cisco Bug IDs: CSCve37646.

cpe:/o:cisco:wap150_firmware:- cpe:/o:cisco:wap361_firmware:-

CVE-2018-0098

2018-01-18T01:29:00.940-05:00

2019-10-09T19:31:13.627-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 102763 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-wap A vulnerability in the web-based management interface of Cisco WAP150 Wireless-AC/N Dual Radio Access Point with Power over Ethernet (PoE) and WAP361 Wireless-AC/N Dual Radio Wall Plate Access Point with PoE could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCve57076.

cpe:/o:cisco:d9800_firmware:-

CVE-2018-0099

2018-01-18T01:29:01.003-05:00

2019-10-09T19:31:13.753-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov BID 102731 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-ntr A vulnerability in the web management GUI of the Cisco D9800 Network Transport Receiver could allow an authenticated, remote attacker to perform a command injection attack. The vulnerability is due to insufficient input validation of GUI command arguments. An attacker could exploit this vulnerability by injecting crafted arguments into a vulnerable GUI command. An exploit could allow the attacker to execute commands on the underlying BusyBox operating system. These commands are run at the privilege level of the authenticated user. The attacker needs valid device credentials for this attack. Cisco Bug IDs: CSCvg74691.

cpe:/a:cisco:anyconnect_secure_mobility_client

CVE-2018-0100

2018-01-18T01:29:01.050-05:00

2019-10-09T19:31:13.863-04:00

3.6

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 102738 SECTRACK 1040246 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-acpe A vulnerability in the Profile Editor of the Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, local attacker to have read and write access to information stored in the affected system. The vulnerability is due to improper handling of the XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by injecting a crafted XML file with malicious entries, which could allow the attacker to read and write files. Cisco Bug IDs: CSCvg19341.

cpe:/a:cisco:adaptive_security_appliance_software:- cpe:/a:cisco:adaptive_security_appliance_software:7.0 cpe:/a:cisco:adaptive_security_appliance_software:7.0%280%29 cpe:/a:cisco:adaptive_security_appliance_software:7.0%281%29 cpe:/a:cisco:adaptive_security_appliance_software:7.0%282%29 cpe:/a:cisco:adaptive_security_appliance_software:7.0%284%29 cpe:/a:cisco:adaptive_security_appliance_software:7.0%285%29 cpe:/a:cisco:adaptive_security_appliance_software:7.0%285.2%29 cpe:/a:cisco:adaptive_security_appliance_software:7.0%286%29 cpe:/a:cisco:adaptive_security_appliance_software:7.0%286.7%29 cpe:/a:cisco:adaptive_security_appliance_software:7.0%287%29 cpe:/a:cisco:adaptive_security_appliance_software:7.0%288%29 cpe:/a:cisco:adaptive_security_appliance_software:7.0.1 cpe:/a:cisco:adaptive_security_appliance_software:7.0.1.4 cpe:/a:cisco:adaptive_security_appliance_software:7.0.2 cpe:/a:cisco:adaptive_security_appliance_software:7.0.3 cpe:/a:cisco:adaptive_security_appliance_software:7.0.4 cpe:/a:cisco:adaptive_security_appliance_software:7.0.4.2 cpe:/a:cisco:adaptive_security_appliance_software:7.0.4.3 cpe:/a:cisco:adaptive_security_appliance_software:7.0.5 cpe:/a:cisco:adaptive_security_appliance_software:7.0.5.12 cpe:/a:cisco:adaptive_security_appliance_software:7.0.6 cpe:/a:cisco:adaptive_security_appliance_software:7.0.6.4 cpe:/a:cisco:adaptive_security_appliance_software:7.0.6.8 cpe:/a:cisco:adaptive_security_appliance_software:7.0.6.18 cpe:/a:cisco:adaptive_security_appliance_software:7.0.6.22 cpe:/a:cisco:adaptive_security_appliance_software:7.0.6.26 cpe:/a:cisco:adaptive_security_appliance_software:7.0.6.29 cpe:/a:cisco:adaptive_security_appliance_software:7.0.6.32 cpe:/a:cisco:adaptive_security_appliance_software:7.0.7 cpe:/a:cisco:adaptive_security_appliance_software:7.0.7.1 cpe:/a:cisco:adaptive_security_appliance_software:7.0.7.4 cpe:/a:cisco:adaptive_security_appliance_software:7.0.7.9 cpe:/a:cisco:adaptive_security_appliance_software:7.0.7.12 cpe:/a:cisco:adaptive_security_appliance_software:7.0.8 cpe:/a:cisco:adaptive_security_appliance_software:7.0.8:interim cpe:/a:cisco:adaptive_security_appliance_software:7.0.8.2 cpe:/a:cisco:adaptive_security_appliance_software:7.0.8.8 cpe:/a:cisco:adaptive_security_appliance_software:7.0.8.12 cpe:/a:cisco:adaptive_security_appliance_software:7.0.8.13 cpe:/a:cisco:adaptive_security_appliance_software:7.1 cpe:/a:cisco:adaptive_security_appliance_software:7.1%282%29 cpe:/a:cisco:adaptive_security_appliance_software:7.1%282.5%29 cpe:/a:cisco:adaptive_security_appliance_software:7.1%282.27%29 cpe:/a:cisco:adaptive_security_appliance_software:7.1%282.48%29 cpe:/a:cisco:adaptive_security_appliance_software:7.1%282.49%29 cpe:/a:cisco:adaptive_security_appliance_software:7.1%285%29 cpe:/a:cisco:adaptive_security_appliance_software:7.1.1 cpe:/a:cisco:adaptive_security_appliance_software:7.1.2 cpe:/a:cisco:adaptive_security_appliance_software:7.1.2.16 cpe:/a:cisco:adaptive_security_appliance_software:7.1.2.20 cpe:/a:cisco:adaptive_security_appliance_software:7.1.2.24 cpe:/a:cisco:adaptive_security_appliance_software:7.1.2.28 cpe:/a:cisco:adaptive_security_appliance_software:7.1.2.38 cpe:/a:cisco:adaptive_security_appliance_software:7.1.2.42 cpe:/a:cisco:adaptive_security_appliance_software:7.1.2.46 cpe:/a:cisco:adaptive_security_appliance_software:7.1.2.49 cpe:/a:cisco:adaptive_security_appliance_software:7.1.2.53 cpe:/a:cisco:adaptive_security_appliance_software:7.1.2.61 cpe:/a:cisco:adaptive_security_appliance_software:7.1.2.64 cpe:/a:cisco:adaptive_security_appliance_software:7.1.2.72 cpe:/a:cisco:adaptive_security_appliance_software:7.1.2.81 cpe:/a:cisco:adaptive_security_appliance_software:7.2 cpe:/a:cisco:adaptive_security_appliance_software:7.2%281%29 cpe:/a:cisco:adaptive_security_appliance_software:7.2%281.22%29 cpe:/a:cisco:adaptive_security_appliance_software:7.2%282%29 cpe:/a:cisco:adaptive_security_appliance_software:7.2%282.5%29 cpe:/a:cisco:adaptive_security_appliance_software:7.2%282.7%29 cpe:/a:cisco:adaptive_security_appliance_software:7.2%282.8%29 cpe:/a:cisco:adaptive_security_appliance_software:7.2%282.10%29 cpe:/a:cisco:adaptive_security_appliance_software:7.2%282.14%29 cpe:/a:cisco:adaptive_security_appliance_software:7.2%282.15%29 cpe:/a:cisco:adaptive_security_appliance_software:7.2%282.16%29 cpe:/a:cisco:adaptive_security_appliance_software:7.2%282.17%29 cpe:/a:cisco:adaptive_security_appliance_software:7.2%282.18%29 cpe:/a:cisco:adaptive_security_appliance_software:7.2%282.19%29 cpe:/a:cisco:adaptive_security_appliance_software:7.2%282.48%29 cpe:/a:cisco:adaptive_security_appliance_software:7.2%283%29 cpe:/a:cisco:adaptive_security_appliance_software:7.2%283%296 cpe:/a:cisco:adaptive_security_appliance_software:7.2%284%29 cpe:/a:cisco:adaptive_security_appliance_software:7.2%285%29 cpe:/a:cisco:adaptive_security_appliance_software:7.2.1 cpe:/a:cisco:adaptive_security_appliance_software:7.2.1.9 cpe:/a:cisco:adaptive_security_appliance_software:7.2.1.13 cpe:/a:cisco:adaptive_security_appliance_software:7.2.1.19 cpe:/a:cisco:adaptive_security_appliance_software:7.2.1.24 cpe:/a:cisco:adaptive_security_appliance_software:7.2.2 cpe:/a:cisco:adaptive_security_appliance_software:7.2.2.6 cpe:/a:cisco:adaptive_security_appliance_software:7.2.2.10 cpe:/a:cisco:adaptive_security_appliance_software:7.2.2.14 cpe:/a:cisco:adaptive_security_appliance_software:7.2.2.18 cpe:/a:cisco:adaptive_security_appliance_software:7.2.2.19 cpe:/a:cisco:adaptive_security_appliance_software:7.2.2.22 cpe:/a:cisco:adaptive_security_appliance_software:7.2.2.34 cpe:/a:cisco:adaptive_security_appliance_software:7.2.3 cpe:/a:cisco:adaptive_security_appliance_software:7.2.3.1 cpe:/a:cisco:adaptive_security_appliance_software:7.2.3.12 cpe:/a:cisco:adaptive_security_appliance_software:7.2.3.16 cpe:/a:cisco:adaptive_security_appliance_software:7.2.4 cpe:/a:cisco:adaptive_security_appliance_software:7.2.4.6 cpe:/a:cisco:adaptive_security_appliance_software:7.2.4.9 cpe:/a:cisco:adaptive_security_appliance_software:7.2.4.18 cpe:/a:cisco:adaptive_security_appliance_software:7.2.4.25 cpe:/a:cisco:adaptive_security_appliance_software:7.2.4.27 cpe:/a:cisco:adaptive_security_appliance_software:7.2.4.30 cpe:/a:cisco:adaptive_security_appliance_software:7.2.4.33 cpe:/a:cisco:adaptive_security_appliance_software:7.2.5 cpe:/a:cisco:adaptive_security_appliance_software:7.2.5.2 cpe:/a:cisco:adaptive_security_appliance_software:7.2.5.4 cpe:/a:cisco:adaptive_security_appliance_software:7.2.5.7 cpe:/a:cisco:adaptive_security_appliance_software:7.2.5.8 cpe:/a:cisco:adaptive_security_appliance_software:7.2.5.10 cpe:/a:cisco:adaptive_security_appliance_software:7.2.5.12 cpe:/a:cisco:adaptive_security_appliance_software:8.0 cpe:/a:cisco:adaptive_security_appliance_software:8.0%282%29 cpe:/a:cisco:adaptive_security_appliance_software:8.0%283%29 cpe:/a:cisco:adaptive_security_appliance_software:8.0%284%29 cpe:/a:cisco:adaptive_security_appliance_software:8.0%285%29 cpe:/a:cisco:adaptive_security_appliance_software:8.0%285.28%29 cpe:/a:cisco:adaptive_security_appliance_software:8.0%285.31%29 cpe:/a:cisco:adaptive_security_appliance_software:8.0.1.2 cpe:/a:cisco:adaptive_security_appliance_software:8.0.2 cpe:/a:cisco:adaptive_security_appliance_software:8.0.2.11 cpe:/a:cisco:adaptive_security_appliance_software:8.0.2.15 cpe:/a:cisco:adaptive_security_appliance_software:8.0.3 cpe:/a:cisco:adaptive_security_appliance_software:8.0.3.6 cpe:/a:cisco:adaptive_security_appliance_software:8.0.3.12 cpe:/a:cisco:adaptive_security_appliance_software:8.0.3.19 cpe:/a:cisco:adaptive_security_appliance_software:8.0.4 cpe:/a:cisco:adaptive_security_appliance_software:8.0.4.3 cpe:/a:cisco:adaptive_security_appliance_software:8.0.4.9 cpe:/a:cisco:adaptive_security_appliance_software:8.0.4.16 cpe:/a:cisco:adaptive_security_appliance_software:8.0.4.23 cpe:/a:cisco:adaptive_security_appliance_software:8.0.4.25 cpe:/a:cisco:adaptive_security_appliance_software:8.0.4.28 cpe:/a:cisco:adaptive_security_appliance_software:8.0.4.31 cpe:/a:cisco:adaptive_security_appliance_software:8.0.4.32 cpe:/a:cisco:adaptive_security_appliance_software:8.0.4.33 cpe:/a:cisco:adaptive_security_appliance_software:8.0.5 cpe:/a:cisco:adaptive_security_appliance_software:8.0.5.20 cpe:/a:cisco:adaptive_security_appliance_software:8.0.5.23 cpe:/a:cisco:adaptive_security_appliance_software:8.0.5.25 cpe:/a:cisco:adaptive_security_appliance_software:8.0.5.27 cpe:/a:cisco:adaptive_security_appliance_software:8.0.5.28 cpe:/a:cisco:adaptive_security_appliance_software:8.0.5.31 cpe:/a:cisco:adaptive_security_appliance_software:8.1 cpe:/a:cisco:adaptive_security_appliance_software:8.1.0.104 cpe:/a:cisco:adaptive_security_appliance_software:8.1.1 cpe:/a:cisco:adaptive_security_appliance_software:8.1.1.6 cpe:/a:cisco:adaptive_security_appliance_software:8.1.2 cpe:/a:cisco:adaptive_security_appliance_software:8.1.2.13 cpe:/a:cisco:adaptive_security_appliance_software:8.1.2.15 cpe:/a:cisco:adaptive_security_appliance_software:8.1.2.16 cpe:/a:cisco:adaptive_security_appliance_software:8.1.2.19 cpe:/a:cisco:adaptive_security_appliance_software:8.1.2.23 cpe:/a:cisco:adaptive_security_appliance_software:8.1.2.24 cpe:/a:cisco:adaptive_security_appliance_software:8.1.2.49 cpe:/a:cisco:adaptive_security_appliance_software:8.1.2.50 cpe:/a:cisco:adaptive_security_appliance_software:8.1.2.55 cpe:/a:cisco:adaptive_security_appliance_software:8.1.2.56 cpe:/a:cisco:adaptive_security_appliance_software:8.2 cpe:/a:cisco:adaptive_security_appliance_software:8.2%281%29 cpe:/a:cisco:adaptive_security_appliance_software:8.2%282%29 cpe:/a:cisco:adaptive_security_appliance_software:8.2%283%29 cpe:/a:cisco:adaptive_security_appliance_software:8.2%283.9%29 cpe:/a:cisco:adaptive_security_appliance_software:8.2%284%29 cpe:/a:cisco:adaptive_security_appliance_software:8.2%284.1%29 cpe:/a:cisco:adaptive_security_appliance_software:8.2%284.4%29 cpe:/a:cisco:adaptive_security_appliance_software:8.2%285%29 cpe:/a:cisco:adaptive_security_appliance_software:8.2%285.35%29 cpe:/a:cisco:adaptive_security_appliance_software:8.2%285.38%29 cpe:/a:cisco:adaptive_security_appliance_software:8.2.1 cpe:/a:cisco:adaptive_security_appliance_software:8.2.1.11 cpe:/a:cisco:adaptive_security_appliance_software:8.2.2 cpe:/a:cisco:adaptive_security_appliance_software:8.2.2:interim cpe:/a:cisco:adaptive_security_appliance_software:8.2.3 cpe:/a:cisco:adaptive_security_appliance_software:8.2.5.52 cpe:/a:cisco:adaptive_security_appliance_software:8.2.5.55 cpe:/a:cisco:adaptive_security_appliance_software:8.2.5.57 cpe:/a:cisco:adaptive_security_appliance_software:8.2.5.59 cpe:/a:cisco:adaptive_security_appliance_software:8.3%281%29 cpe:/a:cisco:adaptive_security_appliance_software:8.3%282%29 cpe:/a:cisco:adaptive_security_appliance_software:8.3%282.34%29 cpe:/a:cisco:adaptive_security_appliance_software:8.3%282.37%29 cpe:/a:cisco:adaptive_security_appliance_software:8.3.1 cpe:/a:cisco:adaptive_security_appliance_software:8.3.1:interim cpe:/a:cisco:adaptive_security_appliance_software:8.3.2 cpe:/a:cisco:adaptive_security_appliance_software:8.3.2.44 cpe:/a:cisco:adaptive_security_appliance_software:8.4 cpe:/a:cisco:adaptive_security_appliance_software:8.4%28.1%29 cpe:/a:cisco:adaptive_security_appliance_software:8.4%28.1.3%29 cpe:/a:cisco:adaptive_security_appliance_software:8.4%28.1.11%29 cpe:/a:cisco:adaptive_security_appliance_software:8.4%28.2%29 cpe:/a:cisco:adaptive_security_appliance_software:8.4%28.2.1%29 cpe:/a:cisco:adaptive_security_appliance_software:8.4%28.2.8%29 cpe:/a:cisco:adaptive_security_appliance_software:8.4%28.3%29 cpe:/a:cisco:adaptive_security_appliance_software:8.4%28.3.8%29 cpe:/a:cisco:adaptive_security_appliance_software:8.4%28.3.9%29 cpe:/a:cisco:adaptive_security_appliance_software:8.4%28.4%29 cpe:/a:cisco:adaptive_security_appliance_software:8.4%28.4.1%29 cpe:/a:cisco:adaptive_security_appliance_software:8.4%28.4.3%29 cpe:/a:cisco:adaptive_security_appliance_software:8.4%28.4.5%29 cpe:/a:cisco:adaptive_security_appliance_software:8.4%28.4.9%29 cpe:/a:cisco:adaptive_security_appliance_software:8.4%28.5%29 cpe:/a:cisco:adaptive_security_appliance_software:8.4%28.5.6%29 cpe:/a:cisco:adaptive_security_appliance_software:8.4%28.6%29 cpe:/a:cisco:adaptive_security_appliance_software:8.4%28.7%29 cpe:/a:cisco:adaptive_security_appliance_software:8.4%28.7.3%29 cpe:/a:cisco:adaptive_security_appliance_software:8.4%28.7.15%29 cpe:/a:cisco:adaptive_security_appliance_software:8.4%281%29 cpe:/a:cisco:adaptive_security_appliance_software:8.4%281.11%29 cpe:/a:cisco:adaptive_security_appliance_software:8.4%282%29 cpe:/a:cisco:adaptive_security_appliance_software:8.4%282.11%29 cpe:/a:cisco:adaptive_security_appliance_software:8.4%283%29 cpe:/a:cisco:adaptive_security_appliance_software:8.4%284.11%29 cpe:/a:cisco:adaptive_security_appliance_software:8.4%285%29 cpe:/a:cisco:adaptive_security_appliance_software:8.4%286%29 cpe:/a:cisco:adaptive_security_appliance_software:8.4.0 cpe:/a:cisco:adaptive_security_appliance_software:8.4.1 cpe:/a:cisco:adaptive_security_appliance_software:8.4.1.3 cpe:/a:cisco:adaptive_security_appliance_software:8.4.1.11 cpe:/a:cisco:adaptive_security_appliance_software:8.4.2 cpe:/a:cisco:adaptive_security_appliance_software:8.4.2.1 cpe:/a:cisco:adaptive_security_appliance_software:8.4.2.8 cpe:/a:cisco:adaptive_security_appliance_software:8.4.3 cpe:/a:cisco:adaptive_security_appliance_software:8.4.3.8 cpe:/a:cisco:adaptive_security_appliance_software:8.4.3.9 cpe:/a:cisco:adaptive_security_appliance_software:8.4.4 cpe:/a:cisco:adaptive_security_appliance_software:8.4.4.1 cpe:/a:cisco:adaptive_security_appliance_software:8.4.4.3 cpe:/a:cisco:adaptive_security_appliance_software:8.4.4.5 cpe:/a:cisco:adaptive_security_appliance_software:8.4.4.9 cpe:/a:cisco:adaptive_security_appliance_software:8.4.5 cpe:/a:cisco:adaptive_security_appliance_software:8.4.5.6 cpe:/a:cisco:adaptive_security_appliance_software:8.4.6 cpe:/a:cisco:adaptive_security_appliance_software:8.4.7 cpe:/a:cisco:adaptive_security_appliance_software:8.4.7.3 cpe:/a:cisco:adaptive_security_appliance_software:8.4.7.15 cpe:/a:cisco:adaptive_security_appliance_software:8.4.7.22 cpe:/a:cisco:adaptive_security_appliance_software:8.4.7.23 cpe:/a:cisco:adaptive_security_appliance_software:8.4.7.26 cpe:/a:cisco:adaptive_security_appliance_software:8.4.7.28 cpe:/a:cisco:adaptive_security_appliance_software:8.4.7.29 cpe:/a:cisco:adaptive_security_appliance_software:8.5 cpe:/a:cisco:adaptive_security_appliance_software:8.5%281%29 cpe:/a:cisco:adaptive_security_appliance_software:8.5%281.4%29 cpe:/a:cisco:adaptive_security_appliance_software:8.5%281.17%29 cpe:/a:cisco:adaptive_security_appliance_software:8.6 cpe:/a:cisco:adaptive_security_appliance_software:8.6%281%29 cpe:/a:cisco:adaptive_security_appliance_software:8.6%281.2%29 cpe:/a:cisco:adaptive_security_appliance_software:8.6%281.3%29 cpe:/a:cisco:adaptive_security_appliance_software:8.6%281.10%29 cpe:/a:cisco:adaptive_security_appliance_software:8.7 cpe:/a:cisco:adaptive_security_appliance_software:8.7%281.1%29 cpe:/a:cisco:adaptive_security_appliance_software:8.7%281.3%29 cpe:/a:cisco:adaptive_security_appliance_software:8.7.1 cpe:/a:cisco:adaptive_security_appliance_software:8.7.1.1 cpe:/a:cisco:adaptive_security_appliance_software:8.7.1.8 cpe:/a:cisco:adaptive_security_appliance_software:8.7.1.17 cpe:/a:cisco:adaptive_security_appliance_software:9%283%29 cpe:/a:cisco:adaptive_security_appliance_software:9.0 cpe:/a:cisco:adaptive_security_appliance_software:9.0%28.1%29 cpe:/a:cisco:adaptive_security_appliance_software:9.0%28.2.10%29 cpe:/a:cisco:adaptive_security_appliance_software:9.0%28.3%29 cpe:/a:cisco:adaptive_security_appliance_software:9.0%28.3.6%29 cpe:/a:cisco:adaptive_security_appliance_software:9.0%28.3.8%29 cpe:/a:cisco:adaptive_security_appliance_software:9.0%28.4%29 cpe:/a:cisco:adaptive_security_appliance_software:9.0%28.4.1%29 cpe:/a:cisco:adaptive_security_appliance_software:9.0%281%29 cpe:/a:cisco:adaptive_security_appliance_software:9.0%282%29 cpe:/a:cisco:adaptive_security_appliance_software:9.0%283%29 cpe:/a:cisco:adaptive_security_appliance_software:9.0.3%286%29 cpe:/a:cisco:adaptive_security_appliance_software:9.0.4.24 cpe:/a:cisco:adaptive_security_appliance_software:9.0.4.26 cpe:/a:cisco:adaptive_security_appliance_software:9.0.4.29 cpe:/a:cisco:adaptive_security_appliance_software:9.0.4.37 cpe:/a:cisco:adaptive_security_appliance_software:9.0.4.40 cpe:/a:cisco:adaptive_security_appliance_software:9.0.4.42 cpe:/a:cisco:adaptive_security_appliance_software:9.1 cpe:/a:cisco:adaptive_security_appliance_software:9.1%28.2%29 cpe:/a:cisco:adaptive_security_appliance_software:9.1%28.3%29 cpe:/a:cisco:adaptive_security_appliance_software:9.1%28.5%29 cpe:/a:cisco:adaptive_security_appliance_software:9.1%281%29 cpe:/a:cisco:adaptive_security_appliance_software:9.1%281.7%29 cpe:/a:cisco:adaptive_security_appliance_software:9.1%282%29 cpe:/a:cisco:adaptive_security_appliance_software:9.1%283%29 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%294 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%296 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%297 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%299 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2911 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2912 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2913 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2915 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2916 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2919 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2920 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2921 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2923 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2925 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2929 cpe:/a:cisco:adaptive_security_appliance_software:9.1.1 cpe:/a:cisco:adaptive_security_appliance_software:9.1.4.5 cpe:/a:cisco:adaptive_security_appliance_software:9.1.5.12 cpe:/a:cisco:adaptive_security_appliance_software:9.1.5.21 cpe:/a:cisco:adaptive_security_appliance_software:9.1.6 cpe:/a:cisco:adaptive_security_appliance_software:9.1.6.8 cpe:/a:cisco:adaptive_security_appliance_software:9.1.6.10 cpe:/a:cisco:adaptive_security_appliance_software:9.1.7.4 cpe:/a:cisco:adaptive_security_appliance_software:9.1.7.6 cpe:/a:cisco:adaptive_security_appliance_software:9.1.7.7 cpe:/a:cisco:adaptive_security_appliance_software:9.1.7.9 cpe:/a:cisco:adaptive_security_appliance_software:9.1.7.11 cpe:/a:cisco:adaptive_security_appliance_software:9.1.7.12 cpe:/a:cisco:adaptive_security_appliance_software:9.2.2.7 cpe:/a:cisco:adaptive_security_appliance_software:9.2.2.8 cpe:/a:cisco:adaptive_security_appliance_software:9.2.3.3 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4.2 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4.4 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4.8 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4.10 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4.13 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4.14 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4.16 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4.17 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4.18 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4.19 cpe:/a:cisco:adaptive_security_appliance_software:9.3.1.1 cpe:/a:cisco:adaptive_security_appliance_software:9.3.2 cpe:/a:cisco:adaptive_security_appliance_software:9.3.2.2 cpe:/a:cisco:adaptive_security_appliance_software:9.3.3.5 cpe:/a:cisco:adaptive_security_appliance_software:9.3.3.6 cpe:/a:cisco:adaptive_security_appliance_software:9.3.3.9 cpe:/a:cisco:adaptive_security_appliance_software:9.3.3.10 cpe:/a:cisco:adaptive_security_appliance_software:9.3.3.11 cpe:/a:cisco:adaptive_security_appliance_software:9.3.5 cpe:/a:cisco:adaptive_security_appliance_software:9.4 cpe:/a:cisco:adaptive_security_appliance_software:9.4%281%29 cpe:/a:cisco:adaptive_security_appliance_software:9.4%281.1%29 cpe:/a:cisco:adaptive_security_appliance_software:9.4%281.152%29 cpe:/a:cisco:adaptive_security_appliance_software:9.4%281.200%29 cpe:/a:cisco:adaptive_security_appliance_software:9.4%281.225%29 cpe:/a:cisco:adaptive_security_appliance_software:9.4%282%29 cpe:/a:cisco:adaptive_security_appliance_software:9.4%282.145%29 cpe:/a:cisco:adaptive_security_appliance_software:9.4%283%29 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%292 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%295 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%296 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%298 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%2910 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%2912 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%2913 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%2914 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%2916 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%2917 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%2918 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284.5%29 cpe:/a:cisco:adaptive_security_appliance_software:9.4.1 cpe:/a:cisco:adaptive_security_appliance_software:9.4.1.1 cpe:/a:cisco:adaptive_security_appliance_software:9.4.1.2 cpe:/a:cisco:adaptive_security_appliance_software:9.4.1.3 cpe:/a:cisco:adaptive_security_appliance_software:9.4.1.5 cpe:/a:cisco:adaptive_security_appliance_software:9.4.2 cpe:/a:cisco:adaptive_security_appliance_software:9.4.2.3 cpe:/a:cisco:adaptive_security_appliance_software:9.4.3 cpe:/a:cisco:adaptive_security_appliance_software:9.4.3.4 cpe:/a:cisco:adaptive_security_appliance_software:9.4.3.6 cpe:/a:cisco:adaptive_security_appliance_software:9.4.3.8 cpe:/a:cisco:adaptive_security_appliance_software:9.4.3.11 cpe:/a:cisco:adaptive_security_appliance_software:9.4.3.12 cpe:/a:cisco:adaptive_security_appliance_software:9.4.4 cpe:/a:cisco:adaptive_security_appliance_software:9.5.1 cpe:/a:cisco:adaptive_security_appliance_software:9.5.2 cpe:/a:cisco:adaptive_security_appliance_software:9.5.2.6 cpe:/a:cisco:adaptive_security_appliance_software:9.5.2.10 cpe:/a:cisco:adaptive_security_appliance_software:9.5.2.14 cpe:/a:cisco:adaptive_security_appliance_software:9.5.3 cpe:/a:cisco:adaptive_security_appliance_software:9.5.3.1 cpe:/a:cisco:adaptive_security_appliance_software:9.5.3.2 cpe:/a:cisco:adaptive_security_appliance_software:9.5.3.3 cpe:/a:cisco:adaptive_security_appliance_software:9.5.3.6 cpe:/a:cisco:adaptive_security_appliance_software:9.5.3.7 cpe:/a:cisco:adaptive_security_appliance_software:9.6 cpe:/a:cisco:adaptive_security_appliance_software:9.6%281%29 cpe:/a:cisco:adaptive_security_appliance_software:9.6%282%29 cpe:/a:cisco:adaptive_security_appliance_software:9.6%283%293 cpe:/a:cisco:adaptive_security_appliance_software:9.6%283%298 cpe:/a:cisco:adaptive_security_appliance_software:9.6%283%299 cpe:/a:cisco:adaptive_security_appliance_software:9.6%283%2911 cpe:/a:cisco:adaptive_security_appliance_software:9.6%283%2912 cpe:/a:cisco:adaptive_security_appliance_software:9.6%283%2914 cpe:/a:cisco:adaptive_security_appliance_software:9.6%283%2917 cpe:/a:cisco:adaptive_security_appliance_software:9.6%283.1%29 cpe:/a:cisco:adaptive_security_appliance_software:9.6%284%29 cpe:/a:cisco:adaptive_security_appliance_software:9.6%284%293 cpe:/a:cisco:adaptive_security_appliance_software:9.6%284%295 cpe:/a:cisco:adaptive_security_appliance_software:9.6%284%296 cpe:/a:cisco:adaptive_security_appliance_software:9.6%284%298 cpe:/a:cisco:adaptive_security_appliance_software:9.6.0 cpe:/a:cisco:adaptive_security_appliance_software:9.6.1 cpe:/a:cisco:adaptive_security_appliance_software:9.6.1.3 cpe:/a:cisco:adaptive_security_appliance_software:9.6.1.5 cpe:/a:cisco:adaptive_security_appliance_software:9.6.1.10 cpe:/a:cisco:adaptive_security_appliance_software:9.6.2 cpe:/a:cisco:adaptive_security_appliance_software:9.6.2.1 cpe:/a:cisco:adaptive_security_appliance_software:9.6.2.2 cpe:/a:cisco:adaptive_security_appliance_software:9.6.2.3 cpe:/a:cisco:adaptive_security_appliance_software:9.6.2.7 cpe:/a:cisco:firepower_threat_defense:6.0.0 cpe:/a:cisco:firepower_threat_defense:6.0.1 cpe:/a:cisco:firepower_threat_defense:6.1.0 cpe:/a:cisco:firepower_threat_defense:6.2.0 cpe:/a:cisco:firepower_threat_defense:6.2.1 cpe:/a:cisco:firepower_threat_defense:6.2.2

CVE-2018-0101

2018-01-29T15:29:00.280-05:00

2019-10-09T19:31:13.973-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 102845 SECTRACK 1040292 MISC https://icanthackit.wordpress.com/2018/01/30/thoughts-on-the-handling-cve-2018-0101-cisco-bug-cscvg35618/ MISC https://pastebin.com/YrBcG2Ln CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180129-asa1 EXPLOIT-DB 43986 A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to an attempt to double free a region of memory when the webvpn feature is enabled on the Cisco ASA device. An attacker could exploit this vulnerability by sending multiple, crafted XML packets to a webvpn-configured interface on the affected system. An exploit could allow the attacker to execute arbitrary code and obtain full control of the system, or cause a reload of the affected device. This vulnerability affects Cisco ASA Software that is running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, ASA 1000V Cloud Firewall, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4110 Security Appliance, Firepower 9300 ASA Security Module, Firepower Threat Defense Software (FTD). Cisco Bug IDs: CSCvg35618.

cpe:/o:cisco:nx-os:7.2%281%29d%281%29 cpe:/o:cisco:nx-os:7.2%282%29d1%281%29 cpe:/o:cisco:nx-os:7.2%282%29d1%282%29

CVE-2018-0102

2018-01-18T01:29:01.097-05:00

2019-10-09T19:31:14.177-04:00

6.1

ADJACENT_NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 102728 SECTRACK 1040219 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-nx-os A vulnerability in the Pong tool of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software attempts to free the same area of memory twice. An attacker could exploit this vulnerability by sending a pong request to an affected device from a location on the network that causes the pong reply packet to egress both a FabricPath port and a non-FabricPath port. An exploit could allow the attacker to cause a dual or quad supervisor virtual port-channel (vPC) to reload. This vulnerability affects the following products when running Cisco NX-OS Software Release 7.2(1)D(1), 7.2(2)D1(1), or 7.2(2)D1(2) with both the Pong and FabricPath features enabled and the FabricPath port is actively monitored via a SPAN session: Cisco Nexus 7000 Series Switches and Cisco Nexus 7700 Series Switches. Cisco Bug IDs: CSCuv98660.

cpe:/a:cisco:webex_business_suite:- cpe:/a:cisco:webex_meetings:- cpe:/a:cisco:webex_meetings_server:- cpe:/a:cisco:webex_network_recording_player:-

CVE-2018-0103

2018-01-04T01:29:00.340-05:00

2019-10-09T19:31:14.347-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 102369 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180103-wnrp A Buffer Overflow vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow a local attacker to execute arbitrary code on the system of a user. The attacker could exploit this vulnerability by sending the user a link or email attachment with a malicious ARF file and persuading the user to follow the link or launch the file. Successful exploitation could allow the attacker to execute arbitrary code on the user's system. This vulnerability affects Cisco WebEx Business Suite meeting sites, Cisco WebEx Meetings sites, Cisco WebEx Meetings Server, and Cisco WebEx ARF players. Cisco Bug IDs: CSCvg78835, CSCvg78837, CSCvg78839.

cpe:/a:cisco:webex_business_suite:- cpe:/a:cisco:webex_meetings:- cpe:/a:cisco:webex_meetings_server:- cpe:/a:cisco:webex_network_recording_player:-

CVE-2018-0104

2018-01-04T01:29:00.387-05:00

2019-10-09T19:31:14.533-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 102382 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180103-warfp A vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow a remote attacker to execute arbitrary code on the system of a targeted user. The attacker could exploit this vulnerability by sending the user a link or email attachment with a malicious ARF file and persuading the user to follow the link or launch the file. Successful exploitation could allow the attacker to execute arbitrary code on the user's system. This vulnerability affects Cisco WebEx Business Suite meeting sites, Cisco WebEx Meetings sites, Cisco WebEx Meetings Server, and Cisco WebEx ARF players. Cisco Bug IDs: CSCvg78853, CSCvg78856, CSCvg78857.

cpe:/a:cisco:unified_communications_manager

CVE-2018-0105

2018-01-18T01:29:01.143-05:00

2019-10-09T19:31:14.707-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 102725 SECTRACK 1040245 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-ucm A vulnerability in the web framework of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to view sensitive data. The vulnerability is due to insufficient protection of database tables. An attacker could exploit this vulnerability by browsing to a specific URL. An exploit could allow the attacker to view data library information. Cisco Bug IDs: CSCvf20269.

cpe:/a:cisco:elastic_services_controller

CVE-2018-0106

2018-01-18T01:29:01.207-05:00

2019-10-09T19:31:14.847-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 102757 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-esc A vulnerability in the ConfD server of the Cisco Elastic Services Controller (ESC) could allow an unauthenticated, local attacker to access sensitive information on a targeted system. The vulnerability is due to insufficient security restrictions. An attacker could exploit this vulnerability by accessing unauthorized information within the ConfD directory and file structure. Successful exploitation could allow the attacker to view sensitive information. Cisco Bug IDs: CSCvg00221.

cpe:/a:cisco:prime_service_catalog

CVE-2018-0107

2018-01-18T01:29:01.267-05:00

2019-10-09T19:31:14.987-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 102719 SECTRACK 1040244 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-psc A vulnerability in the web framework of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to execute unwanted actions on an affected device. The vulnerability is due to a lack of cross-site request forgery (CSRF) protection. An attacker could exploit this vulnerability by tricking the user of a web application into executing an adverse action. Cisco Bug IDs: CSCvg30313.

cpe:/a:cisco:webex_meetings_server

CVE-2018-0108

2018-01-18T01:29:01.330-05:00

2019-10-09T19:31:15.127-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 102720 SECTRACK 1040238 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-wms A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to collect customer files via an out-of-band XML External Entity (XXE) injection. An attacker could exploit this vulnerability to gain information to conduct additional reconnaissance attacks. The vulnerability is due to the ability of an attacker to perform an out-of-band XXE injection on the system, which could allow an attacker to capture customer files and redirect them to another destination address. An exploit could allow the attacker to discover sensitive customer data. Cisco Bug IDs: CSCvg36996.

cpe:/a:cisco:webex_meetings_server

CVE-2018-0109

2018-01-18T01:29:01.393-05:00

2019-10-09T19:31:15.253-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov BID 102722 SECTRACK 1040235 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-wms1 A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to access sensitive data about the application. An attacker could exploit this vulnerability to obtain information to conduct additional reconnaissance attacks. The vulnerability is due to a design flaw in Cisco WebEx Meetings Server that could allow an attacker who is authenticated as root to gain shared secrets. An attacker could exploit the vulnerability by accessing the root account and viewing sensitive information. Successful exploitation could allow the attacker to discover sensitive information about the application. Cisco Bug IDs: CSCvg42664.

cpe:/a:cisco:webex_meetings_server

CVE-2018-0110

2018-01-18T01:29:01.423-05:00

2019-10-09T19:31:15.410-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov BID 102773 SECTRACK 1040236 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-wms2 A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to access the remote support account even after it has been disabled via the web application. The vulnerability is due to a design flaw in Cisco WebEx Meetings Server, which would not disable access to specifically configured user accounts, even after access had been disabled in the web application. An attacker could exploit this vulnerability by connecting to the remote support account, even after it had been disabled at the web application level. An exploit could allow the attacker to modify server configuration and gain access to customer data. Cisco Bug IDs: CSCvg46741.

cpe:/a:cisco:webex_meetings_server

CVE-2018-0111

2018-01-18T01:29:01.487-05:00

2019-10-09T19:31:15.533-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 102723 SECTRACK 1040237 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-wms3 A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to access sensitive data about the application. An attacker could exploit this vulnerability to gain information to conduct additional reconnaissance attacks. The vulnerability is due to a design flaw in Cisco WebEx Meetings Server, which could include internal network information that should be restricted. An attacker could exploit the vulnerability by utilizing available resources to study the customer network. An exploit could allow the attacker to discover sensitive data about the application. Cisco Bug IDs: CSCvg46806.

CVE-2018-0112

2018-04-19T16:29:00.253-04:00

2019-10-09T19:31:15.643-04:00

6.0

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov BID 103920 SECTRACK 1040709 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-wbs A vulnerability in Cisco WebEx Business Suite clients, Cisco WebEx Meetings, and Cisco WebEx Meetings Server could allow an authenticated, remote attacker to execute arbitrary code on a targeted system. The vulnerability is due to insufficient input validation by the Cisco WebEx clients. An attacker could exploit this vulnerability by providing meeting attendees with a malicious Flash (.swf) file via the file-sharing capabilities of the client. Exploitation of this vulnerability could allow arbitrary code execution on the system of a targeted user. This affects the clients installed by customers when accessing a WebEx meeting. The following client builds of Cisco WebEx Business Suite (WBS30, WBS31, and WBS32), Cisco WebEx Meetings, and Cisco WebEx Meetings Server are impacted: Cisco WebEx Business Suite (WBS31) client builds prior to T31.23.2, Cisco WebEx Business Suite (WBS32) client builds prior to T32.10, Cisco WebEx Meetings with client builds prior to T32.10, Cisco WebEx Meetings Server builds prior to 2.8 MR2. Cisco Bug IDs: CSCvg19384, CSCvi10746.

cpe:/a:cisco:unified_computing_system_central_software:1.5%281c%29

CVE-2018-0113

2018-02-08T02:29:00.210-05:00

2019-10-09T19:31:15.800-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov BID 102966 SECTRACK 1040337 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-ucsc A vulnerability in an operations script of Cisco UCS Central could allow an authenticated, remote attacker to execute arbitrary shell commands with the privileges of the daemon user. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by posting a crafted request to the user interface of Cisco UCS Central. This vulnerability affects Cisco UCS Central Software prior to Release 2.0(1c). Cisco Bug IDs: CSCve70825.

cpe:/a:cisco:node-jose:0.3.0 cpe:/a:cisco:node-jose:0.3.0::~~~node.js~~ cpe:/a:cisco:node-jose:0.3.1 cpe:/a:cisco:node-jose:0.3.1::~~~node.js~~ cpe:/a:cisco:node-jose:0.4.0 cpe:/a:cisco:node-jose:0.4.0::~~~node.js~~ cpe:/a:cisco:node-jose:0.5.0 cpe:/a:cisco:node-jose:0.5.0::~~~node.js~~ cpe:/a:cisco:node-jose:0.5.1 cpe:/a:cisco:node-jose:0.5.1::~~~node.js~~ cpe:/a:cisco:node-jose:0.5.2 cpe:/a:cisco:node-jose:0.5.2::~~~node.js~~ cpe:/a:cisco:node-jose:0.6.0 cpe:/a:cisco:node-jose:0.6.0::~~~node.js~~ cpe:/a:cisco:node-jose:0.7.0 cpe:/a:cisco:node-jose:0.7.0::~~~node.js~~ cpe:/a:cisco:node-jose:0.7.1 cpe:/a:cisco:node-jose:0.7.1::~~~node.js~~ cpe:/a:cisco:node-jose:0.8.0 cpe:/a:cisco:node-jose:0.8.0::~~~node.js~~ cpe:/a:cisco:node-jose:0.8.1 cpe:/a:cisco:node-jose:0.8.1::~~~node.js~~ cpe:/a:cisco:node-jose:0.9.0 cpe:/a:cisco:node-jose:0.9.0::~~~node.js~~ cpe:/a:cisco:node-jose:0.9.1 cpe:/a:cisco:node-jose:0.9.1::~~~node.js~~ cpe:/a:cisco:node-jose:0.9.2 cpe:/a:cisco:node-jose:0.9.2::~~~node.js~~ cpe:/a:cisco:node-jose:0.9.3 cpe:/a:cisco:node-jose:0.9.3::~~~node.js~~ cpe:/a:cisco:node-jose:0.9.4 cpe:/a:cisco:node-jose:0.9.4::~~~node.js~~ cpe:/a:cisco:node-jose:0.9.5 cpe:/a:cisco:node-jose:0.9.5::~~~node.js~~ cpe:/a:cisco:node-jose:0.10.0 cpe:/a:cisco:node-jose:0.10.0::~~~node.js~~

CVE-2018-0114

2018-01-04T01:29:00.417-05:00

2018-03-28T21:29:00.697-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 102445 CONFIRM https://github.com/cisco/node-jose/blob/master/CHANGELOG.md MISC https://github.com/zi0Black/POC-CVE-2018-0114 CONFIRM https://tools.cisco.com/security/center/viewAlert.x?alertId=56326 EXPLOIT-DB 44324 A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature (JWS) standard for JSON Web Tokens (JWTs). This standard specifies that a JSON Web Key (JWK) representing a public key can be embedded within the header of a JWS. This public key is then trusted for verification. An attacker could exploit this by forging valid JWS objects by removing the original signature, adding a new public key to the header, and then signing the object using the (attacker-owned) private key associated with the public key embedded in that JWS header.

cpe:/o:cisco:staros

CVE-2018-0115

2018-01-18T01:29:01.533-05:00

2019-10-09T19:31:16.003-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

ALLOWS_ADMIN_ACCESS

BID 102788 SECTRACK 1040239 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-staros A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series routers could allow an authenticated, local attacker to execute arbitrary commands with root privileges on an affected host operating system. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by injecting malicious command arguments into a vulnerable CLI command. A successful exploit could allow the attacker to execute arbitrary commands with root privileges. To exploit this vulnerability, the attacker would need to authenticate to the affected system by using valid administrator credentials. Cisco Bug IDs: CSCvf93332.

cpe:/a:cisco:mobility_services_engine:13.0.0 cpe:/a:cisco:mobility_services_engine:13.1.0 cpe:/a:cisco:mobility_services_engine:14.0.0

CVE-2018-0116

2018-02-08T02:29:00.257-05:00

2019-10-09T19:31:16.113-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 102968 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-cps A vulnerability in the RADIUS authentication module of Cisco Policy Suite could allow an unauthenticated, remote attacker to be authorized as a subscriber without providing a valid password; however, the attacker must provide a valid username. The vulnerability is due to incorrect RADIUS user credential validation. An attacker could exploit this vulnerability by attempting to access a Cisco Policy Suite domain configured with RADIUS authentication. An exploit could allow the attacker to be authorized as a subscriber without providing a valid password. This vulnerability affects the Cisco Policy Suite application running a release prior to 13.1.0 with Hotfix Patch 1 when RADIUS authentication is configured for a domain. Cisco Policy Suite Release 14.0.0 is also affected, as it includes vulnerable code, but RADIUS authentication is not officially supported in Cisco Policy Suite Releases 14.0.0 and later. Cisco Bug IDs: CSCvg40124.

cpe:/o:cisco:asr_5000_firmware:21.1.v0.66836 cpe:/o:cisco:asr_5000_firmware:21.1.v7 cpe:/o:cisco:asr_5000_firmware:21.3.0 cpe:/o:cisco:asr_5000_firmware:21.6.0 cpe:/o:cisco:asr_5500_firmware:21.1.v0.66836 cpe:/o:cisco:asr_5500_firmware:21.1.v7 cpe:/o:cisco:asr_5500_firmware:21.3.0 cpe:/o:cisco:asr_5500_firmware:21.6.0

CVE-2018-0117

2018-02-08T02:29:00.320-05:00

2019-10-09T19:31:16.237-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 102970 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-vpcdi A vulnerability in the ingress packet processing functionality of the Cisco Virtualized Packet Core-Distributed Instance (VPC-DI) Software could allow an unauthenticated, remote attacker to cause both control function (CF) instances on an affected system to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient handling of user-supplied data by the affected software. An attacker could exploit this vulnerability by sending malicious traffic to the internal distributed instance (DI) network address on an affected system. A successful exploit could allow the attacker to cause an unhandled error condition on the affected system, which would cause the CF instances to reload and consequently cause the entire VPC to reload, resulting in the disconnection of all subscribers and a DoS condition on the affected system. This vulnerability affects Cisco Virtualized Packet Core-Distributed Instance (VPC-DI) Software N4.0 through N5.5 with the Cisco StarOS operating system 19.2 through 21.3. Cisco Bug IDs: CSCve17656.

cpe:/a:cisco:unified_communications_manager:-

CVE-2018-0118

2018-01-11T04:29:00.213-05:00

2019-10-09T19:31:16.363-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 102478 SECTRACK 1040193 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180110-ucm A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to perform a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the web-based management interface to click a link that is designed to submit malicious input to the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information on the targeted device. Cisco Bug IDs: CSCvg51264.

cpe:/a:cisco:conference_director:2017-08-30

CVE-2018-0119

2018-02-08T02:29:00.367-05:00

2019-10-09T19:31:16.473-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov BID 102961 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-spark A vulnerability in certain authentication controls in the account services of Cisco Spark could allow an authenticated, remote attacker to interact with and view information on an affected device that would normally be prohibited. The vulnerability is due to the improper display of user-account tokens generated in the system. An attacker could exploit this vulnerability by logging in to the device with a token in use by another account. Successful exploitation could allow the attacker to cause a partial impact to the device's confidentiality, integrity, and availability. Cisco Bug IDs: CSCvg05206.

cpe:/a:cisco:unified_communications_manager:11.5%281.13900.52%29

CVE-2018-0120

2018-02-08T02:29:00.413-05:00

2019-10-09T19:31:16.580-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov BID 102958 SECTRACK 1040341 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-cucm A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct an SQL injection attack against an affected system. The vulnerability exists because the affected software fails to validate user-supplied input in certain SQL queries that bypass protection filters. An attacker could exploit this vulnerability by submitting crafted HTTP requests that contain malicious SQL statements to an affected system. A successful exploit could allow the attacker to determine the presence of certain values in the database of the affected system. Cisco Bug IDs: CSCvg74810.

cpe:/a:cisco:elastic_services_controller:3.0.0 cpe:/a:cisco:virtual_managed_services:3.0

CVE-2018-0121

2018-02-21T19:29:00.203-05:00

2019-10-09T19:31:16.690-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 103113 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-esc A vulnerability in the authentication functionality of the web-based service portal of Cisco Elastic Services Controller Software could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrator privileges on an affected system. The vulnerability is due to improper security restrictions that are imposed by the web-based service portal of the affected software. An attacker could exploit this vulnerability by submitting an empty password value to an affected portal when prompted to enter an administrative password for the portal. A successful exploit could allow the attacker to bypass authentication and gain administrator privileges for the web-based service portal of the affected software. This vulnerability affects Cisco Elastic Services Controller Software Release 3.0.0. Cisco Bug IDs: CSCvg29809.

cpe:/o:cisco:staros:21.3.0.67664

CVE-2018-0122

2018-02-08T02:29:00.477-05:00

2019-10-09T19:31:16.847-04:00

4.9

LOCAL

LOW

NONE

COMPLETE

NONE

http://nvd.nist.gov BID 103028 SECTRACK 1040340 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-asr A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series Aggregation Services Routers could allow an authenticated, local attacker to overwrite system files that are stored in the flash memory of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the affected operating system. An attacker could exploit this vulnerability by injecting crafted command arguments into a vulnerable CLI command for the affected operating system. A successful exploit could allow the attacker to overwrite or modify arbitrary files that are stored in the flash memory of an affected system. To exploit this vulnerability, the attacker would need to authenticate to an affected system by using valid administrator credentials. Cisco Bug IDs: CSCvf93335.

cpe:/o:cisco:ios:16.7%281%29 cpe:/o:cisco:ios_xe:-

CVE-2018-0123

2018-02-08T02:29:00.523-05:00

2019-10-09T19:31:16.973-04:00

4.9

LOCAL

LOW

NONE

COMPLETE

NONE

http://nvd.nist.gov BID 102967 SECTRACK 1040346 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-ios A Path Traversal vulnerability in the diagnostic shell for Cisco IOS and IOS XE Software could allow an authenticated, local attacker to use certain diagnostic shell commands that can overwrite system files. These system files may be sensitive and should not be able to be overwritten by a user of the diagnostic shell. The vulnerability is due to lack of proper input validation for certain diagnostic shell commands. An attacker could exploit this vulnerability by authenticating to the device, entering the diagnostic shell, and providing crafted user input to commands at the local diagnostic shell CLI. Successful exploitation could allow the attacker to overwrite system files that should be restricted. Cisco Bug IDs: CSCvg41950.

cpe:/a:cisco:unified_communications_domain_manager:- cpe:/a:cisco:unified_communications_domain_manager:4.4.1 cpe:/a:cisco:unified_communications_domain_manager:4.4.2 cpe:/a:cisco:unified_communications_domain_manager:4.4.3 cpe:/a:cisco:unified_communications_domain_manager:4.4.4 cpe:/a:cisco:unified_communications_domain_manager:7.4 cpe:/a:cisco:unified_communications_domain_manager:8.0 cpe:/a:cisco:unified_communications_domain_manager:8.0.1 cpe:/a:cisco:unified_communications_domain_manager:8.0.2 cpe:/a:cisco:unified_communications_domain_manager:8.1 cpe:/a:cisco:unified_communications_domain_manager:8.1%28.1%29 cpe:/a:cisco:unified_communications_domain_manager:8.1%28.2%29 cpe:/a:cisco:unified_communications_domain_manager:8.1%28.3%29 cpe:/a:cisco:unified_communications_domain_manager:8.1%28.4%29 cpe:/a:cisco:unified_communications_domain_manager:8.1%284%29er1 cpe:/a:cisco:unified_communications_domain_manager:8.1.4er1 cpe:/a:cisco:unified_communications_domain_manager:8.6 cpe:/a:cisco:unified_communications_domain_manager:8.6%28.2%29 cpe:/a:cisco:unified_communications_domain_manager:9.0 cpe:/a:cisco:unified_communications_domain_manager:9.0%28.1%29 cpe:/a:cisco:unified_communications_domain_manager:10.0 cpe:/a:cisco:unified_communications_domain_manager:10.5%281.98991.13%29 cpe:/a:cisco:unified_communications_domain_manager:10.5%282.10000.5%29 cpe:/a:cisco:unified_communications_domain_manager:10.6.1 cpe:/a:cisco:unified_communications_domain_manager:10.6_base cpe:/a:cisco:unified_communications_domain_manager:11.0%281.10000.10%29 cpe:/a:cisco:unified_communications_domain_manager:11.5%281.10000.6%29

CVE-2018-0124

2018-02-21T19:29:00.267-05:00

2019-10-09T19:31:17.097-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 103114 SECTRACK 1040405 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-ucdm A vulnerability in Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to bypass security protections, gain elevated privileges, and execute arbitrary code. The vulnerability is due to insecure key generation during application configuration. An attacker could exploit this vulnerability by using a known insecure key value to bypass security protections by sending arbitrary requests using the insecure key to a targeted application. An exploit could allow the attacker to execute arbitrary code. This vulnerability affects Cisco Unified Communications Domain Manager releases prior to 11.5(2). Cisco Bug IDs: CSCuv67964.

cpe:/o:cisco:rv132w_firmware:1.0 cpe:/o:cisco:rv134w_firmware:1.0

CVE-2018-0125

2018-02-08T02:29:00.570-05:00

2019-10-09T19:31:17.207-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

ALLOWS_ADMIN_ACCESS

BID 103140 SECTRACK 1040336 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-rv13x A vulnerability in the web interface of the Cisco RV132W ADSL2+ Wireless-N VPN and RV134W VDSL2 Wireless-AC VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system, including issuing commands with root privileges. The attacker could also cause an affected system to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to an incomplete input validation on user-controlled input in an HTTP request to the targeted device. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to execute arbitrary code as the root user and gain full control of the affected system or cause it to reload, resulting in a DoS condition. This vulnerability is fixed in firmware version 1.0.1.11 for the following Cisco products: RV132W ADSL2+ Wireless-N VPN Router and RV134W VDSL2 Wireless-AC VPN Router. Cisco Bug IDs: CSCvg92737, CSCvh60170.

cpe:/o:cisco:rv132w_firmware:1.0.0.1 cpe:/o:cisco:rv132w_firmware:1.0.1.8 cpe:/o:cisco:rv134w_firmware:1.0.0.1 cpe:/o:cisco:rv134w_firmware:1.0.1.8

CVE-2018-0127

2018-02-08T02:29:00.633-05:00

2019-10-09T19:31:17.347-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 102969 SECTRACK 1040345 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-rv13x_2 A vulnerability in the web interface of Cisco RV132W ADSL2+ Wireless-N VPN Routers and Cisco RV134W VDSL2 Wireless-AC VPN Routers could allow an unauthenticated, remote attacker to view configuration parameters for an affected device, which could lead to the disclosure of confidential information. The vulnerability is due to the absence of user authentication requirements for certain pages that are part of the web interface and contain confidential information for an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device and examining the HTTP response to the request. A successful exploit could allow the attacker to view configuration parameters, including the administrator password, for the affected device. Cisco Bug IDs: CSCvg92739, CSCvh60172.

cpe:/a:cisco:data_center_analytics_framework:-

CVE-2018-0128

2018-02-08T02:29:00.680-05:00

2019-10-09T19:31:17.503-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 102960 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-dcaf A vulnerability in the web-based management interface of Cisco Data Center Analytics Framework could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvh02082.

cpe:/a:cisco:data_center_analytics_framework:1.0

CVE-2018-0129

2018-02-08T02:29:00.743-05:00

2019-10-09T19:31:17.627-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 102959 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-dcaf1 A vulnerability in the web-based management interface of Cisco Data Center Analytics Framework could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvh02088.

cpe:/a:cisco:virtual_managed_services:3.0

CVE-2018-0130

2018-02-21T19:29:00.313-05:00

2019-10-09T19:31:17.723-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 103116 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-esc1 A vulnerability in the use of JSON web tokens by the web-based service portal of Cisco Elastic Services Controller Software could allow an unauthenticated, remote attacker to gain administrative access to an affected system. The vulnerability is due to the presence of static default credentials for the web-based service portal of the affected software. An attacker could exploit this vulnerability by extracting the credentials from an image of the affected software and using those credentials to generate a valid administrative session token for the web-based service portal of any other installation of the affected software. A successful exploit could allow the attacker to gain administrative access to the web-based service portal of an affected system. This vulnerability affects Cisco Elastic Services Controller Software Release 3.0.0. Cisco Bug IDs: CSCvg30884.

cpe:/o:cisco:ios:15.5%283%29s cpe:/o:cisco:ios_xe:15.5%283%29s

CVE-2018-0131

2018-08-14T12:29:00.223-04:00

2019-10-09T19:31:17.847-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 105074 SECTRACK 1041539 CISCO 20180813 Cisco IOS and IOS XE Software Internet Key Exchange Version 1 RSA-Encrypted Nonces Vulnerability A vulnerability in the implementation of RSA-encrypted nonces in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to obtain the encrypted nonces of an Internet Key Exchange Version 1 (IKEv1) session. The vulnerability exists because the affected software responds incorrectly to decryption failures. An attacker could exploit this vulnerability sending crafted ciphertexts to a device configured with IKEv1 that uses RSA-encrypted nonces. A successful exploit could allow the attacker to obtain the encrypted nonces. Cisco Bug IDs: CSCve77140.

cpe:/a:cisco:carrier_routing_system:5.3.0.rout

CVE-2018-0132

2018-02-08T02:29:00.790-05:00

2019-10-09T19:31:17.987-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 102975 SECTRACK 1040344 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-iosxr A vulnerability in the forwarding information base (FIB) code of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause inconsistency between the routing information base (RIB) and the FIB, resulting in a denial of service (DoS) condition. The vulnerability is due to incorrect processing of extremely long routing updates. An attacker could exploit this vulnerability by sending a large routing update. A successful exploit could allow the attacker to trigger inconsistency between the FIB and the RIB, resulting in a DoS condition. Cisco Bug IDs: CSCus84718.

cpe:/a:cisco:mobility_services_engine:13.0.0 cpe:/a:cisco:mobility_services_engine:13.1.0

CVE-2018-0134

2018-02-08T02:29:00.837-05:00

2019-10-09T19:31:18.127-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 102954 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-cps1 A vulnerability in the RADIUS authentication module of Cisco Policy Suite could allow an unauthenticated, remote attacker to determine whether a subscriber username is valid. The vulnerability occurs because the Cisco Policy Suite RADIUS server component returns different authentication failure messages based on the validity of usernames. An attacker could use these messages to determine whether a valid subscriber username has been identified. The attacker could use this information in subsequent attacks against the system. Cisco Bug IDs: CSCvg47830.

cpe:/a:cisco:unified_communications_manager:11.0%281.24075.1%29

CVE-2018-0135

2018-02-08T02:29:00.897-05:00

2019-10-09T19:31:18.237-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov BID 102964 SECTRACK 1040343 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-ucm A vulnerability in Cisco Unified Communications Manager could allow an authenticated, remote attacker to access sensitive information on an affected system. The vulnerability exists because the affected software improperly validates user-supplied search input. An attacker could exploit this vulnerability by sending malicious requests to an affected system. A successful exploit could allow the attacker to retrieve sensitive information from the affected system. Cisco Bug IDs: CSCvf17644.

cpe:/o:cisco:ios_xr:5.3.4

CVE-2018-0136

2018-01-31T15:29:00.663-05:00

2019-10-09T19:31:18.347-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 102905 SECTRACK 1040315 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180131-ipv6 A vulnerability in the IPv6 subsystem of Cisco IOS XR Software Release 5.3.4 for the Cisco Aggregation Services Router (ASR) 9000 Series could allow an unauthenticated, remote attacker to trigger a reload of one or more Trident-based line cards, resulting in a denial of service (DoS) condition. The vulnerability is due to incorrect handling of IPv6 packets with a fragment header extension. An attacker could exploit this vulnerability by sending IPv6 packets designed to trigger the issue either to or through the Trident-based line card. A successful exploit could allow the attacker to trigger a reload of Trident-based line cards, resulting in a DoS during the period of time the line card takes to restart. This vulnerability affects Cisco Aggregation Services Router (ASR) 9000 Series when the following conditions are met: The router is running Cisco IOS XR Software Release 5.3.4, and the router has installed Trident-based line cards that have IPv6 configured. A software maintenance upgrade (SMU) has been made available that addresses this vulnerability. The fix has also been incorporated into service pack 7 for Cisco IOS XR Software Release 5.3.4. Cisco Bug IDs: CSCvg46800.

cpe:/a:cisco:prime_network:4.3%280.0%29pp6 cpe:/a:cisco:prime_network:4.3%282.0%29pp1

CVE-2018-0137

2018-02-08T02:29:00.947-05:00

2019-10-09T19:31:18.473-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 102955 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-cpn A vulnerability in the TCP throttling process of Cisco Prime Network could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient rate limiting protection for TCP listening ports. An attacker could exploit this vulnerability by sending the affected device a high rate of TCP SYN packets to the local IP address of the targeted application. A successful exploit could allow the attacker to cause the device to consume a high amount of memory and become slow, or to stop accepting new TCP connections to the application. Cisco Bug IDs: CSCvg48152.

cpe:/a:cisco:firepower_threat_defense:6.1.0 cpe:/a:cisco:firepower_threat_defense:6.2.0 cpe:/a:cisco:firepower_threat_defense:6.2.2 cpe:/a:cisco:firepower_threat_defense:6.2.3

CVE-2018-0138

2018-02-08T02:29:00.977-05:00

2019-10-09T19:31:18.597-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 102978 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-fss A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass file policies that are configured to block files transmitted to an affected device via the BitTorrent protocol. The vulnerability exists because the affected software does not detect BitTorrent handshake messages correctly. An attacker could exploit this vulnerability by sending a crafted BitTorrent connection request to an affected device. A successful exploit could allow the attacker to bypass file policies that are configured to block files transmitted to the affected device via the BitTorrent protocol. Cisco Bug IDs: CSCve26946.

cpe:/a:cisco:unified_customer_voice_portal:11.5%281%29 cpe:/a:cisco:unified_customer_voice_portal:11.6

CVE-2018-0139

2018-02-21T19:29:00.377-05:00

2019-10-09T19:31:18.707-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 103124 SECTRACK 1040414 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-cvp A vulnerability in the Interactive Voice Response (IVR) management connection interface for Cisco Unified Customer Voice Portal (CVP) could allow an unauthenticated, remote attacker to cause the IVR connection to disconnect, creating a system-wide denial of service (DoS) condition. The vulnerability is due to improper handling of a TCP connection request when the IVR connection is already established. An attacker could exploit this vulnerability by initiating a crafted connection to the IP address of the targeted CVP device. An exploit could allow the attacker to disconnect the IVR to CVP connection, creating a DoS condition that prevents the CVP from accepting new, incoming calls while the IVR automatically attempts to re-establish the connection to the CVP. This vulnerability affects Cisco Unified Customer Voice Portal (CVP) Software Release 11.5(1). Cisco Bug IDs: CSCve70560.

cpe:/o:cisco:content_security_management_appliance:10.0.0-096 cpe:/o:cisco:content_security_management_appliance:10.1.0-037 cpe:/o:cisco:content_security_management_appliance:10.1.0-052 cpe:/o:cisco:content_security_management_appliance:11.0.0-115 cpe:/o:cisco:email_security_appliance_firmware:9.8.0-112 cpe:/o:cisco:email_security_appliance_firmware:10.0.1-087 cpe:/o:cisco:email_security_appliance_firmware:11.0.0-274

CVE-2018-0140

2018-02-08T02:29:01.053-05:00

2019-10-09T19:31:18.830-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov BID 103090 SECTRACK 1040338 SECTRACK 1040339 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-esacsm A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance could allow an authenticated, remote attacker to download any message from the spam quarantine by modifying browser string information. The vulnerability is due to a lack of verification of authenticated user accounts. An attacker could exploit this vulnerability by modifying browser strings to see messages submitted by other users to the spam quarantine within their company. Cisco Bug IDs: CSCvg39759, CSCvg42295.

cpe:/a:cisco:prime_collaboration:11.6 cpe:/a:cisco:prime_collaboration_assurance:11.6 cpe:/a:cisco:prime_collaboration_provisioning:11.6

CVE-2018-0141

2018-03-08T02:29:00.283-05:00

2019-10-09T19:31:18.973-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103329 SECTRACK 1040462 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-cpcp A vulnerability in Cisco Prime Collaboration Provisioning (PCP) Software 11.6 could allow an unauthenticated, local attacker to log in to the underlying Linux operating system. The vulnerability is due to a hard-coded account password on the system. An attacker could exploit this vulnerability by connecting to the affected system via Secure Shell (SSH) using the hard-coded credentials. A successful exploit could allow the attacker to access the underlying operating system as a low-privileged user. After low-level privileges are gained, the attacker could elevate to root privileges and take full control of the device. Cisco Bug IDs: CSCvc82982.

CVE-2018-0143

2019-03-21T11:28:19.963-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

cpe:/a:cisco:prime_data_center_network_manager:10.4%281.109%29

CVE-2018-0144

2018-03-08T02:29:00.330-05:00

2019-10-09T19:31:19.113-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103327 SECTRACK 1040469 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-pdcnm A vulnerability in the web-based management interface of Cisco Prime Data Center Network Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvg81051.

cpe:/a:cisco:data_center_analytics_framework:3.1

CVE-2018-0145

2018-02-21T19:29:00.423-05:00

2019-10-09T19:31:19.237-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103131 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-dcaf A vulnerability in the web-based management interface of the Cisco Data Center Analytics Framework application could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information on the affected system. Cisco Bug IDs: CSCvg45105.

cpe:/a:cisco:data_center_analytics_framework:3.1

CVE-2018-0146

2018-02-21T19:29:00.470-05:00

2019-10-09T19:31:19.333-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103122 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-dcaf1 A vulnerability in the Cisco Data Center Analytics Framework application could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to improper CSRF protection by the affected application. An attacker could exploit this vulnerability by persuading a user of the affected application to click a malicious link. A successful exploit could allow the attacker to submit arbitrary requests and take unauthorized actions on behalf of the user. Cisco Bug IDs: CSCvg45114.

cpe:/a:cisco:secure_access_control_system:5.2%280.3%29

CVE-2018-0147

2018-03-08T02:29:00.377-05:00

2019-10-09T19:31:19.457-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103328 SECTRACK 1040463 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-acs2 A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a crafted serialized Java object. An exploit could allow the attacker to execute arbitrary commands on the device with root privileges. Cisco Bug IDs: CSCvh25988.

cpe:/a:cisco:ucs_director:6.5%280.0.65832%29

CVE-2018-0148

2018-02-21T19:29:00.533-05:00

2019-10-09T19:31:19.583-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 103141 SECTRACK 1040412 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-ucsd A vulnerability in the web-based management interface of Cisco UCS Director Software and Cisco Integrated Management Controller (IMC) Supervisor Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protection by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the affected interface to click a malicious link. A successful exploit could allow the attacker to perform arbitrary actions, via the user's web browser and with the user's privileges, on an affected system. Cisco Bug IDs: CSCvf71929.

cpe:/a:cisco:integrated_management_controller_supervisor:2.1%280.2%29 cpe:/a:cisco:integrated_management_controller_supervisor:2.2%280.2%29

CVE-2018-0149

2018-06-07T17:29:00.307-04:00

2019-10-09T19:31:19.690-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104444 SECTRACK 1041072 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-ucsdimcs A vulnerability in the web-based management interface of Cisco Integrated Management Controller Supervisor Software and Cisco UCS Director Software could allow an authenticated, remote attacker to conduct a Document Object Model-based (DOM-based), stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the affected interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or allow the attacker to access sensitive browser-based information on the affected device. Cisco Bug IDs: CSCvh12994.

cpe:/o:cisco:ios_xe:16.5.1 cpe:/o:cisco:ios_xe:everest-16.5.1

CVE-2018-0150

2018-03-28T18:29:00.217-04:00

2019-10-09T19:31:19.800-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103539 SECTRACK 1040579 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-xesc A vulnerability in Cisco IOS XE Software could allow an unauthenticated, remote attacker to log in to a device running an affected release of Cisco IOS XE Software with the default username and password that are used at initial boot, aka a Static Credential Vulnerability. The vulnerability is due to an undocumented user account with privilege level 15 that has a default username and password. An attacker could exploit this vulnerability by using this account to remotely connect to an affected device. A successful exploit could allow the attacker to log in to the device with privilege level 15 access. This vulnerability affects Cisco devices that are running a vulnerable release of Cisco IOS XE Software Release 16.x. This vulnerability does not affect Cisco IOS XE Software releases prior to Release 16.x. Cisco Bug IDs: CSCve89880.

cpe:/o:cisco:ios:everest-16.5.1 cpe:/o:cisco:ios_xe:-

CVE-2018-0151

2018-03-28T18:29:00.297-04:00

2019-10-09T19:31:19.940-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103540 SECTRACK 1040582 MISC https://ics-cert.us-cert.gov/advisories/ICSA-18-107-03 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-qos A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges. The vulnerability is due to incorrect bounds checking of certain values in packets that are destined for UDP port 18999 of an affected device. An attacker could exploit this vulnerability by sending malicious packets to an affected device. When the packets are processed, an exploitable buffer overflow condition may occur. A successful exploit could allow the attacker to execute arbitrary code on the affected device with elevated privileges. The attacker could also leverage this vulnerability to cause the device to reload, causing a temporary DoS condition while the device is reloading. The malicious packets must be destined to and processed by an affected device. Traffic transiting a device will not trigger the vulnerability. Cisco Bug IDs: CSCvf73881.

cpe:/o:cisco:ios:16.6.1 cpe:/o:cisco:ios:everest-16.6.1 cpe:/o:cisco:ios_xe:16.1.1

CVE-2018-0152

2018-03-28T18:29:00.343-04:00

2019-10-09T19:31:20.050-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov BID 103558 SECTRACK 1040597 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-xepriv A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to gain elevated privileges on an affected device. The vulnerability exists because the affected software does not reset the privilege level for each web UI session. An attacker who has valid credentials for an affected device could exploit this vulnerability by remotely accessing a VTY line to the device. A successful exploit could allow the attacker to access an affected device with the privileges of the user who previously logged in to the web UI. This vulnerability affects Cisco devices that are running a vulnerable release of Cisco IOS XE Software, if the HTTP Server feature is enabled and authentication, authorization, and accounting (AAA) authorization is not configured for EXEC sessions. The default state of the HTTP Server feature is version-dependent. This vulnerability was introduced in Cisco IOS XE Software Release 16.1.1. Cisco Bug IDs: CSCvf71769.

CVE-2018-0153

2019-03-21T11:28:19.980-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

cpe:/o:cisco:ios:-

CVE-2018-0154

2018-03-28T18:29:00.373-04:00

2019-10-09T19:31:20.190-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103559 SECTRACK 1040585 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dos A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient handling of VPN traffic by the affected device. An attacker could exploit this vulnerability by sending crafted VPN traffic to an affected device. A successful exploit could allow the attacker to cause the affected device to hang or crash, resulting in a DoS condition. Cisco Bug IDs: CSCvd39267.

cpe:/o:cisco:ios:3.6%282%29e cpe:/o:cisco:ios_xe:3.6%282%29e

CVE-2018-0155

2018-03-28T18:29:00.420-04:00

2019-10-09T19:31:20.347-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103565 SECTRACK 1040587 MISC https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-bfd A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the iosd process, causing a denial of service (DoS) condition. The vulnerability is due to insufficient error handling when the BFD header in a BFD packet is incomplete. An attacker could exploit this vulnerability by sending a crafted BFD message to or across an affected switch. A successful exploit could allow the attacker to trigger a reload of the system. This vulnerability affects Catalyst 4500 Supervisor Engine 6-E (K5), Catalyst 4500 Supervisor Engine 6L-E (K10), Catalyst 4500 Supervisor Engine 7-E (K10), Catalyst 4500 Supervisor Engine 7L-E (K10), Catalyst 4500E Supervisor Engine 8-E (K10), Catalyst 4500E Supervisor Engine 8L-E (K10), Catalyst 4500E Supervisor Engine 9-E (K10), Catalyst 4500-X Series Switches (K10), Catalyst 4900M Switch (K5), Catalyst 4948E Ethernet Switch (K5). Cisco Bug IDs: CSCvc40729.

cpe:/o:cisco:ios:15.2%282%29e4 cpe:/o:cisco:ios:15.2%282a%29ja cpe:/o:cisco:ios_xe:15.2%282%29e4 cpe:/o:cisco:ios_xe:15.2%282a%29ja

CVE-2018-0156

2018-03-28T18:29:00.467-04:00

2019-10-09T19:31:20.520-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103569 SECTRACK 1040596 MISC https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04 MISC https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted packet to an affected device on TCP port 4786. Only Smart Install client switches are affected. Cisco devices that are configured as a Smart Install director are not affected by this vulnerability. Cisco Bug IDs: CSCvd40673.

cpe:/o:cisco:ios_xe:everest-16.4.1 cpe:/o:cisco:ios_xe:everest-16.4.2 cpe:/o:cisco:ios_xe:everest-16.5.1 cpe:/o:cisco:ios_xe:everest-16.5.1b cpe:/o:cisco:ios_xe:everest-16.6.1 cpe:/o:cisco:ios_xe:everest-16.6.1a

CVE-2018-0157

2018-03-28T18:29:00.500-04:00

2019-10-09T19:31:21.020-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103561 SECTRACK 1040593 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-fwip A vulnerability in the Zone-Based Firewall code of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a device to reload. The vulnerability is due to the way fragmented packets are handled in the firewall code. An attacker could exploit this vulnerability by sending fragmented IP Version 4 or IP Version 6 packets through an affected device. An exploit could allow the attacker to cause the device to crash, resulting in a denial of service (DoS) condition. The following releases of Cisco IOS XE Software are vulnerable: Everest-16.4.1, Everest-16.4.2, Everest-16.5.1, Everest-16.5.1b, Everest-16.6.1, Everest-16.6.1a. Cisco Bug IDs: CSCvf60296.

cpe:/o:cisco:ios:15.5%283%29s1.1 cpe:/o:cisco:ios:15.5%283%29s1.2 cpe:/o:cisco:ios:15.5%283%29s1.4 cpe:/o:cisco:ios:15.5%283%29s1.5 cpe:/o:cisco:ios:15.5%283%29s1.7 cpe:/o:cisco:ios:15.5%283%29s1.8 cpe:/o:cisco:ios:15.5%283%29s1.9 cpe:/o:cisco:ios:15.5%283%29s1.10 cpe:/o:cisco:ios:15.5%283%29s1.11 cpe:/o:cisco:ios:15.5%283%29s1.12 cpe:/o:cisco:ios_xe:15.5%283%29s1.1 cpe:/o:cisco:ios_xe:15.5%283%29s1.2 cpe:/o:cisco:ios_xe:15.5%283%29s1.4 cpe:/o:cisco:ios_xe:15.5%283%29s1.5 cpe:/o:cisco:ios_xe:15.5%283%29s1.7 cpe:/o:cisco:ios_xe:15.5%283%29s1.8 cpe:/o:cisco:ios_xe:15.5%283%29s1.9 cpe:/o:cisco:ios_xe:15.5%283%29s1.10 cpe:/o:cisco:ios_xe:15.5%283%29s1.11 cpe:/o:cisco:ios_xe:15.5%283%29s1.12

CVE-2018-0158

2018-03-28T18:29:00.547-04:00

2019-10-09T19:31:21.130-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103566 SECTRACK 1040595 MISC https://ics-cert.us-cert.gov/advisories/ICSA-18-107-03 MISC https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-ike A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak or a reload of an affected device that leads to a denial of service (DoS) condition. The vulnerability is due to incorrect processing of certain IKEv2 packets. An attacker could exploit this vulnerability by sending crafted IKEv2 packets to an affected device to be processed. A successful exploit could cause an affected device to continuously consume memory and eventually reload, resulting in a DoS condition. Cisco Bug IDs: CSCvf22394.

cpe:/o:cisco:ios:15.3%283%29s cpe:/o:cisco:ios_xe:15.3%283%29s

CVE-2018-0159

2018-03-28T18:29:00.593-04:00

2019-10-09T19:31:21.347-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103562 SECTRACK 1040595 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-ike-dos A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of specific IKEv1 packets. An attacker could exploit this vulnerability by sending crafted IKEv1 packets to an affected device during an IKE negotiation. A successful exploit could allow the attacker to cause an affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCuj73916.

cpe:/o:cisco:ios_xe:15.5%283%29s

CVE-2018-0160

2018-03-28T18:29:00.657-04:00

2019-10-09T19:31:21.487-04:00

6.3

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov BID 103575 SECTRACK 1040584 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-snmp-dos A vulnerability in Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to improper management of memory resources, referred to as a double free. An attacker could exploit this vulnerability by sending crafted SNMP packets to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. To exploit this vulnerability via SNMP Version 2c or earlier, the attacker must know the SNMP read-only community string for an affected system. To exploit this vulnerability via SNMP Version 3, the attacker must know the user credentials for the affected system. This vulnerability affects Cisco devices that are running a vulnerable release of Cisco IOS XE Software, have been configured to be queried over SNMP, and have Network Address Translation (NAT) enabled. Cisco Bug IDs: CSCve75818.

cpe:/o:cisco:ios:15.2%285%29e

CVE-2018-0161

2018-03-28T18:29:00.703-04:00

2019-10-02T20:03:26.223-04:00

6.3

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov BID 103573 SECTRACK 1040589 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-snmp A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco Catalyst Switches could allow an authenticated, remote attacker to cause a denial of service (DoS) condition, aka a GET MIB Object ID Denial of Service Vulnerability. The vulnerability is due to a condition that could occur when the affected software processes an SNMP read request that contains a request for the ciscoFlashMIB object ID (OID). An attacker could trigger this vulnerability by issuing an SNMP GET request for the ciscoFlashMIB OID on an affected device. A successful exploit could cause the affected device to restart due to a SYS-3-CPUHOG. This vulnerability affects the following Cisco devices if they are running a vulnerable release of Cisco IOS Software and are configured to use SNMP Version 2 (SNMPv2) or SNMP Version 3 (SNMPv3): Cisco Catalyst 2960-L Series Switches, Cisco Catalyst Digital Building Series Switches 8P, Cisco Catalyst Digital Building Series Switches 8U. Cisco Bug IDs: CSCvd89541.

cpe:/o:cisco:ios:15.4%283%29m6 cpe:/o:cisco:ios:15.4%283%29m6a cpe:/o:cisco:ios:15.4%283%29m7 cpe:/o:cisco:ios:15.4%283%29m7a cpe:/o:cisco:ios:15.4%283%29m8 cpe:/o:cisco:ios:15.4%283.0i%29m6 cpe:/o:cisco:ios:15.5%283%29m3 cpe:/o:cisco:ios:15.5%283%29m4 cpe:/o:cisco:ios:15.5%283%29m4a cpe:/o:cisco:ios:15.5%283%29m4b cpe:/o:cisco:ios:15.5%283%29m4c cpe:/o:cisco:ios:15.5%283%29m5 cpe:/o:cisco:ios:15.5%283%29m5a cpe:/o:cisco:ios:15.5%283%29m6 cpe:/o:cisco:ios:15.5%283%29m6a cpe:/o:cisco:ios:15.6%281%29t2 cpe:/o:cisco:ios:15.6%281%29t3 cpe:/o:cisco:ios:15.6%282%29t1 cpe:/o:cisco:ios:15.6%282%29t2 cpe:/o:cisco:ios:15.6%282%29t3 cpe:/o:cisco:ios:15.6%283%29m cpe:/o:cisco:ios:15.6%283%29m0a cpe:/o:cisco:ios:15.6%283%29m1 cpe:/o:cisco:ios:15.6%283%29m1a cpe:/o:cisco:ios:15.6%283%29m1b cpe:/o:cisco:ios:15.6%283%29m2 cpe:/o:cisco:ios:15.6%283%29m2a cpe:/o:cisco:ios:15.6%283%29m3 cpe:/o:cisco:ios:15.6%283%29m3a cpe:/o:cisco:ios:15.7%283%29m cpe:/o:cisco:ios:15.7%283%29m0a cpe:/o:cisco:ios:15.7%283%29m1 cpe:/o:cisco:ios:15.7%283%29m2

CVE-2018-0163

2018-03-28T18:29:00.750-04:00

2019-10-09T19:31:21.707-04:00

3.3

ADJACENT_NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103571 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dot1x A vulnerability in the 802.1x multiple-authentication (multi-auth) feature of Cisco IOS Software could allow an unauthenticated, adjacent attacker to bypass the authentication phase on an 802.1x multi-auth port. The vulnerability is due to a logic change error introduced into the code. An attacker could exploit this vulnerability by trying to access an 802.1x multi-auth port after a successful supplicant has authenticated. An exploit could allow the attacker to bypass the 802.1x access controls and obtain access to the network. Cisco Bug IDs: CSCvg69701.

cpe:/o:cisco:ios_xe:15.6%282%29sp

CVE-2018-0164

2018-03-28T18:29:00.797-04:00

2019-10-09T19:31:21.940-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103553 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-sisf A vulnerability in the Switch Integrated Security Features of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an interface queue wedge. The vulnerability is due to incorrect handling of crafted IPv6 packets. An attacker could exploit this vulnerability by sending crafted IPv6 packets through the device. An exploit could allow the attacker to cause an interface queue wedge. This vulnerability affects the Cisco cBR-8 Converged Broadband Router, Cisco ASR 1000 Series Aggregation Services Routers, and Cisco Cloud Services Router 1000V Series when configured with IPv6. In the field and internal testing, this vulnerability was only observed or reproduced on the Cisco cBR-8 Converged Broadband Router. The Cisco ASR 1000 Series Aggregation Services Routers and Cisco Cloud Services Router 1000V Series contain the same code logic, so affected trains have had the code fix applied; however, on these two products, the vulnerability has not been observed in the field or successfully reproduced internally. Cisco Bug IDs: CSCvd75185.

cpe:/o:cisco:ios_xe:15.2%283%29e cpe:/o:cisco:ios_xe:denali-16.3.3

CVE-2018-0165

2018-03-28T18:29:00.860-04:00

2019-10-09T19:31:22.067-04:00

6.1

ADJACENT_NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103568 SECTRACK 1040592 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-igmp A vulnerability in the Internet Group Management Protocol (IGMP) packet-processing functionality of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to exhaust buffers on an affected device, resulting in a denial of service (DoS) condition, aka a Memory Leak. The vulnerability is due to the affected software insufficiently processing IGMP Membership Query packets that are sent to an affected device. An attacker could exploit this vulnerability by sending a large number of IGMP Membership Query packets, which contain certain values, to an affected device. A successful exploit could allow the attacker to exhaust buffers on the affected device, resulting in a DoS condition that requires the device to be reloaded manually. This vulnerability affects: Cisco Catalyst 4500 Switches with Supervisor Engine 8-E, if they are running Cisco IOS XE Software Release 3.x.x.E and IP multicast routing is configured; Cisco devices that are running Cisco IOS XE Software Release 16.x, if IP multicast routing is configured. Cisco Bug IDs: CSCuw09295, CSCve94496.

cpe:/o:cisco:ios:5.2.0.base cpe:/o:cisco:ios_xe:5.2.0.base cpe:/o:cisco:ios_xr:5.2.0.base

CVE-2018-0167

2018-03-28T18:29:00.907-04:00

2019-10-09T19:31:22.237-04:00

8.3

ADJACENT_NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103564 SECTRACK 1040586 MISC https://ics-cert.us-cert.gov/advisories/ICSA-18-107-03 MISC https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04 MISC https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-lldp Multiple Buffer Overflow vulnerabilities in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. Cisco Bug IDs: CSCuo17183, CSCvd73487.

cpe:/o:cisco:ios:15.0%285.59%29emd

CVE-2018-0169

2018-03-28T18:29:00.967-04:00

2019-10-09T19:31:22.410-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103567 SECTRACK 1040583 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-privesc1 Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the underlying Linux shell of an affected device and execute arbitrary commands with root privileges on the device. The vulnerabilities are due to the affected software improperly sanitizing command arguments to prevent access to internal data structures on a device. An attacker who has user EXEC mode (privilege level 1) access to an affected device could exploit these vulnerabilities on the device by executing CLI commands that contain crafted arguments. A successful exploit could allow the attacker to gain access to the underlying Linux shell of the affected device and execute arbitrary commands with root privileges on the device. Cisco Bug IDs: CSCtw85441, CSCus42252, CSCuv95370.

cpe:/o:cisco:ios_xe:16.4%281%29

CVE-2018-0170

2018-03-28T18:29:01.017-04:00

2019-10-09T19:31:22.520-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103560 SECTRACK 1040590 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-opendns-dos A vulnerability in the Cisco Umbrella Integration feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition, related to the OpenDNS software. The vulnerability is due to a logic error that exists when handling a malformed incoming packet, leading to access to an internal data structure after it has been freed. An attacker could exploit this vulnerability by sending crafted, malformed IP packets to an affected device. A successful exploit could allow the attacker to cause an affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCvb86327.

cpe:/o:cisco:ios:15.2%285%29e

CVE-2018-0171

2018-03-28T18:29:01.063-04:00

2019-10-09T19:31:22.643-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103538 SECTRACK 1040580 MISC https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04 MISC https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2 MISC https://www.darkreading.com/perimeter/attackers-exploit-cisco-switch-issue-as-vendor-warns-of-yet-another-critical-flaw/d/d-id/1331490 A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition, or to execute arbitrary code on an affected device. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted Smart Install message to an affected device on TCP port 4786. A successful exploit could allow the attacker to cause a buffer overflow on the affected device, which could have the following impacts: Triggering a reload of the device, Allowing the attacker to execute arbitrary code on the device, Causing an indefinite loop on the affected device that triggers a watchdog crash. Cisco Bug IDs: CSCvg76186.

cpe:/o:cisco:ios:- cpe:/o:cisco:ios_xe:-

CVE-2018-0172

2018-03-28T18:29:01.110-04:00

2019-10-09T19:31:22.770-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103552 SECTRACK 1040591 MISC https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04 MISC https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr1 MISC https://www.tenable.com/security/research/tra-2018-06 A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software performs incomplete input validation of option 82 information that it receives in DHCP Version 4 (DHCPv4) packets from DHCP relay agents. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device. A successful exploit could allow the attacker to cause a heap overflow condition on the affected device, which will cause the device to reload and result in a DoS condition. Cisco Bug IDs: CSCvg62730.

cpe:/o:cisco:ios:denali-16.3.4 cpe:/o:cisco:ios_xe:denali-16.3.4

CVE-2018-0173

2018-03-28T18:29:01.170-04:00

2019-10-09T19:31:22.940-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103545 SECTRACK 1040591 MISC https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04 MISC https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr2 MISC https://www.tenable.com/security/research/tra-2018-06 A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a Relay Reply denial of service (DoS) condition. The vulnerability exists because the affected software performs incomplete input validation of encapsulated option 82 information that it receives in DHCPOFFER messages from DHCPv4 servers. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device, which the device would then forward to a DHCPv4 server. When the affected software processes the option 82 information that is encapsulated in the response from the server, an error could occur. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCvg62754.

cpe:/o:cisco:ios:12.2%2833%29sre7a cpe:/o:cisco:ios_xe:12.2%2833%29sre7a

CVE-2018-0174

2018-03-28T18:29:01.233-04:00

2019-10-09T19:31:23.190-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103554 SECTRACK 1040591 MISC https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04 MISC https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr3 MISC https://www.tenable.com/security/research/tra-2018-06 A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software performs incomplete input validation of option 82 information that it receives in DHCP Version 4 (DHCPv4) packets from DHCP relay agents. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCuh91645.

cpe:/o:cisco:ios:15.4%283%29m4.1 cpe:/o:cisco:ios_xe:15.4%283%29m4.1 cpe:/o:cisco:ios_xr:15.4%283%29m4.1

CVE-2018-0175

2018-03-28T18:29:01.280-04:00

2019-10-09T19:31:23.347-04:00

7.9

ADJACENT_NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 103564 SECTRACK 1040586 MISC https://ics-cert.us-cert.gov/advisories/ICSA-18-107-03 MISC https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04 MISC https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-lldp Format String vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. Cisco Bug IDs: CSCvd73664.

cpe:/o:cisco:ios_xe:15.0%285.59%29emd cpe:/o:cisco:ios_xe:16.1%280%29 cpe:/o:cisco:ios_xe:16.2%280%29

CVE-2018-0176

2018-03-28T18:29:01.343-04:00

2019-10-09T19:31:23.487-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

cpe:/o:cisco:ios_xe:denali-16.3.1 cpe:/o:cisco:ios_xe:denali-16.3.3

CVE-2018-0177

2018-03-28T18:29:01.407-04:00

2019-10-09T19:31:23.597-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103563 SECTRACK 1040588 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-ipv4 A vulnerability in the IP Version 4 (IPv4) processing code of Cisco IOS XE Software running on Cisco Catalyst 3850 and Cisco Catalyst 3650 Series Switches could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that leads to a denial of service (DoS) condition. The vulnerability is due to incorrect processing of certain IPv4 packets. An attacker could exploit this vulnerability by sending specific IPv4 packets to an IPv4 address on an affected device. A successful exploit could allow the attacker to cause high CPU utilization, traceback messages, or a reload of the affected device that leads to a DoS condition. If the switch does not reboot when under attack, it would require manual intervention to reload the device. This vulnerability affects Cisco Catalyst 3850 and Cisco Catalyst 3650 Series Switches that are running Cisco IOS XE Software Release 16.1.1 or later, until the first fixed release, and are configured with an IPv4 address. Cisco Bug IDs: CSCvd80714.

cpe:/o:cisco:ios:15.3%280.0.19%29sy cpe:/o:cisco:ios:15.4%281%29ia1.100 cpe:/o:cisco:ios:15.4%282%29s cpe:/o:cisco:ios:15.4%282%29s1 cpe:/o:cisco:ios:15.4%282%29s2 cpe:/o:cisco:ios:15.4%282%29t cpe:/o:cisco:ios:15.4%282%29t1 cpe:/o:cisco:ios:15.4%282%29t2 cpe:/o:cisco:ios:15.4%282%29t3 cpe:/o:cisco:ios:15.4%282%29t4 cpe:/o:cisco:ios:15.4%283%29m cpe:/o:cisco:ios:15.4%283%29m2.2 cpe:/o:cisco:ios:15.4%283%29m3 cpe:/o:cisco:ios:15.4%283%29m4 cpe:/o:cisco:ios:15.4%283%29m4.1 cpe:/o:cisco:ios:15.4%283%29m5 cpe:/o:cisco:ios:15.4%283%29m6 cpe:/o:cisco:ios:15.4%283%29m7 cpe:/o:cisco:ios:15.4%283%29s cpe:/o:cisco:ios:15.4%283%29s1 cpe:/o:cisco:ios:15.4%283%29s7 cpe:/o:cisco:ios:15.4%283%29sn1 cpe:/o:cisco:ios:15.4s cpe:/o:cisco:ios:15.4sn cpe:/o:cisco:ios:15.4t cpe:/o:cisco:ios:15.5%281%29s cpe:/o:cisco:ios:15.5%281%29s2 cpe:/o:cisco:ios:15.5%281%29s3 cpe:/o:cisco:ios:15.5%281%29s4 cpe:/o:cisco:ios:15.5%281%29sy cpe:/o:cisco:ios:15.5%281%29t cpe:/o:cisco:ios:15.5%281%29t1 cpe:/o:cisco:ios:15.5%281%29t2 cpe:/o:cisco:ios:15.5%281%29t3 cpe:/o:cisco:ios:15.5%281%29t4 cpe:/o:cisco:ios:15.5%282%29s cpe:/o:cisco:ios:15.5%282%29s1 cpe:/o:cisco:ios:15.5%282%29s2 cpe:/o:cisco:ios:15.5%282%29s3 cpe:/o:cisco:ios:15.5%282%29s4 cpe:/o:cisco:ios:15.5%282%29t cpe:/o:cisco:ios:15.5%282%29t1 cpe:/o:cisco:ios:15.5%282%29t2 cpe:/o:cisco:ios:15.5%282%29t3 cpe:/o:cisco:ios:15.5%282%29t4 cpe:/o:cisco:ios:15.5%282.25%29t cpe:/o:cisco:ios:15.5%283%29m cpe:/o:cisco:ios:15.5%283%29m0a cpe:/o:cisco:ios:15.5%283%29m1 cpe:/o:cisco:ios:15.5%283%29m4 cpe:/o:cisco:ios:15.5%283%29m5 cpe:/o:cisco:ios:15.5%283%29m6 cpe:/o:cisco:ios:15.5%283%29s cpe:/o:cisco:ios:15.5%283%29s0a cpe:/o:cisco:ios:15.5%283%29s1 cpe:/o:cisco:ios:15.5%283%29s1a cpe:/o:cisco:ios:15.5%283%29s3.16 cpe:/o:cisco:ios:15.5%283%29sn cpe:/o:cisco:ios:15.5s cpe:/o:cisco:ios:15.5t cpe:/o:cisco:ios:15.6%280.17%29t cpe:/o:cisco:ios:15.6%281%29t0a cpe:/o:cisco:ios:15.6%281.22%29t cpe:/o:cisco:ios:15.6%282%29sn cpe:/o:cisco:ios:15.6%282%29sp cpe:/o:cisco:ios:15.6%282%29sp1 cpe:/o:cisco:ios:15.6%283%29m cpe:/o:cisco:ios:15.6%283%29m1b cpe:/o:cisco:ios:15.6%283%29m2 cpe:/o:cisco:ios:15.6%283%29m2a cpe:/o:cisco:ios:15.6%283%29m3 cpe:/o:cisco:ios:15.7%282.0z%29m cpe:/o:cisco:ios:16.1%280%29

CVE-2018-0179

2018-03-28T18:29:01.467-04:00

2019-10-09T19:31:23.817-04:00

7.1

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 103556 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-slogin Multiple vulnerabilities in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a reload of an affected system, resulting in a denial of service (DoS) condition. These vulnerabilities affect Cisco devices that are running Cisco IOS Software Release 15.4(2)T, 15.4(3)M, or 15.4(2)CG and later. Cisco Bug IDs: CSCuy32360, CSCuz60599.

CVE-2018-0180

2018-03-28T18:29:01.547-04:00

2019-10-09T19:31:24.037-04:00

7.1

NETWORK

MEDIUM

NONE

COMPLETE

cpe:/a:cisco:cisco_policy_suite_diameter_routing_agent:- cpe:/a:cisco:cisco_policy_suite_for_mobile:13.0.0

CVE-2018-0181

2019-01-09T19:29:00.250-05:00

2019-10-09T19:31:24.270-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 106547 CISCO 20190109 Cisco Policy Suite for Mobile and Cisco Policy Suite Diameter Routing Agent Software Redis Server Unauthenticated Access Vulnerability A vulnerability in the Redis implementation used by the Cisco Policy Suite for Mobile and Cisco Policy Suite Diameter Routing Agent software could allow an unauthenticated, remote attacker to modify key-value pairs for short-lived events stored by the Redis server. The vulnerability is due to improper authentication when accessing the Redis server. An unauthenticated attacker could exploit this vulnerability by modifying key-value pairs stored within the Redis server database. An exploit could allow the attacker to reduce the efficiency of the Cisco Policy Suite for Mobile and Cisco Policy Suite Diameter Routing Agent software.

cpe:/o:cisco:ios_xe:- cpe:/o:cisco:ios_xe:2.1.0 cpe:/o:cisco:ios_xe:2.1.1 cpe:/o:cisco:ios_xe:2.1.2 cpe:/o:cisco:ios_xe:2.2.1 cpe:/o:cisco:ios_xe:2.2.2 cpe:/o:cisco:ios_xe:2.2.3 cpe:/o:cisco:ios_xe:2.3.0 cpe:/o:cisco:ios_xe:2.3.0t cpe:/o:cisco:ios_xe:2.3.1 cpe:/o:cisco:ios_xe:2.3.1t cpe:/o:cisco:ios_xe:2.3.2 cpe:/o:cisco:ios_xe:2.4.0 cpe:/o:cisco:ios_xe:2.4.1 cpe:/o:cisco:ios_xe:2.4.2 cpe:/o:cisco:ios_xe:2.4.3 cpe:/o:cisco:ios_xe:2.4.4 cpe:/o:cisco:ios_xe:2.5%28.0%29 cpe:/o:cisco:ios_xe:2.5.0 cpe:/o:cisco:ios_xe:2.5.1 cpe:/o:cisco:ios_xe:2.5.2 cpe:/o:cisco:ios_xe:2.6%28.0%29 cpe:/o:cisco:ios_xe:2.6%28.1%29 cpe:/o:cisco:ios_xe:2.6%28.2%29 cpe:/o:cisco:ios_xe:2.6.0 cpe:/o:cisco:ios_xe:2.6.1 cpe:/o:cisco:ios_xe:2.6.2 cpe:/o:cisco:ios_xe:2.6.2a cpe:/o:cisco:ios_xe:3.1.0s cpe:/o:cisco:ios_xe:3.1.0sg cpe:/o:cisco:ios_xe:3.1.1s cpe:/o:cisco:ios_xe:3.1.1sg cpe:/o:cisco:ios_xe:3.1.2s cpe:/o:cisco:ios_xe:3.1.3s cpe:/o:cisco:ios_xe:3.1.4s cpe:/o:cisco:ios_xe:3.1s cpe:/o:cisco:ios_xe:3.1s%28.0%29 cpe:/o:cisco:ios_xe:3.1s%28.1%29 cpe:/o:cisco:ios_xe:3.1s%28.2%29 cpe:/o:cisco:ios_xe:3.1s%28.3%29 cpe:/o:cisco:ios_xe:3.1s.0 cpe:/o:cisco:ios_xe:3.1s.1 cpe:/o:cisco:ios_xe:3.1s.2 cpe:/o:cisco:ios_xe:3.1s.3 cpe:/o:cisco:ios_xe:3.1s.4 cpe:/o:cisco:ios_xe:3.1s.4a cpe:/o:cisco:ios_xe:3.1s.5 cpe:/o:cisco:ios_xe:3.1s.6 cpe:/o:cisco:ios_xe:3.1sg cpe:/o:cisco:ios_xe:3.1sg.0 cpe:/o:cisco:ios_xe:3.1sg.1 cpe:/o:cisco:ios_xe:3.2.00.xo.15.0%282%29xo cpe:/o:cisco:ios_xe:3.2.0s cpe:/o:cisco:ios_xe:3.2.0sg cpe:/o:cisco:ios_xe:3.2.0xo cpe:/o:cisco:ios_xe:3.2.1s cpe:/o:cisco:ios_xe:3.2.1sg cpe:/o:cisco:ios_xe:3.2.2s cpe:/o:cisco:ios_xe:3.2.2sg cpe:/o:cisco:ios_xe:3.2.3sg cpe:/o:cisco:ios_xe:3.2.4sg cpe:/o:cisco:ios_xe:3.2.11sg cpe:/o:cisco:ios_xe:3.2ja cpe:/o:cisco:ios_xe:3.2s cpe:/o:cisco:ios_xe:3.2s%28.0%29 cpe:/o:cisco:ios_xe:3.2s%28.1%29 cpe:/o:cisco:ios_xe:3.2s%28.2%29 cpe:/o:cisco:ios_xe:3.2s.0 cpe:/o:cisco:ios_xe:3.2s.1 cpe:/o:cisco:ios_xe:3.2s.2 cpe:/o:cisco:ios_xe:3.2s.3 cpe:/o:cisco:ios_xe:3.2se cpe:/o:cisco:ios_xe:3.2se.0 cpe:/o:cisco:ios_xe:3.2se.1 cpe:/o:cisco:ios_xe:3.2se.2 cpe:/o:cisco:ios_xe:3.2se.3 cpe:/o:cisco:ios_xe:3.2sg cpe:/o:cisco:ios_xe:3.2sg.0 cpe:/o:cisco:ios_xe:3.2sg.1 cpe:/o:cisco:ios_xe:3.2sg.2 cpe:/o:cisco:ios_xe:3.2sg.3 cpe:/o:cisco:ios_xe:3.2sg.4 cpe:/o:cisco:ios_xe:3.2sg.5 cpe:/o:cisco:ios_xe:3.2sg.6 cpe:/o:cisco:ios_xe:3.2sg.7 cpe:/o:cisco:ios_xe:3.2sg.8 cpe:/o:cisco:ios_xe:3.2sg.9 cpe:/o:cisco:ios_xe:3.2xo cpe:/o:cisco:ios_xe:3.2xo.0 cpe:/o:cisco:ios_xe:3.2xo.1 cpe:/o:cisco:ios_xe:3.3.0s cpe:/o:cisco:ios_xe:3.3.0sg cpe:/o:cisco:ios_xe:3.3.1s cpe:/o:cisco:ios_xe:3.3.1sg cpe:/o:cisco:ios_xe:3.3.2s cpe:/o:cisco:ios_xe:3.3.2sg cpe:/o:cisco:ios_xe:3.3.3s cpe:/o:cisco:ios_xe:3.3s cpe:/o:cisco:ios_xe:3.3s%28.0%29 cpe:/o:cisco:ios_xe:3.3s%28.1%29 cpe:/o:cisco:ios_xe:3.3s%28.2%29 cpe:/o:cisco:ios_xe:3.3s.0 cpe:/o:cisco:ios_xe:3.3s.1 cpe:/o:cisco:ios_xe:3.3s.2 cpe:/o:cisco:ios_xe:3.3s_3.3.0s cpe:/o:cisco:ios_xe:3.3s_3.3.1s cpe:/o:cisco:ios_xe:3.3s_3.3.2s cpe:/o:cisco:ios_xe:3.3se cpe:/o:cisco:ios_xe:3.3sg cpe:/o:cisco:ios_xe:3.3sg.0 cpe:/o:cisco:ios_xe:3.3sg.1 cpe:/o:cisco:ios_xe:3.3sg.2 cpe:/o:cisco:ios_xe:3.3sg_3.3.0sg cpe:/o:cisco:ios_xe:3.3sg_3.3.1sg cpe:/o:cisco:ios_xe:3.3sg_3.3.2sg cpe:/o:cisco:ios_xe:3.3sq cpe:/o:cisco:ios_xe:3.3sq.0 cpe:/o:cisco:ios_xe:3.3sq.1 cpe:/o:cisco:ios_xe:3.3xo cpe:/o:cisco:ios_xe:3.3xo.0 cpe:/o:cisco:ios_xe:3.3xo.1 cpe:/o:cisco:ios_xe:3.3xo.2 cpe:/o:cisco:ios_xe:3.4.0as cpe:/o:cisco:ios_xe:3.4.0s cpe:/o:cisco:ios_xe:3.4.0sg cpe:/o:cisco:ios_xe:3.4.1s cpe:/o:cisco:ios_xe:3.4.1sg cpe:/o:cisco:ios_xe:3.4.2s cpe:/o:cisco:ios_xe:3.4.2sg cpe:/o:cisco:ios_xe:3.4.3s cpe:/o:cisco:ios_xe:3.4.3sg cpe:/o:cisco:ios_xe:3.4.4s cpe:/o:cisco:ios_xe:3.4.4sg cpe:/o:cisco:ios_xe:3.4.5s cpe:/o:cisco:ios_xe:3.4.5sg cpe:/o:cisco:ios_xe:3.4.6sg cpe:/o:cisco:ios_xe:3.4.7asg cpe:/o:cisco:ios_xe:3.4.7sg cpe:/o:cisco:ios_xe:3.4.8sg cpe:/o:cisco:ios_xe:3.4.9sg cpe:/o:cisco:ios_xe:3.4.xs cpe:/o:cisco:ios_xe:3.4s cpe:/o:cisco:ios_xe:3.4s%28.0%29 cpe:/o:cisco:ios_xe:3.4s%28.1%29 cpe:/o:cisco:ios_xe:3.4s%28.2%29 cpe:/o:cisco:ios_xe:3.4s%28.3%29 cpe:/o:cisco:ios_xe:3.4s%28.4%29 cpe:/o:cisco:ios_xe:3.4s%28.5%29 cpe:/o:cisco:ios_xe:3.4s%28.6%29 cpe:/o:cisco:ios_xe:3.4s.0 cpe:/o:cisco:ios_xe:3.4s.0a cpe:/o:cisco:ios_xe:3.4s.1 cpe:/o:cisco:ios_xe:3.4s.2 cpe:/o:cisco:ios_xe:3.4s.3 cpe:/o:cisco:ios_xe:3.4s.4 cpe:/o:cisco:ios_xe:3.4s.5 cpe:/o:cisco:ios_xe:3.4s.6 cpe:/o:cisco:ios_xe:3.4s_3.4.0as cpe:/o:cisco:ios_xe:3.4s_3.4.0s cpe:/o:cisco:ios_xe:3.4s_3.4.1s cpe:/o:cisco:ios_xe:3.4s_3.4.2s cpe:/o:cisco:ios_xe:3.4s_3.4.3s cpe:/o:cisco:ios_xe:3.4s_3.4.4s cpe:/o:cisco:ios_xe:3.4s_3.4.5s cpe:/o:cisco:ios_xe:3.4s_3.4.6s cpe:/o:cisco:ios_xe:3.4sg cpe:/o:cisco:ios_xe:3.4sg.0 cpe:/o:cisco:ios_xe:3.4sg.1 cpe:/o:cisco:ios_xe:3.4sg.2 cpe:/o:cisco:ios_xe:3.4sg.3 cpe:/o:cisco:ios_xe:3.4sg.4 cpe:/o:cisco:ios_xe:3.4sg.5 cpe:/o:cisco:ios_xe:3.4sg_3.4.7sg cpe:/o:cisco:ios_xe:3.4sq cpe:/o:cisco:ios_xe:3.4sq.0 cpe:/o:cisco:ios_xe:3.4sq.1 cpe:/o:cisco:ios_xe:3.5.0s cpe:/o:cisco:ios_xe:3.5.1s cpe:/o:cisco:ios_xe:3.5.2s cpe:/o:cisco:ios_xe:3.5.4sq cpe:/o:cisco:ios_xe:3.5.5sq cpe:/o:cisco:ios_xe:3.5.xs cpe:/o:cisco:ios_xe:3.5e cpe:/o:cisco:ios_xe:3.5e.0 cpe:/o:cisco:ios_xe:3.5e.1 cpe:/o:cisco:ios_xe:3.5e.2 cpe:/o:cisco:ios_xe:3.5e.3 cpe:/o:cisco:ios_xe:3.5s cpe:/o:cisco:ios_xe:3.5s%28.0%29 cpe:/o:cisco:ios_xe:3.5s%28.1%29 cpe:/o:cisco:ios_xe:3.5s%28.2%29 cpe:/o:cisco:ios_xe:3.5s.0 cpe:/o:cisco:ios_xe:3.5s.1 cpe:/o:cisco:ios_xe:3.5s.2 cpe:/o:cisco:ios_xe:3.5s_base cpe:/o:cisco:ios_xe:3.5sq cpe:/o:cisco:ios_xe:3.6.0s cpe:/o:cisco:ios_xe:3.6.1s cpe:/o:cisco:ios_xe:3.6.2s cpe:/o:cisco:ios_xe:3.6.5ae cpe:/o:cisco:ios_xe:3.6.5be cpe:/o:cisco:ios_xe:3.6.5e cpe:/o:cisco:ios_xe:3.6.6e cpe:/o:cisco:ios_xe:3.6.7e cpe:/o:cisco:ios_xe:3.6e cpe:/o:cisco:ios_xe:3.6e.0 cpe:/o:cisco:ios_xe:3.6e.1 cpe:/o:cisco:ios_xe:3.6s cpe:/o:cisco:ios_xe:3.6s%28.0%29 cpe:/o:cisco:ios_xe:3.6s%28.1%29 cpe:/o:cisco:ios_xe:3.6s%28.2%29 cpe:/o:cisco:ios_xe:3.6s.0 cpe:/o:cisco:ios_xe:3.6s.1 cpe:/o:cisco:ios_xe:3.6s.2 cpe:/o:cisco:ios_xe:3.6s_base cpe:/o:cisco:ios_xe:3.7.0s cpe:/o:cisco:ios_xe:3.7.1s cpe:/o:cisco:ios_xe:3.7.2s cpe:/o:cisco:ios_xe:3.7.5e cpe:/o:cisco:ios_xe:3.7e cpe:/o:cisco:ios_xe:3.7e.0 cpe:/o:cisco:ios_xe:3.7e_3.7.3e cpe:/o:cisco:ios_xe:3.7s cpe:/o:cisco:ios_xe:3.7s%28.0%29 cpe:/o:cisco:ios_xe:3.7s%28.1%29 cpe:/o:cisco:ios_xe:3.7s.0 cpe:/o:cisco:ios_xe:3.7s.1 cpe:/o:cisco:ios_xe:3.7s.2 cpe:/o:cisco:ios_xe:3.7s.3 cpe:/o:cisco:ios_xe:3.7s.4 cpe:/o:cisco:ios_xe:3.7s.5 cpe:/o:cisco:ios_xe:3.7s.6 cpe:/o:cisco:ios_xe:3.7s.7 cpe:/o:cisco:ios_xe:3.7s_base cpe:/o:cisco:ios_xe:3.8.0s cpe:/o:cisco:ios_xe:3.8.1s cpe:/o:cisco:ios_xe:3.8.2e cpe:/o:cisco:ios_xe:3.8.2s cpe:/o:cisco:ios_xe:3.8e cpe:/o:cisco:ios_xe:3.8e_3.8.1e cpe:/o:cisco:ios_xe:3.8ex cpe:/o:cisco:ios_xe:3.8s cpe:/o:cisco:ios_xe:3.8s%28.0%29 cpe:/o:cisco:ios_xe:3.8s%28.1%29 cpe:/o:cisco:ios_xe:3.8s%28.2%29 cpe:/o:cisco:ios_xe:3.8s.0 cpe:/o:cisco:ios_xe:3.8s.1 cpe:/o:cisco:ios_xe:3.8s.2 cpe:/o:cisco:ios_xe:3.8s_base cpe:/o:cisco:ios_xe:3.9.0as cpe:/o:cisco:ios_xe:3.9.0s cpe:/o:cisco:ios_xe:3.9.1as cpe:/o:cisco:ios_xe:3.9.1s cpe:/o:cisco:ios_xe:3.9.2e cpe:/o:cisco:ios_xe:3.9.2s cpe:/o:cisco:ios_xe:3.9e cpe:/o:cisco:ios_xe:3.9s cpe:/o:cisco:ios_xe:3.9s.0 cpe:/o:cisco:ios_xe:3.9s.1 cpe:/o:cisco:ios_xe:3.9s.2 cpe:/o:cisco:ios_xe:3.10 cpe:/o:cisco:ios_xe:3.10.0s cpe:/o:cisco:ios_xe:3.10.1s cpe:/o:cisco:ios_xe:3.10.1s1 cpe:/o:cisco:ios_xe:3.10.1xbs cpe:/o:cisco:ios_xe:3.10.2s cpe:/o:cisco:ios_xe:3.10.3s cpe:/o:cisco:ios_xe:3.10s.0 cpe:/o:cisco:ios_xe:3.10s.0a cpe:/o:cisco:ios_xe:3.10s.1 cpe:/o:cisco:ios_xe:3.10s.2 cpe:/o:cisco:ios_xe:3.10s.3 cpe:/o:cisco:ios_xe:3.10s.4 cpe:/o:cisco:ios_xe:3.10s.5 cpe:/o:cisco:ios_xe:3.10s_3.10.2ts cpe:/o:cisco:ios_xe:3.10s_3.10.7s cpe:/o:cisco:ios_xe:3.11s cpe:/o:cisco:ios_xe:3.11s.0 cpe:/o:cisco:ios_xe:3.11s.1 cpe:/o:cisco:ios_xe:3.11s.2 cpe:/o:cisco:ios_xe:3.11s.3 cpe:/o:cisco:ios_xe:3.11s.4 cpe:/o:cisco:ios_xe:3.12s cpe:/o:cisco:ios_xe:3.12s.0 cpe:/o:cisco:ios_xe:3.12s.1 cpe:/o:cisco:ios_xe:3.12s.2 cpe:/o:cisco:ios_xe:3.12s.3 cpe:/o:cisco:ios_xe:3.13s.0 cpe:/o:cisco:ios_xe:3.13s.1 cpe:/o:cisco:ios_xe:3.13s.2 cpe:/o:cisco:ios_xe:3.14s cpe:/o:cisco:ios_xe:3.14s.0 cpe:/o:cisco:ios_xe:3.14s.1 cpe:/o:cisco:ios_xe:3.14s.2 cpe:/o:cisco:ios_xe:3.14s.3 cpe:/o:cisco:ios_xe:3.14s.4 cpe:/o:cisco:ios_xe:3.15.1cs cpe:/o:cisco:ios_xe:3.15.4s cpe:/o:cisco:ios_xe:3.15s cpe:/o:cisco:ios_xe:3.15s.0 cpe:/o:cisco:ios_xe:3.15s.1 cpe:/o:cisco:ios_xe:3.15s.2 cpe:/o:cisco:ios_xe:3.16.0cs cpe:/o:cisco:ios_xe:3.16.1s cpe:/o:cisco:ios_xe:3.16.2bs cpe:/o:cisco:ios_xe:3.16s cpe:/o:cisco:ios_xe:3.16s.0 cpe:/o:cisco:ios_xe:3.16s.1 cpe:/o:cisco:ios_xe:3.17.1as cpe:/o:cisco:ios_xe:3.17.2s cpe:/o:cisco:ios_xe:3.17s cpe:/o:cisco:ios_xe:3.17s.0 cpe:/o:cisco:ios_xe:3.17s.1 cpe:/o:cisco:ios_xe:3.17s_3.17.0s cpe:/o:cisco:ios_xe:3.18.0as cpe:/o:cisco:ios_xe:3.18.0s cpe:/o:cisco:ios_xe:3.18s cpe:/o:cisco:ios_xe:13.10.2s cpe:/o:cisco:ios_xe:15.4%283%29s cpe:/o:cisco:ios_xe:16.1.1

CVE-2018-0182

2018-03-28T18:29:01.640-04:00

2019-10-09T19:31:24.473-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103547 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-cmdinj Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary commands into the CLI of the affected software, which could allow the attacker to gain access to the underlying Linux shell of an affected device and execute commands with root privileges on the device. The vulnerabilities exist because the affected software does not sufficiently sanitize command arguments before passing commands to the Linux shell for execution. An attacker could exploit these vulnerabilities by submitting a malicious CLI command to the affected software. A successful exploit could allow the attacker to break from the CLI of the affected software, which could allow the attacker to gain access to the underlying Linux shell on an affected device and execute arbitrary commands with root privileges on the device. Cisco Bug IDs: CSCuz03145, CSCuz56419, CSCva31971, CSCvb09542.

CVE-2018-0183

2018-03-28T18:29:01.703-04:00

2019-10-09T19:31:24.567-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103555 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-privesc3 A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the underlying Linux shell of an affected device and execute arbitrary commands with root privileges on the device. The vulnerability is due to the affected software improperly sanitizing command arguments to prevent access to internal data structures on a device. An attacker who has privileged EXEC mode (privilege level 15) access to an affected device could exploit this vulnerability on the device by executing CLI commands that contain crafted arguments. A successful exploit could allow the attacker to gain access to the underlying Linux shell of the affected device and execute arbitrary commands with root privileges on the device. Cisco Bug IDs: CSCuv91356.

CVE-2018-0184

2018-03-28T18:29:01.767-04:00

2019-10-09T19:31:24.723-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103550 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-privesc2 A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the underlying Linux shell of an affected device and execute arbitrary commands with root privileges on the device. The vulnerability is due to the affected software improperly sanitizing command arguments to prevent access to internal data structures on a device. An attacker who has privileged EXEC mode (privilege level 15) access to an affected device could exploit this vulnerability on the device by executing CLI commands that contain crafted arguments. A successful exploit could allow the attacker to gain access to the underlying Linux shell of the affected device and execute arbitrary commands with root privileges on the device. Cisco Bug IDs: CSCve74432.

CVE-2018-0185

2018-03-28T18:29:01.813-04:00

2019-10-09T19:31:24.833-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

CVE-2018-0186

2018-03-28T18:29:01.873-04:00

2019-10-09T19:31:24.940-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103551 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-webuixss Multiple vulnerabilities in the web-based user interface (web UI) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web UI of the affected software. The vulnerabilities are due to insufficient input validation of certain parameters that are passed to the affected software via the web UI. An attacker could exploit these vulnerabilities by persuading a user of the affected UI to access a malicious link or by intercepting a user request for the affected UI and injecting malicious code into the request. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected UI or allow the attacker to access sensitive browser-based information on the user's system. Cisco Bug IDs: CSCuz38591, CSCvb09530, CSCvb10022.

cpe:/a:cisco:identity_services_engine:2.4%280.901%29 cpe:/a:cisco:identity_services_engine:2.4%280.901.1%29

CVE-2018-0187

2019-01-23T17:29:00.290-05:00

2019-10-09T19:31:25.050-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov BID 106717 CISCO 20190123 Cisco Identity Services Engine Privileged Account Sensitive Information Disclosure Vulnerability A vulnerability in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain confidential information for privileged accounts. The vulnerability is due to the improper handling of confidential information. An attacker could exploit this vulnerability by logging into the web interface on a vulnerable system. An exploit could allow an attacker to obtain confidential information for privileged accounts. This information could then be used to impersonate or negatively impact the privileged account on the affected system.

CVE-2018-0188

2018-03-28T18:29:01.953-04:00

2019-10-09T19:31:25.270-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

CVE-2018-0189

2018-03-28T18:29:02.000-04:00

2019-10-09T19:31:25.380-04:00

7.1

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 103548 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-FIB-dos A vulnerability in the Forwarding Information Base (FIB) code of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, network attacker to cause a denial of service (DoS) condition. The vulnerability is due to a limitation in the way the FIB is internally representing recursive routes. An attacker could exploit this vulnerability by injecting routes into the routing protocol that have a specific recursive pattern. The attacker must be in a position on the network that provides the ability to inject a number of recursive routes with a specific pattern. An exploit could allow the attacker to cause an affected device to reload, creating a DoS condition. Cisco Bug IDs: CSCva91655.

CVE-2018-0190

2018-03-28T18:29:02.047-04:00

2019-10-09T19:31:25.613-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

CVE-2018-0191

2019-03-21T11:28:19.980-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

CVE-2018-0193

2018-03-28T18:29:02.110-04:00

2019-10-09T19:31:25.753-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

CVE-2018-0194

2018-04-02T10:29:00.207-04:00

2019-10-09T19:31:25.863-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

CVE-2018-0195

2018-03-28T18:29:02.157-04:00

2019-10-09T19:31:26.003-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov BID 103557 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-rest A vulnerability in the Cisco IOS XE Software REST API could allow an authenticated, remote attacker to bypass API authorization checks and use the API to perform privileged actions on an affected device. The vulnerability is due to insufficient authorization checks for requests that are sent to the REST API of the affected software. An attacker could exploit this vulnerability by sending a malicious request to an affected device via the REST API. A successful exploit could allow the attacker to selectively bypass authorization checks for the REST API of the affected software and use the API to perform privileged actions on an affected device. Cisco Bug IDs: CSCuz56428.

cpe:/o:cisco:ios_xe:16.1.2 cpe:/o:cisco:ios_xe:16.2.0 cpe:/o:cisco:ios_xe:16.3%281%29

CVE-2018-0196

2018-03-28T18:29:02.217-04:00

2018-04-03T21:29:03.420-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103570 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-wfw A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to write arbitrary files to the operating system of an affected device. The vulnerability is due to insufficient input validation of HTTP requests that are sent to the web UI of the affected software. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web UI of the affected software. A successful exploit could allow the attacker to write arbitrary files to the operating system of an affected device. Cisco Bug IDs: CSCvb22645.

cpe:/o:cisco:ios:12.1%285c%29ex cpe:/o:cisco:ios:12.1%285c%29ex1 cpe:/o:cisco:ios:12.1%285c%29ex3 cpe:/o:cisco:ios:12.1%286%29ea1 cpe:/o:cisco:ios:12.1%286%29ea1a cpe:/o:cisco:ios:12.1%286%29ea2 cpe:/o:cisco:ios:12.1%286%29ea2a cpe:/o:cisco:ios:12.1%286%29ea2b cpe:/o:cisco:ios:12.1%286%29ea2c cpe:/o:cisco:ios:12.1%286%29ex cpe:/o:cisco:ios:12.1%287%29e cpe:/o:cisco:ios:12.1%287a%29e1 cpe:/o:cisco:ios:12.1%287a%29e5 cpe:/o:cisco:ios:12.1%288%29ea1b cpe:/o:cisco:ios:12.1%288%29ea1c cpe:/o:cisco:ios:12.1%288a%29e cpe:/o:cisco:ios:12.1%288a%29e2 cpe:/o:cisco:ios:12.1%288a%29e3 cpe:/o:cisco:ios:12.1%288a%29e4 cpe:/o:cisco:ios:12.1%288a%29e5 cpe:/o:cisco:ios:12.1%288a%29ew cpe:/o:cisco:ios:12.1%288a%29ew1 cpe:/o:cisco:ios:12.1%288a%29ex cpe:/o:cisco:ios:12.1%288a%29ex1 cpe:/o:cisco:ios:12.1%288b%29e6 cpe:/o:cisco:ios:12.1%288b%29e7 cpe:/o:cisco:ios:12.1%288b%29e8 cpe:/o:cisco:ios:12.1%288b%29e9 cpe:/o:cisco:ios:12.1%288b%29e10 cpe:/o:cisco:ios:12.1%288b%29e11 cpe:/o:cisco:ios:12.1%288b%29e12 cpe:/o:cisco:ios:12.1%288b%29e13 cpe:/o:cisco:ios:12.1%288b%29e14 cpe:/o:cisco:ios:12.1%288b%29e15 cpe:/o:cisco:ios:12.1%288b%29e16 cpe:/o:cisco:ios:12.1%288b%29e18 cpe:/o:cisco:ios:12.1%288b%29e19 cpe:/o:cisco:ios:12.1%288b%29e20 cpe:/o:cisco:ios:12.1%288b%29ex2 cpe:/o:cisco:ios:12.1%288b%29ex3 cpe:/o:cisco:ios:12.1%288b%29ex4 cpe:/o:cisco:ios:12.1%288b%29ex5 cpe:/o:cisco:ios:12.1%289%29ea1 cpe:/o:cisco:ios:12.1%289%29ea1a cpe:/o:cisco:ios:12.1%289%29ea1c cpe:/o:cisco:ios:12.1%289%29ea1d cpe:/o:cisco:ios:12.1%289%29ex cpe:/o:cisco:ios:12.1%2811%29ea1 cpe:/o:cisco:ios:12.1%2811%29ea1a cpe:/o:cisco:ios:12.1%2811b%29e cpe:/o:cisco:ios:12.1%2811b%29e0a cpe:/o:cisco:ios:12.1%2811b%29e1 cpe:/o:cisco:ios:12.1%2811b%29e2 cpe:/o:cisco:ios:12.1%2811b%29e3 cpe:/o:cisco:ios:12.1%2811b%29e4 cpe:/o:cisco:ios:12.1%2811b%29e6 cpe:/o:cisco:ios:12.1%2811b%29e7 cpe:/o:cisco:ios:12.1%2811b%29e8 cpe:/o:cisco:ios:12.1%2811b%29e11 cpe:/o:cisco:ios:12.1%2811b%29e12 cpe:/o:cisco:ios:12.1%2811b%29e14 cpe:/o:cisco:ios:12.1%2811b%29ew cpe:/o:cisco:ios:12.1%2811b%29ew1 cpe:/o:cisco:ios:12.1%2811b%29ex cpe:/o:cisco:ios:12.1%2811b%29ex1 cpe:/o:cisco:ios:12.1%2812c%29e1 cpe:/o:cisco:ios:12.1%2812c%29e2 cpe:/o:cisco:ios:12.1%2812c%29e4 cpe:/o:cisco:ios:12.1%2812c%29e5 cpe:/o:cisco:ios:12.1%2812c%29e7 cpe:/o:cisco:ios:12.1%2812c%29ea1 cpe:/o:cisco:ios:12.1%2812c%29ea1a cpe:/o:cisco:ios:12.1%2812c%29ew cpe:/o:cisco:ios:12.1%2812c%29ew1 cpe:/o:cisco:ios:12.1%2812c%29ew2 cpe:/o:cisco:ios:12.1%2812c%29ew3 cpe:/o:cisco:ios:12.1%2812c%29ew4 cpe:/o:cisco:ios:12.1%2813%29e cpe:/o:cisco:ios:12.1%2813%29e1 cpe:/o:cisco:ios:12.1%2813%29e3 cpe:/o:cisco:ios:12.1%2813%29e4 cpe:/o:cisco:ios:12.1%2813%29e5 cpe:/o:cisco:ios:12.1%2813%29e6 cpe:/o:cisco:ios:12.1%2813%29e7 cpe:/o:cisco:ios:12.1%2813%29e8 cpe:/o:cisco:ios:12.1%2813%29e9 cpe:/o:cisco:ios:12.1%2813%29e10 cpe:/o:cisco:ios:12.1%2813%29e11 cpe:/o:cisco:ios:12.1%2813%29e12 cpe:/o:cisco:ios:12.1%2813%29e13 cpe:/o:cisco:ios:12.1%2813%29e14 cpe:/o:cisco:ios:12.1%2813%29e15 cpe:/o:cisco:ios:12.1%2813%29e16 cpe:/o:cisco:ios:12.1%2813%29e17 cpe:/o:cisco:ios:12.1%2813%29ea1 cpe:/o:cisco:ios:12.1%2813%29ea1a cpe:/o:cisco:ios:12.1%2813%29ea1b cpe:/o:cisco:ios:12.1%2813%29ea1c cpe:/o:cisco:ios:12.1%2813%29ew cpe:/o:cisco:ios:12.1%2813%29ew1 cpe:/o:cisco:ios:12.1%2813%29ew2 cpe:/o:cisco:ios:12.1%2813%29ew3 cpe:/o:cisco:ios:12.1%2813%29ew4 cpe:/o:cisco:ios:12.1%2814%29az cpe:/o:cisco:ios:12.1%2814%29e1 cpe:/o:cisco:ios:12.1%2814%29ea1 cpe:/o:cisco:ios:12.1%2814%29ea1a cpe:/o:cisco:ios:12.1%2814%29ea1b cpe:/o:cisco:ios:12.1%2819%29e cpe:/o:cisco:ios:12.1%2819%29e1 cpe:/o:cisco:ios:12.1%2819%29e1a cpe:/o:cisco:ios:12.1%2819%29ea1 cpe:/o:cisco:ios:12.1%2819%29ea1a cpe:/o:cisco:ios:12.1%2819%29ea1b cpe:/o:cisco:ios:12.1%2819%29ea1c cpe:/o:cisco:ios:12.1%2819%29ea1d cpe:/o:cisco:ios:12.1%2819%29ew cpe:/o:cisco:ios:12.1%2819%29ew1 cpe:/o:cisco:ios:12.1%2819%29ew2 cpe:/o:cisco:ios:12.1%2819%29ew3 cpe:/o:cisco:ios:12.1%2820%29e cpe:/o:cisco:ios:12.1%2820%29e1 cpe:/o:cisco:ios:12.1%2820%29e2 cpe:/o:cisco:ios:12.1%2820%29e3 cpe:/o:cisco:ios:12.1%2820%29e6 cpe:/o:cisco:ios:12.1%2820%29ea1 cpe:/o:cisco:ios:12.1%2820%29ea1a cpe:/o:cisco:ios:12.1%2820%29ea1b cpe:/o:cisco:ios:12.1%2820%29ea2 cpe:/o:cisco:ios:12.1%2820%29ew cpe:/o:cisco:ios:12.1%2820%29ew1 cpe:/o:cisco:ios:12.1%2820%29ew2 cpe:/o:cisco:ios:12.1%2820%29ew3 cpe:/o:cisco:ios:12.1%2820%29ew4 cpe:/o:cisco:ios:12.1%2822%29e cpe:/o:cisco:ios:12.1%2822%29e1 cpe:/o:cisco:ios:12.1%2822%29e2 cpe:/o:cisco:ios:12.1%2822%29e3 cpe:/o:cisco:ios:12.1%2822%29e4 cpe:/o:cisco:ios:12.1%2822%29e5 cpe:/o:cisco:ios:12.1%2822%29e6 cpe:/o:cisco:ios:12.1%2822%29ea1 cpe:/o:cisco:ios:12.1%2822%29ea1a cpe:/o:cisco:ios:12.1%2822%29ea1b cpe:/o:cisco:ios:12.1%2822%29ea2 cpe:/o:cisco:ios:12.1%2822%29ea3 cpe:/o:cisco:ios:12.1%2822%29ea4 cpe:/o:cisco:ios:12.1%2822%29ea4a cpe:/o:cisco:ios:12.1%2822%29ea5 cpe:/o:cisco:ios:12.1%2822%29ea5a cpe:/o:cisco:ios:12.1%2822%29ea6 cpe:/o:cisco:ios:12.1%2822%29ea6a cpe:/o:cisco:ios:12.1%2822%29ea7 cpe:/o:cisco:ios:12.1%2822%29ea8 cpe:/o:cisco:ios:12.1%2822%29ea8a cpe:/o:cisco:ios:12.1%2822%29ea9 cpe:/o:cisco:ios:12.1%2822%29ea10 cpe:/o:cisco:ios:12.1%2822%29ea10a cpe:/o:cisco:ios:12.1%2822%29ea10b cpe:/o:cisco:ios:12.1%2822%29ea11 cpe:/o:cisco:ios:12.1%2822%29ea12 cpe:/o:cisco:ios:12.1%2822%29ea13 cpe:/o:cisco:ios:12.1%2822%29ea14 cpe:/o:cisco:ios:12.1%2823%29e cpe:/o:cisco:ios:12.1%2823%29e1 cpe:/o:cisco:ios:12.1%2823%29e2 cpe:/o:cisco:ios:12.1%2823%29e3 cpe:/o:cisco:ios:12.1%2823%29e4 cpe:/o:cisco:ios:12.1%2826%29e cpe:/o:cisco:ios:12.1%2826%29e1 cpe:/o:cisco:ios:12.1%2826%29e2 cpe:/o:cisco:ios:12.1%2826%29e3 cpe:/o:cisco:ios:12.1%2826%29e4 cpe:/o:cisco:ios:12.1%2826%29e5 cpe:/o:cisco:ios:12.1%2826%29e6 cpe:/o:cisco:ios:12.1%2826%29e7 cpe:/o:cisco:ios:12.1%2826%29e8 cpe:/o:cisco:ios:12.1%2826%29e9 cpe:/o:cisco:ios:12.1%2827b%29e cpe:/o:cisco:ios:12.1%2827b%29e1 cpe:/o:cisco:ios:12.1%2827b%29e2 cpe:/o:cisco:ios:12.1%2827b%29e3 cpe:/o:cisco:ios:12.1%2827b%29e4 cpe:/o:cisco:ios:12.2%286%29i1 cpe:/o:cisco:ios:12.2%289%29s cpe:/o:cisco:ios:12.2%289%29yo cpe:/o:cisco:ios:12.2%289%29yo1 cpe:/o:cisco:ios:12.2%289%29yo2 cpe:/o:cisco:ios:12.2%289%29yo3 cpe:/o:cisco:ios:12.2%289%29yo4 cpe:/o:cisco:ios:12.2%289%29za cpe:/o:cisco:ios:12.2%2811%29yz cpe:/o:cisco:ios:12.2%2811%29yz1 cpe:/o:cisco:ios:12.2%2811%29yz2 cpe:/o:cisco:ios:12.2%2811%29yz3 cpe:/o:cisco:ios:12.2%2814%29sz cpe:/o:cisco:ios:12.2%2814%29sz1 cpe:/o:cisco:ios:12.2%2814%29sz2 cpe:/o:cisco:ios:12.2%2814%29sz3 cpe:/o:cisco:ios:12.2%2814%29sz4 cpe:/o:cisco:ios:12.2%2814%29sz5 cpe:/o:cisco:ios:12.2%2814%29sz6 cpe:/o:cisco:ios:12.2%2814%29za cpe:/o:cisco:ios:12.2%2814%29za2 cpe:/o:cisco:ios:12.2%2814%29za3 cpe:/o:cisco:ios:12.2%2814%29za4 cpe:/o:cisco:ios:12.2%2814%29za5 cpe:/o:cisco:ios:12.2%2814%29za6 cpe:/o:cisco:ios:12.2%2814%29za7 cpe:/o:cisco:ios:12.2%2817b%29sxa cpe:/o:cisco:ios:12.2%2817b%29sxa1 cpe:/o:cisco:ios:12.2%2817b%29sxa2 cpe:/o:cisco:ios:12.2%2817d%29sxb cpe:/o:cisco:ios:12.2%2817d%29sxb1 cpe:/o:cisco:ios:12.2%2817d%29sxb2 cpe:/o:cisco:ios:12.2%2817d%29sxb3 cpe:/o:cisco:ios:12.2%2817d%29sxb4 cpe:/o:cisco:ios:12.2%2817d%29sxb5 cpe:/o:cisco:ios:12.2%2817d%29sxb6 cpe:/o:cisco:ios:12.2%2817d%29sxb7 cpe:/o:cisco:ios:12.2%2817d%29sxb8 cpe:/o:cisco:ios:12.2%2817d%29sxb9 cpe:/o:cisco:ios:12.2%2817d%29sxb10 cpe:/o:cisco:ios:12.2%2817d%29sxb11 cpe:/o:cisco:ios:12.2%2817d%29sxb11a cpe:/o:cisco:ios:12.2%2818%29ew cpe:/o:cisco:ios:12.2%2818%29ew1 cpe:/o:cisco:ios:12.2%2818%29ew2 cpe:/o:cisco:ios:12.2%2818%29ew3 cpe:/o:cisco:ios:12.2%2818%29ew4 cpe:/o:cisco:ios:12.2%2818%29ew5 cpe:/o:cisco:ios:12.2%2818%29ew6 cpe:/o:cisco:ios:12.2%2818%29ew7 cpe:/o:cisco:ios:12.2%2818%29ixa cpe:/o:cisco:ios:12.2%2818%29ixb cpe:/o:cisco:ios:12.2%2818%29ixb1 cpe:/o:cisco:ios:12.2%2818%29ixb2 cpe:/o:cisco:ios:12.2%2818%29ixc cpe:/o:cisco:ios:12.2%2818%29ixd cpe:/o:cisco:ios:12.2%2818%29ixd1 cpe:/o:cisco:ios:12.2%2818%29ixe cpe:/o:cisco:ios:12.2%2818%29ixf cpe:/o:cisco:ios:12.2%2818%29ixf1 cpe:/o:cisco:ios:12.2%2818%29ixg cpe:/o:cisco:ios:12.2%2818%29ixh cpe:/o:cisco:ios:12.2%2818%29ixh1 cpe:/o:cisco:ios:12.2%2818%29s cpe:/o:cisco:ios:12.2%2818%29s1 cpe:/o:cisco:ios:12.2%2818%29s2 cpe:/o:cisco:ios:12.2%2818%29s3 cpe:/o:cisco:ios:12.2%2818%29s4 cpe:/o:cisco:ios:12.2%2818%29se cpe:/o:cisco:ios:12.2%2818%29se1 cpe:/o:cisco:ios:12.2%2818%29sxd cpe:/o:cisco:ios:12.2%2818%29sxd1 cpe:/o:cisco:ios:12.2%2818%29sxd2 cpe:/o:cisco:ios:12.2%2818%29sxd3 cpe:/o:cisco:ios:12.2%2818%29sxd4 cpe:/o:cisco:ios:12.2%2818%29sxd5 cpe:/o:cisco:ios:12.2%2818%29sxd6 cpe:/o:cisco:ios:12.2%2818%29sxd7 cpe:/o:cisco:ios:12.2%2818%29sxd7a cpe:/o:cisco:ios:12.2%2818%29sxd7b cpe:/o:cisco:ios:12.2%2818%29sxe cpe:/o:cisco:ios:12.2%2818%29sxe1 cpe:/o:cisco:ios:12.2%2818%29sxe2 cpe:/o:cisco:ios:12.2%2818%29sxe3 cpe:/o:cisco:ios:12.2%2818%29sxe4 cpe:/o:cisco:ios:12.2%2818%29sxe5 cpe:/o:cisco:ios:12.2%2818%29sxe6 cpe:/o:cisco:ios:12.2%2818%29sxe6a cpe:/o:cisco:ios:12.2%2818%29sxe6b cpe:/o:cisco:ios:12.2%2818%29sxf cpe:/o:cisco:ios:12.2%2818%29sxf1 cpe:/o:cisco:ios:12.2%2818%29sxf2 cpe:/o:cisco:ios:12.2%2818%29sxf3 cpe:/o:cisco:ios:12.2%2818%29sxf4 cpe:/o:cisco:ios:12.2%2818%29sxf5 cpe:/o:cisco:ios:12.2%2818%29sxf6 cpe:/o:cisco:ios:12.2%2818%29sxf7 cpe:/o:cisco:ios:12.2%2818%29sxf8 cpe:/o:cisco:ios:12.2%2818%29sxf9 cpe:/o:cisco:ios:12.2%2818%29sxf10 cpe:/o:cisco:ios:12.2%2818%29sxf10a cpe:/o:cisco:ios:12.2%2818%29sxf11 cpe:/o:cisco:ios:12.2%2818%29sxf12 cpe:/o:cisco:ios:12.2%2818%29sxf12a cpe:/o:cisco:ios:12.2%2818%29sxf13 cpe:/o:cisco:ios:12.2%2818%29sxf13a cpe:/o:cisco:ios:12.2%2818%29sxf13b cpe:/o:cisco:ios:12.2%2818%29sxf14 cpe:/o:cisco:ios:12.2%2818%29sxf15 cpe:/o:cisco:ios:12.2%2818%29sxf15a cpe:/o:cisco:ios:12.2%2818%29sxf16 cpe:/o:cisco:ios:12.2%2818%29sxf17 cpe:/o:cisco:ios:12.2%2818%29sxf17a cpe:/o:cisco:ios:12.2%2818%29sxf17b cpe:/o:cisco:ios:12.2%2818%29zu cpe:/o:cisco:ios:12.2%2818%29zu1 cpe:/o:cisco:ios:12.2%2818%29zu2 cpe:/o:cisco:ios:12.2%2818%29zy cpe:/o:cisco:ios:12.2%2818%29zy1 cpe:/o:cisco:ios:12.2%2818%29zy2 cpe:/o:cisco:ios:12.2%2818%29zya cpe:/o:cisco:ios:12.2%2818%29zya1 cpe:/o:cisco:ios:12.2%2818%29zya2 cpe:/o:cisco:ios:12.2%2818%29zya3 cpe:/o:cisco:ios:12.2%2818%29zya3a cpe:/o:cisco:ios:12.2%2818%29zya3b cpe:/o:cisco:ios:12.2%2818%29zya3c cpe:/o:cisco:ios:12.2%2820%29eu cpe:/o:cisco:ios:12.2%2820%29eu1 cpe:/o:cisco:ios:12.2%2820%29eu2 cpe:/o:cisco:ios:12.2%2820%29ew cpe:/o:cisco:ios:12.2%2820%29ew1 cpe:/o:cisco:ios:12.2%2820%29ew2 cpe:/o:cisco:ios:12.2%2820%29ew3 cpe:/o:cisco:ios:12.2%2820%29ew4 cpe:/o:cisco:ios:12.2%2820%29ewa cpe:/o:cisco:ios:12.2%2820%29ewa1 cpe:/o:cisco:ios:12.2%2820%29ewa2 cpe:/o:cisco:ios:12.2%2820%29ewa3 cpe:/o:cisco:ios:12.2%2820%29ewa4 cpe:/o:cisco:ios:12.2%2820%29ex cpe:/o:cisco:ios:12.2%2820%29s cpe:/o:cisco:ios:12.2%2820%29s1 cpe:/o:cisco:ios:12.2%2820%29s2 cpe:/o:cisco:ios:12.2%2820%29s2a cpe:/o:cisco:ios:12.2%2820%29s3 cpe:/o:cisco:ios:12.2%2820%29s4 cpe:/o:cisco:ios:12.2%2820%29s4a cpe:/o:cisco:ios:12.2%2820%29s5 cpe:/o:cisco:ios:12.2%2820%29s6 cpe:/o:cisco:ios:12.2%2820%29se cpe:/o:cisco:ios:12.2%2820%29se1 cpe:/o:cisco:ios:12.2%2820%29se2 cpe:/o:cisco:ios:12.2%2820%29se3 cpe:/o:cisco:ios:12.2%2820%29se4 cpe:/o:cisco:ios:12.2%2822%29s cpe:/o:cisco:ios:12.2%2825%29ew cpe:/o:cisco:ios:12.2%2825%29ewa cpe:/o:cisco:ios:12.2%2825%29ewa1 cpe:/o:cisco:ios:12.2%2825%29ewa2 cpe:/o:cisco:ios:12.2%2825%29ewa3 cpe:/o:cisco:ios:12.2%2825%29ewa4 cpe:/o:cisco:ios:12.2%2825%29ewa5 cpe:/o:cisco:ios:12.2%2825%29ewa6 cpe:/o:cisco:ios:12.2%2825%29ewa7 cpe:/o:cisco:ios:12.2%2825%29ewa8 cpe:/o:cisco:ios:12.2%2825%29ewa9 cpe:/o:cisco:ios:12.2%2825%29ewa10 cpe:/o:cisco:ios:12.2%2825%29ewa11 cpe:/o:cisco:ios:12.2%2825%29ewa12 cpe:/o:cisco:ios:12.2%2825%29ewa13 cpe:/o:cisco:ios:12.2%2825%29ewa14 cpe:/o:cisco:ios:12.2%2825%29ex cpe:/o:cisco:ios:12.2%2825%29ex1 cpe:/o:cisco:ios:12.2%2825%29ey cpe:/o:cisco:ios:12.2%2825%29ey1 cpe:/o:cisco:ios:12.2%2825%29ey2 cpe:/o:cisco:ios:12.2%2825%29ey3 cpe:/o:cisco:ios:12.2%2825%29ey4 cpe:/o:cisco:ios:12.2%2825%29ez cpe:/o:cisco:ios:12.2%2825%29ez1 cpe:/o:cisco:ios:12.2%2825%29fx cpe:/o:cisco:ios:12.2%2825%29fy cpe:/o:cisco:ios:12.2%2825%29fz cpe:/o:cisco:ios:12.2%2825%29s cpe:/o:cisco:ios:12.2%2825%29s1 cpe:/o:cisco:ios:12.2%2825%29s2 cpe:/o:cisco:ios:12.2%2825%29se cpe:/o:cisco:ios:12.2%2825%29se2 cpe:/o:cisco:ios:12.2%2825%29se3 cpe:/o:cisco:ios:12.2%2825%29sea cpe:/o:cisco:ios:12.2%2825%29seb cpe:/o:cisco:ios:12.2%2825%29seb1 cpe:/o:cisco:ios:12.2%2825%29seb2 cpe:/o:cisco:ios:12.2%2825%29seb3 cpe:/o:cisco:ios:12.2%2825%29seb4 cpe:/o:cisco:ios:12.2%2825%29sec cpe:/o:cisco:ios:12.2%2825%29sec1 cpe:/o:cisco:ios:12.2%2825%29sec2 cpe:/o:cisco:ios:12.2%2825%29sed cpe:/o:cisco:ios:12.2%2825%29sed1 cpe:/o:cisco:ios:12.2%2825%29see cpe:/o:cisco:ios:12.2%2825%29see1 cpe:/o:cisco:ios:12.2%2825%29see2 cpe:/o:cisco:ios:12.2%2825%29see3 cpe:/o:cisco:ios:12.2%2825%29see4 cpe:/o:cisco:ios:12.2%2825%29sef cpe:/o:cisco:ios:12.2%2825%29sef1 cpe:/o:cisco:ios:12.2%2825%29sef2 cpe:/o:cisco:ios:12.2%2825%29sef3 cpe:/o:cisco:ios:12.2%2825%29seg cpe:/o:cisco:ios:12.2%2825%29seg1 cpe:/o:cisco:ios:12.2%2825%29seg2 cpe:/o:cisco:ios:12.2%2825%29seg3 cpe:/o:cisco:ios:12.2%2825%29seg4 cpe:/o:cisco:ios:12.2%2825%29seg5 cpe:/o:cisco:ios:12.2%2825%29seg6 cpe:/o:cisco:ios:12.2%2825%29sg cpe:/o:cisco:ios:12.2%2825%29sg1 cpe:/o:cisco:ios:12.2%2825%29sg2 cpe:/o:cisco:ios:12.2%2825%29sg3 cpe:/o:cisco:ios:12.2%2825%29sg4 cpe:/o:cisco:ios:12.2%2827%29sbk9 cpe:/o:cisco:ios:12.2%2831%29sg cpe:/o:cisco:ios:12.2%2831%29sg1 cpe:/o:cisco:ios:12.2%2831%29sg2 cpe:/o:cisco:ios:12.2%2831%29sg3 cpe:/o:cisco:ios:12.2%2831%29sga cpe:/o:cisco:ios:12.2%2831%29sga1 cpe:/o:cisco:ios:12.2%2831%29sga2 cpe:/o:cisco:ios:12.2%2831%29sga3 cpe:/o:cisco:ios:12.2%2831%29sga4 cpe:/o:cisco:ios:12.2%2831%29sga5 cpe:/o:cisco:ios:12.2%2831%29sga6 cpe:/o:cisco:ios:12.2%2831%29sga7 cpe:/o:cisco:ios:12.2%2831%29sga8 cpe:/o:cisco:ios:12.2%2831%29sga9 cpe:/o:cisco:ios:12.2%2831%29sga10 cpe:/o:cisco:ios:12.2%2831%29sga11 cpe:/o:cisco:ios:12.2%2833%29ira cpe:/o:cisco:ios:12.2%2833%29irb cpe:/o:cisco:ios:12.2%2833%29irc cpe:/o:cisco:ios:12.2%2833%29ird cpe:/o:cisco:ios:12.2%2833%29ire cpe:/o:cisco:ios:12.2%2833%29ire1 cpe:/o:cisco:ios:12.2%2833%29ire2 cpe:/o:cisco:ios:12.2%2833%29irf cpe:/o:cisco:ios:12.2%2833%29irg cpe:/o:cisco:ios:12.2%2833%29irg1 cpe:/o:cisco:ios:12.2%2833%29irh cpe:/o:cisco:ios:12.2%2833%29irh1 cpe:/o:cisco:ios:12.2%2833%29mra cpe:/o:cisco:ios:12.2%2833%29mrb cpe:/o:cisco:ios:12.2%2833%29mrb1 cpe:/o:cisco:ios:12.2%2833%29mrb2 cpe:/o:cisco:ios:12.2%2833%29mrb3 cpe:/o:cisco:ios:12.2%2833%29mrb4 cpe:/o:cisco:ios:12.2%2833%29mrb5 cpe:/o:cisco:ios:12.2%2833%29mrb6 cpe:/o:cisco:ios:12.2%2833%29sra cpe:/o:cisco:ios:12.2%2833%29sra1 cpe:/o:cisco:ios:12.2%2833%29sra2 cpe:/o:cisco:ios:12.2%2833%29sra3 cpe:/o:cisco:ios:12.2%2833%29sra4 cpe:/o:cisco:ios:12.2%2833%29sra5 cpe:/o:cisco:ios:12.2%2833%29sra6 cpe:/o:cisco:ios:12.2%2833%29sra7 cpe:/o:cisco:ios:12.2%2833%29srb cpe:/o:cisco:ios:12.2%2833%29srb1 cpe:/o:cisco:ios:12.2%2833%29srb2 cpe:/o:cisco:ios:12.2%2833%29srb3 cpe:/o:cisco:ios:12.2%2833%29srb4 cpe:/o:cisco:ios:12.2%2833%29srb5 cpe:/o:cisco:ios:12.2%2833%29srb5a cpe:/o:cisco:ios:12.2%2833%29srb6 cpe:/o:cisco:ios:12.2%2833%29srb7 cpe:/o:cisco:ios:12.2%2833%29src cpe:/o:cisco:ios:12.2%2833%29src1 cpe:/o:cisco:ios:12.2%2833%29src2 cpe:/o:cisco:ios:12.2%2833%29src3 cpe:/o:cisco:ios:12.2%2833%29src4 cpe:/o:cisco:ios:12.2%2833%29src5 cpe:/o:cisco:ios:12.2%2833%29src6 cpe:/o:cisco:ios:12.2%2833%29srd cpe:/o:cisco:ios:12.2%2833%29srd1 cpe:/o:cisco:ios:12.2%2833%29srd2 cpe:/o:cisco:ios:12.2%2833%29srd2a cpe:/o:cisco:ios:12.2%2833%29srd3 cpe:/o:cisco:ios:12.2%2833%29srd4 cpe:/o:cisco:ios:12.2%2833%29srd4a cpe:/o:cisco:ios:12.2%2833%29srd5 cpe:/o:cisco:ios:12.2%2833%29srd6 cpe:/o:cisco:ios:12.2%2833%29srd7 cpe:/o:cisco:ios:12.2%2833%29srd8 cpe:/o:cisco:ios:12.2%2833%29sre cpe:/o:cisco:ios:12.2%2833%29sre0a cpe:/o:cisco:ios:12.2%2833%29sre1 cpe:/o:cisco:ios:12.2%2833%29sre2 cpe:/o:cisco:ios:12.2%2833%29sre3 cpe:/o:cisco:ios:12.2%2833%29sre4 cpe:/o:cisco:ios:12.2%2833%29sre5 cpe:/o:cisco:ios:12.2%2833%29sre6 cpe:/o:cisco:ios:12.2%2833%29sre7 cpe:/o:cisco:ios:12.2%2833%29sre7a cpe:/o:cisco:ios:12.2%2833%29sre8 cpe:/o:cisco:ios:12.2%2833%29sre9 cpe:/o:cisco:ios:12.2%2833%29sre9a cpe:/o:cisco:ios:12.2%2833%29sre10 cpe:/o:cisco:ios:12.2%2833%29sre11 cpe:/o:cisco:ios:12.2%2833%29sre12 cpe:/o:cisco:ios:12.2%2833%29sre13 cpe:/o:cisco:ios:12.2%2833%29sre14 cpe:/o:cisco:ios:12.2%2833%29sre15 cpe:/o:cisco:ios:12.2%2833%29sre15a cpe:/o:cisco:ios:12.2%2833%29sxh cpe:/o:cisco:ios:12.2%2833%29sxh0a cpe:/o:cisco:ios:12.2%2833%29sxh1 cpe:/o:cisco:ios:12.2%2833%29sxh2 cpe:/o:cisco:ios:12.2%2833%29sxh2a cpe:/o:cisco:ios:12.2%2833%29sxh3 cpe:/o:cisco:ios:12.2%2833%29sxh3a cpe:/o:cisco:ios:12.2%2833%29sxh4 cpe:/o:cisco:ios:12.2%2833%29sxh5 cpe:/o:cisco:ios:12.2%2833%29sxh6 cpe:/o:cisco:ios:12.2%2833%29sxh7 cpe:/o:cisco:ios:12.2%2833%29sxh7v cpe:/o:cisco:ios:12.2%2833%29sxh7w cpe:/o:cisco:ios:12.2%2833%29sxh8 cpe:/o:cisco:ios:12.2%2833%29sxh8a cpe:/o:cisco:ios:12.2%2833%29sxh8b cpe:/o:cisco:ios:12.2%2833%29sxi cpe:/o:cisco:ios:12.2%2833%29sxi1 cpe:/o:cisco:ios:12.2%2833%29sxi2 cpe:/o:cisco:ios:12.2%2833%29sxi2a cpe:/o:cisco:ios:12.2%2833%29sxi3 cpe:/o:cisco:ios:12.2%2833%29sxi3a cpe:/o:cisco:ios:12.2%2833%29sxi3z cpe:/o:cisco:ios:12.2%2833%29sxi4 cpe:/o:cisco:ios:12.2%2833%29sxi4a cpe:/o:cisco:ios:12.2%2833%29sxi5 cpe:/o:cisco:ios:12.2%2833%29sxi5a cpe:/o:cisco:ios:12.2%2833%29sxi6 cpe:/o:cisco:ios:12.2%2833%29sxi7 cpe:/o:cisco:ios:12.2%2833%29sxi8 cpe:/o:cisco:ios:12.2%2833%29sxi8a cpe:/o:cisco:ios:12.2%2833%29sxi9 cpe:/o:cisco:ios:12.2%2833%29sxi9a cpe:/o:cisco:ios:12.2%2833%29sxi10 cpe:/o:cisco:ios:12.2%2833%29sxi11 cpe:/o:cisco:ios:12.2%2833%29sxi12 cpe:/o:cisco:ios:12.2%2833%29sxi13 cpe:/o:cisco:ios:12.2%2833%29sxi14 cpe:/o:cisco:ios:12.2%2833%29sxj cpe:/o:cisco:ios:12.2%2833%29sxj1 cpe:/o:cisco:ios:12.2%2833%29sxj2 cpe:/o:cisco:ios:12.2%2833%29sxj3 cpe:/o:cisco:ios:12.2%2833%29sxj4 cpe:/o:cisco:ios:12.2%2833%29sxj5 cpe:/o:cisco:ios:12.2%2833%29sxj6 cpe:/o:cisco:ios:12.2%2833%29sxj7 cpe:/o:cisco:ios:12.2%2833%29sxj8 cpe:/o:cisco:ios:12.2%2833%29sxj9 cpe:/o:cisco:ios:12.2%2833%29sxj10 cpe:/o:cisco:ios:12.2%2833%29zi cpe:/o:cisco:ios:12.2%2833%29zw cpe:/o:cisco:ios:12.2%2833%29zz cpe:/o:cisco:ios:12.2%2835%29ex cpe:/o:cisco:ios:12.2%2835%29ex1 cpe:/o:cisco:ios:12.2%2835%29ex2 cpe:/o:cisco:ios:12.2%2835%29se cpe:/o:cisco:ios:12.2%2835%29se1 cpe:/o:cisco:ios:12.2%2835%29se2 cpe:/o:cisco:ios:12.2%2835%29se3 cpe:/o:cisco:ios:12.2%2835%29se4 cpe:/o:cisco:ios:12.2%2835%29se5 cpe:/o:cisco:ios:12.2%2837%29ex cpe:/o:cisco:ios:12.2%2837%29ey cpe:/o:cisco:ios:12.2%2837%29se cpe:/o:cisco:ios:12.2%2837%29se1 cpe:/o:cisco:ios:12.2%2837%29sg cpe:/o:cisco:ios:12.2%2837%29sg1 cpe:/o:cisco:ios:12.2%2840%29ex cpe:/o:cisco:ios:12.2%2840%29ex1 cpe:/o:cisco:ios:12.2%2840%29ex2 cpe:/o:cisco:ios:12.2%2840%29ex3 cpe:/o:cisco:ios:12.2%2840%29se cpe:/o:cisco:ios:12.2%2840%29se1 cpe:/o:cisco:ios:12.2%2840%29se2 cpe:/o:cisco:ios:12.2%2840%29sg cpe:/o:cisco:ios:12.2%2840%29xo cpe:/o:cisco:ios:12.2%2844%29ex cpe:/o:cisco:ios:12.2%2844%29ex1 cpe:/o:cisco:ios:12.2%2844%29ey cpe:/o:cisco:ios:12.2%2844%29se cpe:/o:cisco:ios:12.2%2844%29se1 cpe:/o:cisco:ios:12.2%2844%29se2 cpe:/o:cisco:ios:12.2%2844%29se3 cpe:/o:cisco:ios:12.2%2844%29se4 cpe:/o:cisco:ios:12.2%2844%29se5 cpe:/o:cisco:ios:12.2%2844%29se6 cpe:/o:cisco:ios:12.2%2844%29sg cpe:/o:cisco:ios:12.2%2844%29sg1 cpe:/o:cisco:ios:12.2%2844%29sq cpe:/o:cisco:ios:12.2%2844%29sq2 cpe:/o:cisco:ios:12.2%2846%29ex cpe:/o:cisco:ios:12.2%2846%29ey cpe:/o:cisco:ios:12.2%2846%29se cpe:/o:cisco:ios:12.2%2846%29se1 cpe:/o:cisco:ios:12.2%2846%29se2 cpe:/o:cisco:ios:12.2%2846%29sg cpe:/o:cisco:ios:12.2%2846%29sg1 cpe:/o:cisco:ios:12.2%2850%29se cpe:/o:cisco:ios:12.2%2850%29se1 cpe:/o:cisco:ios:12.2%2850%29se2 cpe:/o:cisco:ios:12.2%2850%29se3 cpe:/o:cisco:ios:12.2%2850%29se4 cpe:/o:cisco:ios:12.2%2850%29se5 cpe:/o:cisco:ios:12.2%2850%29sg cpe:/o:cisco:ios:12.2%2850%29sg1 cpe:/o:cisco:ios:12.2%2850%29sg2 cpe:/o:cisco:ios:12.2%2850%29sg3 cpe:/o:cisco:ios:12.2%2850%29sg4 cpe:/o:cisco:ios:12.2%2850%29sg5 cpe:/o:cisco:ios:12.2%2850%29sg6 cpe:/o:cisco:ios:12.2%2850%29sg7 cpe:/o:cisco:ios:12.2%2850%29sg8 cpe:/o:cisco:ios:12.2%2850%29sq cpe:/o:cisco:ios:12.2%2850%29sq1 cpe:/o:cisco:ios:12.2%2850%29sq2 cpe:/o:cisco:ios:12.2%2850%29sq3 cpe:/o:cisco:ios:12.2%2850%29sq4 cpe:/o:cisco:ios:12.2%2850%29sq5 cpe:/o:cisco:ios:12.2%2850%29sq6 cpe:/o:cisco:ios:12.2%2850%29sq7 cpe:/o:cisco:ios:12.2%2852%29ex cpe:/o:cisco:ios:12.2%2852%29ex1 cpe:/o:cisco:ios:12.2%2852%29ey cpe:/o:cisco:ios:12.2%2852%29ey1 cpe:/o:cisco:ios:12.2%2852%29ey1a cpe:/o:cisco:ios:12.2%2852%29ey1b cpe:/o:cisco:ios:12.2%2852%29ey1c cpe:/o:cisco:ios:12.2%2852%29ey2 cpe:/o:cisco:ios:12.2%2852%29ey2a cpe:/o:cisco:ios:12.2%2852%29ey3 cpe:/o:cisco:ios:12.2%2852%29ey3a cpe:/o:cisco:ios:12.2%2852%29ey4 cpe:/o:cisco:ios:12.2%2852%29se cpe:/o:cisco:ios:12.2%2852%29se1 cpe:/o:cisco:ios:12.2%2852%29sg cpe:/o:cisco:ios:12.2%2852%29xo cpe:/o:cisco:ios:12.2%2853%29ex cpe:/o:cisco:ios:12.2%2853%29ey cpe:/o:cisco:ios:12.2%2853%29ez cpe:/o:cisco:ios:12.2%2853%29se cpe:/o:cisco:ios:12.2%2853%29se1 cpe:/o:cisco:ios:12.2%2853%29se2 cpe:/o:cisco:ios:12.2%2853%29sg1 cpe:/o:cisco:ios:12.2%2853%29sg2 cpe:/o:cisco:ios:12.2%2853%29sg3 cpe:/o:cisco:ios:12.2%2853%29sg4 cpe:/o:cisco:ios:12.2%2853%29sg5 cpe:/o:cisco:ios:12.2%2853%29sg6 cpe:/o:cisco:ios:12.2%2853%29sg7 cpe:/o:cisco:ios:12.2%2853%29sg8 cpe:/o:cisco:ios:12.2%2853%29sg9 cpe:/o:cisco:ios:12.2%2853%29sg10 cpe:/o:cisco:ios:12.2%2853%29sg11 cpe:/o:cisco:ios:12.2%2854%29se cpe:/o:cisco:ios:12.2%2854%29sg cpe:/o:cisco:ios:12.2%2854%29sg1 cpe:/o:cisco:ios:12.2%2854%29wo cpe:/o:cisco:ios:12.2%2854%29xo cpe:/o:cisco:ios:12.2%2855%29ex cpe:/o:cisco:ios:12.2%2855%29ex1 cpe:/o:cisco:ios:12.2%2855%29ex2 cpe:/o:cisco:ios:12.2%2855%29ex3 cpe:/o:cisco:ios:12.2%2855%29ey cpe:/o:cisco:ios:12.2%2855%29ez cpe:/o:cisco:ios:12.2%2855%29se cpe:/o:cisco:ios:12.2%2855%29se1 cpe:/o:cisco:ios:12.2%2855%29se2 cpe:/o:cisco:ios:12.2%2855%29se3 cpe:/o:cisco:ios:12.2%2855%29se4 cpe:/o:cisco:ios:12.2%2855%29se5 cpe:/o:cisco:ios:12.2%2855%29se6 cpe:/o:cisco:ios:12.2%2855%29se7 cpe:/o:cisco:ios:12.2%2855%29se8 cpe:/o:cisco:ios:12.2%2855%29se9 cpe:/o:cisco:ios:12.2%2855%29se10 cpe:/o:cisco:ios:12.2%2855%29se11 cpe:/o:cisco:ios:12.2%2855%29se12 cpe:/o:cisco:ios:12.2%2858%29ex cpe:/o:cisco:ios:12.2%2858%29ey cpe:/o:cisco:ios:12.2%2858%29ey1 cpe:/o:cisco:ios:12.2%2858%29ey2 cpe:/o:cisco:ios:12.2%2858%29ez cpe:/o:cisco:ios:12.2%2858%29se cpe:/o:cisco:ios:12.2%2858%29se1 cpe:/o:cisco:ios:12.2%2858%29se2 cpe:/o:cisco:ios:12.2%2860%29ez cpe:/o:cisco:ios:12.2%2860%29ez1 cpe:/o:cisco:ios:12.2%2860%29ez2 cpe:/o:cisco:ios:12.2%2860%29ez3 cpe:/o:cisco:ios:12.2%2860%29ez4 cpe:/o:cisco:ios:12.2%2860%29ez5 cpe:/o:cisco:ios:12.2%2860%29ez6 cpe:/o:cisco:ios:12.2%2860%29ez7 cpe:/o:cisco:ios:12.2%2860%29ez8 cpe:/o:cisco:ios:12.2%2860%29ez9 cpe:/o:cisco:ios:12.2%2860%29ez10 cpe:/o:cisco:ios:12.2%2860%29ez11 cpe:/o:cisco:ios:15.0%281%29ey cpe:/o:cisco:ios:15.0%281%29ey1 cpe:/o:cisco:ios:15.0%281%29ey2 cpe:/o:cisco:ios:15.0%281%29mr cpe:/o:cisco:ios:15.0%281%29s cpe:/o:cisco:ios:15.0%281%29s1 cpe:/o:cisco:ios:15.0%281%29s2 cpe:/o:cisco:ios:15.0%281%29s3a cpe:/o:cisco:ios:15.0%281%29s4 cpe:/o:cisco:ios:15.0%281%29s4a cpe:/o:cisco:ios:15.0%281%29s5 cpe:/o:cisco:ios:15.0%281%29se cpe:/o:cisco:ios:15.0%281%29se1 cpe:/o:cisco:ios:15.0%281%29se2 cpe:/o:cisco:ios:15.0%281%29se3 cpe:/o:cisco:ios:15.0%281%29sy cpe:/o:cisco:ios:15.0%281%29sy1 cpe:/o:cisco:ios:15.0%281%29sy2 cpe:/o:cisco:ios:15.0%281%29sy3 cpe:/o:cisco:ios:15.0%281%29sy4 cpe:/o:cisco:ios:15.0%281%29sy5 cpe:/o:cisco:ios:15.0%281%29sy6 cpe:/o:cisco:ios:15.0%281%29sy7 cpe:/o:cisco:ios:15.0%281%29sy7a cpe:/o:cisco:ios:15.0%281%29sy8 cpe:/o:cisco:ios:15.0%281%29sy9 cpe:/o:cisco:ios:15.0%281%29sy10 cpe:/o:cisco:ios:15.0%281%29xo cpe:/o:cisco:ios:15.0%281%29xo1 cpe:/o:cisco:ios:15.0%282%29ej cpe:/o:cisco:ios:15.0%282%29ej1 cpe:/o:cisco:ios:15.0%282%29ek cpe:/o:cisco:ios:15.0%282%29ek1 cpe:/o:cisco:ios:15.0%282%29ex cpe:/o:cisco:ios:15.0%282%29ex1 cpe:/o:cisco:ios:15.0%282%29ex2 cpe:/o:cisco:ios:15.0%282%29ex3 cpe:/o:cisco:ios:15.0%282%29ex4 cpe:/o:cisco:ios:15.0%282%29ex5 cpe:/o:cisco:ios:15.0%282%29ex6 cpe:/o:cisco:ios:15.0%282%29ex7 cpe:/o:cisco:ios:15.0%282%29ex8 cpe:/o:cisco:ios:15.0%282%29ex10 cpe:/o:cisco:ios:15.0%282%29ex11 cpe:/o:cisco:ios:15.0%282%29ex12 cpe:/o:cisco:ios:15.0%282%29ex13 cpe:/o:cisco:ios:15.0%282%29ey cpe:/o:cisco:ios:15.0%282%29ey1 cpe:/o:cisco:ios:15.0%282%29ey2 cpe:/o:cisco:ios:15.0%282%29ey3 cpe:/o:cisco:ios:15.0%282%29ez cpe:/o:cisco:ios:15.0%282%29mr cpe:/o:cisco:ios:15.0%282%29se cpe:/o:cisco:ios:15.0%282%29se1 cpe:/o:cisco:ios:15.0%282%29se2 cpe:/o:cisco:ios:15.0%282%29se3 cpe:/o:cisco:ios:15.0%282%29se4 cpe:/o:cisco:ios:15.0%282%29se5 cpe:/o:cisco:ios:15.0%282%29se6 cpe:/o:cisco:ios:15.0%282%29se7 cpe:/o:cisco:ios:15.0%282%29se8 cpe:/o:cisco:ios:15.0%282%29se9 cpe:/o:cisco:ios:15.0%282%29se10 cpe:/o:cisco:ios:15.0%282%29se10a cpe:/o:cisco:ios:15.0%282%29se11 cpe:/o:cisco:ios:15.0%282%29sg cpe:/o:cisco:ios:15.0%282%29sg1 cpe:/o:cisco:ios:15.0%282%29sg2 cpe:/o:cisco:ios:15.0%282%29sg3 cpe:/o:cisco:ios:15.0%282%29sg4 cpe:/o:cisco:ios:15.0%282%29sg5 cpe:/o:cisco:ios:15.0%282%29sg6 cpe:/o:cisco:ios:15.0%282%29sg7 cpe:/o:cisco:ios:15.0%282%29sg8 cpe:/o:cisco:ios:15.0%282%29sg9 cpe:/o:cisco:ios:15.0%282%29sg10 cpe:/o:cisco:ios:15.0%282%29sg11 cpe:/o:cisco:ios:15.0%282%29sqd cpe:/o:cisco:ios:15.0%282%29sqd1 cpe:/o:cisco:ios:15.0%282%29sqd2 cpe:/o:cisco:ios:15.0%282%29sqd3 cpe:/o:cisco:ios:15.0%282%29sqd4 cpe:/o:cisco:ios:15.0%282%29sqd5 cpe:/o:cisco:ios:15.0%282%29sqd6 cpe:/o:cisco:ios:15.0%282%29sqd7 cpe:/o:cisco:ios:15.0%282%29xo cpe:/o:cisco:ios:15.0%282a%29ex5 cpe:/o:cisco:ios:15.0%282a%29se9 cpe:/o:cisco:ios:15.1%281%29s cpe:/o:cisco:ios:15.1%281%29s1 cpe:/o:cisco:ios:15.1%281%29s2 cpe:/o:cisco:ios:15.1%281%29sg cpe:/o:cisco:ios:15.1%281%29sg1 cpe:/o:cisco:ios:15.1%281%29sg2 cpe:/o:cisco:ios:15.1%281%29sy cpe:/o:cisco:ios:15.1%281%29sy1 cpe:/o:cisco:ios:15.1%281%29sy2 cpe:/o:cisco:ios:15.1%281%29sy3 cpe:/o:cisco:ios:15.1%281%29sy4 cpe:/o:cisco:ios:15.1%281%29sy5 cpe:/o:cisco:ios:15.1%281%29sy6 cpe:/o:cisco:ios:15.1%282%29s cpe:/o:cisco:ios:15.1%282%29s1 cpe:/o:cisco:ios:15.1%282%29s2 cpe:/o:cisco:ios:15.1%282%29sg cpe:/o:cisco:ios:15.1%282%29sg1 cpe:/o:cisco:ios:15.1%282%29sg2 cpe:/o:cisco:ios:15.1%282%29sg3 cpe:/o:cisco:ios:15.1%282%29sg4 cpe:/o:cisco:ios:15.1%282%29sg5 cpe:/o:cisco:ios:15.1%282%29sg6 cpe:/o:cisco:ios:15.1%282%29sg7 cpe:/o:cisco:ios:15.1%282%29sg8 cpe:/o:cisco:ios:15.1%282%29sg8a cpe:/o:cisco:ios:15.1%282%29sy cpe:/o:cisco:ios:15.1%282%29sy1 cpe:/o:cisco:ios:15.1%282%29sy2 cpe:/o:cisco:ios:15.1%282%29sy3 cpe:/o:cisco:ios:15.1%282%29sy4 cpe:/o:cisco:ios:15.1%282%29sy4a cpe:/o:cisco:ios:15.1%282%29sy5 cpe:/o:cisco:ios:15.1%282%29sy6 cpe:/o:cisco:ios:15.1%282%29sy7 cpe:/o:cisco:ios:15.1%282%29sy8 cpe:/o:cisco:ios:15.1%282%29sy9 cpe:/o:cisco:ios:15.1%282%29sy10 cpe:/o:cisco:ios:15.1%282%29sy11 cpe:/o:cisco:ios:15.1%283%29mra cpe:/o:cisco:ios:15.1%283%29mra1 cpe:/o:cisco:ios:15.1%283%29mra2 cpe:/o:cisco:ios:15.1%283%29mra3 cpe:/o:cisco:ios:15.1%283%29mra4 cpe:/o:cisco:ios:15.1%283%29s cpe:/o:cisco:ios:15.1%283%29s0a cpe:/o:cisco:ios:15.1%283%29s1 cpe:/o:cisco:ios:15.1%283%29s2 cpe:/o:cisco:ios:15.1%283%29s3 cpe:/o:cisco:ios:15.1%283%29s4 cpe:/o:cisco:ios:15.1%283%29s5 cpe:/o:cisco:ios:15.1%283%29s6 cpe:/o:cisco:ios:15.1%283%29s7 cpe:/o:cisco:ios:15.1%283%29svk4b cpe:/o:cisco:ios:15.1%283%29svk4c cpe:/o:cisco:ios:15.1%283%29svo2 cpe:/o:cisco:ios:15.1%283%29svp1 cpe:/o:cisco:ios:15.1%284%29m12c cpe:/o:cisco:ios:15.2%281%29e cpe:/o:cisco:ios:15.2%281%29e1 cpe:/o:cisco:ios:15.2%281%29e2 cpe:/o:cisco:ios:15.2%281%29e3 cpe:/o:cisco:ios:15.2%281%29ey cpe:/o:cisco:ios:15.2%281%29s cpe:/o:cisco:ios:15.2%281%29s1 cpe:/o:cisco:ios:15.2%281%29s2 cpe:/o:cisco:ios:15.2%281%29sy cpe:/o:cisco:ios:15.2%281%29sy0a cpe:/o:cisco:ios:15.2%281%29sy1 cpe:/o:cisco:ios:15.2%281%29sy1a cpe:/o:cisco:ios:15.2%281%29sy2 cpe:/o:cisco:ios:15.2%281%29sy3 cpe:/o:cisco:ios:15.2%281%29sy4 cpe:/o:cisco:ios:15.2%281%29sy5 cpe:/o:cisco:ios:15.2%282%29e cpe:/o:cisco:ios:15.2%282%29e1 cpe:/o:cisco:ios:15.2%282%29e2 cpe:/o:cisco:ios:15.2%282%29e3 cpe:/o:cisco:ios:15.2%282%29e4 cpe:/o:cisco:ios:15.2%282%29e5 cpe:/o:cisco:ios:15.2%282%29e5a cpe:/o:cisco:ios:15.2%282%29e5b cpe:/o:cisco:ios:15.2%282%29e6 cpe:/o:cisco:ios:15.2%282%29ea cpe:/o:cisco:ios:15.2%282%29ea1 cpe:/o:cisco:ios:15.2%282%29ea2 cpe:/o:cisco:ios:15.2%282%29ea3 cpe:/o:cisco:ios:15.2%282%29eb cpe:/o:cisco:ios:15.2%282%29eb1 cpe:/o:cisco:ios:15.2%282%29eb2 cpe:/o:cisco:ios:15.2%282%29s cpe:/o:cisco:ios:15.2%282%29s0a cpe:/o:cisco:ios:15.2%282%29s0c cpe:/o:cisco:ios:15.2%282%29s0d cpe:/o:cisco:ios:15.2%282%29s1 cpe:/o:cisco:ios:15.2%282%29s2 cpe:/o:cisco:ios:15.2%282%29sc1 cpe:/o:cisco:ios:15.2%282%29sc3 cpe:/o:cisco:ios:15.2%282%29sc4 cpe:/o:cisco:ios:15.2%282%29sy cpe:/o:cisco:ios:15.2%282%29sy1 cpe:/o:cisco:ios:15.2%282%29sy2 cpe:/o:cisco:ios:15.2%282%29sy3 cpe:/o:cisco:ios:15.2%282a%29e1 cpe:/o:cisco:ios:15.2%282a%29e2 cpe:/o:cisco:ios:15.2%282b%29e cpe:/o:cisco:ios:15.2%283%29e cpe:/o:cisco:ios:15.2%283%29e1 cpe:/o:cisco:ios:15.2%283%29e2 cpe:/o:cisco:ios:15.2%283%29e3 cpe:/o:cisco:ios:15.2%283%29e4 cpe:/o:cisco:ios:15.2%283%29e5 cpe:/o:cisco:ios:15.2%283%29ea cpe:/o:cisco:ios:15.2%283%29ea1 cpe:/o:cisco:ios:15.2%283a%29e cpe:/o:cisco:ios:15.2%283m%29e2 cpe:/o:cisco:ios:15.2%283m%29e7 cpe:/o:cisco:ios:15.2%283m%29e8 cpe:/o:cisco:ios:15.2%284%29e cpe:/o:cisco:ios:15.2%284%29e1 cpe:/o:cisco:ios:15.2%284%29e2 cpe:/o:cisco:ios:15.2%284%29e3 cpe:/o:cisco:ios:15.2%284%29e4 cpe:/o:cisco:ios:15.2%284%29e5 cpe:/o:cisco:ios:15.2%284%29e5a cpe:/o:cisco:ios:15.2%284%29ea cpe:/o:cisco:ios:15.2%284%29ea1 cpe:/o:cisco:ios:15.2%284%29ea2 cpe:/o:cisco:ios:15.2%284%29ea3 cpe:/o:cisco:ios:15.2%284%29ea4 cpe:/o:cisco:ios:15.2%284%29ea5 cpe:/o:cisco:ios:15.2%284%29ea6 cpe:/o:cisco:ios:15.2%284%29ec1 cpe:/o:cisco:ios:15.2%284%29ec2 cpe:/o:cisco:ios:15.2%284%29s cpe:/o:cisco:ios:15.2%284%29s0c cpe:/o:cisco:ios:15.2%284%29s1 cpe:/o:cisco:ios:15.2%284%29s1c cpe:/o:cisco:ios:15.2%284%29s2 cpe:/o:cisco:ios:15.2%284%29s3 cpe:/o:cisco:ios:15.2%284%29s3a cpe:/o:cisco:ios:15.2%284%29s4 cpe:/o:cisco:ios:15.2%284%29s4a cpe:/o:cisco:ios:15.2%284%29s5 cpe:/o:cisco:ios:15.2%284%29s6 cpe:/o:cisco:ios:15.2%284%29s7 cpe:/o:cisco:ios:15.2%284%29s8 cpe:/o:cisco:ios:15.2%284a%29ea5 cpe:/o:cisco:ios:15.2%284m%29e1 cpe:/o:cisco:ios:15.2%284m%29e2 cpe:/o:cisco:ios:15.2%284m%29e3 cpe:/o:cisco:ios:15.2%284n%29e2 cpe:/o:cisco:ios:15.2%284o%29e2 cpe:/o:cisco:ios:15.2%284o%29e3 cpe:/o:cisco:ios:15.2%284p%29e1 cpe:/o:cisco:ios:15.2%284q%29e1 cpe:/o:cisco:ios:15.2%284s%29e1 cpe:/o:cisco:ios:15.2%284s%29e2 cpe:/o:cisco:ios:15.2%285%29e cpe:/o:cisco:ios:15.2%285%29e1 cpe:/o:cisco:ios:15.2%285%29e2 cpe:/o:cisco:ios:15.2%285%29e2b cpe:/o:cisco:ios:15.2%285%29e2c cpe:/o:cisco:ios:15.2%285%29ea cpe:/o:cisco:ios:15.2%285%29ex cpe:/o:cisco:ios:15.2%285a%29e cpe:/o:cisco:ios:15.2%285a%29e1 cpe:/o:cisco:ios:15.2%285b%29e cpe:/o:cisco:ios:15.2%285c%29e cpe:/o:cisco:ios:15.3%280%29sy cpe:/o:cisco:ios:15.3%281%29s cpe:/o:cisco:ios:15.3%281%29s1 cpe:/o:cisco:ios:15.3%281%29s1e cpe:/o:cisco:ios:15.3%281%29s2 cpe:/o:cisco:ios:15.3%281%29sy cpe:/o:cisco:ios:15.3%281%29sy1 cpe:/o:cisco:ios:15.3%281%29sy2 cpe:/o:cisco:ios:15.3%282%29s cpe:/o:cisco:ios:15.3%282%29s1 cpe:/o:cisco:ios:15.3%282%29s2 cpe:/o:cisco:ios:15.3%283%29s cpe:/o:cisco:ios:15.3%283%29s1 cpe:/o:cisco:ios:15.3%283%29s1a cpe:/o:cisco:ios:15.3%283%29s2 cpe:/o:cisco:ios:15.3%283%29s2a cpe:/o:cisco:ios:15.3%283%29s3 cpe:/o:cisco:ios:15.3%283%29s4 cpe:/o:cisco:ios:15.3%283%29s5 cpe:/o:cisco:ios:15.3%283%29s6 cpe:/o:cisco:ios:15.3%283%29s6a cpe:/o:cisco:ios:15.3%283%29s7 cpe:/o:cisco:ios:15.3%283%29s8 cpe:/o:cisco:ios:15.3%283%29s8a cpe:/o:cisco:ios:15.3%283%29s9 cpe:/o:cisco:ios:15.3%283%29s10 cpe:/o:cisco:ios:15.4%281%29s cpe:/o:cisco:ios:15.4%281%29s1 cpe:/o:cisco:ios:15.4%281%29s2 cpe:/o:cisco:ios:15.4%281%29s3 cpe:/o:cisco:ios:15.4%281%29s4 cpe:/o:cisco:ios:15.4%281%29sy cpe:/o:cisco:ios:15.4%281%29sy1 cpe:/o:cisco:ios:15.4%281%29sy2 cpe:/o:cisco:ios:15.4%281%29sy3 cpe:/o:cisco:ios:15.4%282%29s cpe:/o:cisco:ios:15.4%282%29s1 cpe:/o:cisco:ios:15.4%282%29s2 cpe:/o:cisco:ios:15.4%282%29s3 cpe:/o:cisco:ios:15.4%282%29s4 cpe:/o:cisco:ios:15.4%282%29sn cpe:/o:cisco:ios:15.4%282%29sn1 cpe:/o:cisco:ios:15.4%283%29s cpe:/o:cisco:ios:15.4%283%29s0d cpe:/o:cisco:ios:15.4%283%29s0e cpe:/o:cisco:ios:15.4%283%29s0f cpe:/o:cisco:ios:15.4%283%29s1 cpe:/o:cisco:ios:15.4%283%29s2 cpe:/o:cisco:ios:15.4%283%29s3 cpe:/o:cisco:ios:15.4%283%29s4 cpe:/o:cisco:ios:15.4%283%29s5 cpe:/o:cisco:ios:15.4%283%29s6 cpe:/o:cisco:ios:15.4%283%29s6a cpe:/o:cisco:ios:15.4%283%29s7 cpe:/o:cisco:ios:15.4%283%29s8 cpe:/o:cisco:ios:15.4%283%29sn1 cpe:/o:cisco:ios:15.4%283%29sn1a cpe:/o:cisco:ios:15.5%281%29s cpe:/o:cisco:ios:15.5%281%29s1 cpe:/o:cisco:ios:15.5%281%29s2 cpe:/o:cisco:ios:15.5%281%29s3 cpe:/o:cisco:ios:15.5%281%29s4 cpe:/o:cisco:ios:15.5%281%29sn cpe:/o:cisco:ios:15.5%281%29sn1 cpe:/o:cisco:ios:15.5%281%29sy cpe:/o:cisco:ios:15.5%282%29s cpe:/o:cisco:ios:15.5%282%29s1 cpe:/o:cisco:ios:15.5%282%29s2 cpe:/o:cisco:ios:15.5%282%29s3 cpe:/o:cisco:ios:15.5%282%29s4 cpe:/o:cisco:ios:15.5%282%29sn cpe:/o:cisco:ios:15.5%283%29s cpe:/o:cisco:ios:15.5%283%29s0a cpe:/o:cisco:ios:15.5%283%29s1 cpe:/o:cisco:ios:15.5%283%29s1a cpe:/o:cisco:ios:15.5%283%29s2 cpe:/o:cisco:ios:15.5%283%29s3 cpe:/o:cisco:ios:15.5%283%29s4 cpe:/o:cisco:ios:15.5%283%29s5 cpe:/o:cisco:ios:15.5%283%29s6 cpe:/o:cisco:ios:15.5%283%29s6a cpe:/o:cisco:ios:15.5%283%29s6b cpe:/o:cisco:ios:15.5%283%29sn cpe:/o:cisco:ios:15.5%283%29sn0a cpe:/o:cisco:ios:15.6%281%29s cpe:/o:cisco:ios:15.6%281%29s1 cpe:/o:cisco:ios:15.6%281%29s2 cpe:/o:cisco:ios:15.6%281%29s3 cpe:/o:cisco:ios:15.6%281%29s4 cpe:/o:cisco:ios:15.6%281%29sn cpe:/o:cisco:ios:15.6%281%29sn1 cpe:/o:cisco:ios:15.6%281%29sn2 cpe:/o:cisco:ios:15.6%281%29sn3 cpe:/o:cisco:ios:15.6%282%29s cpe:/o:cisco:ios:15.6%282%29s1 cpe:/o:cisco:ios:15.6%282%29s2 cpe:/o:cisco:ios:15.6%282%29s3 cpe:/o:cisco:ios:15.6%282%29s4 cpe:/o:cisco:ios:15.6%282%29sn cpe:/o:cisco:ios:15.6%282%29sp cpe:/o:cisco:ios:15.6%282%29sp1 cpe:/o:cisco:ios:15.6%282%29sp2 cpe:/o:cisco:ios:15.6%282%29sp3 cpe:/o:cisco:ios:15.6%282%29sp3b cpe:/o:cisco:ios:15.6%283%29sn cpe:/o:cisco:ios:15.6%284%29sn cpe:/o:cisco:ios:15.6%285%29sn cpe:/o:cisco:ios:15.6%286%29sn cpe:/o:cisco:ios:15.6%287%29sn cpe:/o:cisco:ios_xe cpe:/o:cisco:ios_xe:3.2.0ja cpe:/o:cisco:ios_xe:3.2.0se cpe:/o:cisco:ios_xe:3.2.0sg cpe:/o:cisco:ios_xe:3.2.1se cpe:/o:cisco:ios_xe:3.2.1sg cpe:/o:cisco:ios_xe:3.2.2se cpe:/o:cisco:ios_xe:3.2.2sg cpe:/o:cisco:ios_xe:3.2.3se cpe:/o:cisco:ios_xe:3.2.3sg cpe:/o:cisco:ios_xe:3.2.4sg cpe:/o:cisco:ios_xe:3.2.5sg cpe:/o:cisco:ios_xe:3.2.6sg cpe:/o:cisco:ios_xe:3.2.7sg cpe:/o:cisco:ios_xe:3.2.8sg cpe:/o:cisco:ios_xe:3.2.9sg cpe:/o:cisco:ios_xe:3.2.10sg cpe:/o:cisco:ios_xe:3.2.11sg cpe:/o:cisco:ios_xe:3.3.0se cpe:/o:cisco:ios_xe:3.3.0sg cpe:/o:cisco:ios_xe:3.3.0sq cpe:/o:cisco:ios_xe:3.3.0xo cpe:/o:cisco:ios_xe:3.3.1se cpe:/o:cisco:ios_xe:3.3.1sg cpe:/o:cisco:ios_xe:3.3.1sq cpe:/o:cisco:ios_xe:3.3.1xo cpe:/o:cisco:ios_xe:3.3.2se cpe:/o:cisco:ios_xe:3.3.2sg cpe:/o:cisco:ios_xe:3.3.2xo cpe:/o:cisco:ios_xe:3.3.3se cpe:/o:cisco:ios_xe:3.3.4se cpe:/o:cisco:ios_xe:3.3.5se cpe:/o:cisco:ios_xe:3.4.0sg cpe:/o:cisco:ios_xe:3.4.0sq cpe:/o:cisco:ios_xe:3.4.1sg cpe:/o:cisco:ios_xe:3.4.1sq cpe:/o:cisco:ios_xe:3.4.2sg cpe:/o:cisco:ios_xe:3.4.3sg cpe:/o:cisco:ios_xe:3.4.4sg cpe:/o:cisco:ios_xe:3.4.5sg cpe:/o:cisco:ios_xe:3.4.6sg cpe:/o:cisco:ios_xe:3.4.7sg cpe:/o:cisco:ios_xe:3.4.8sg cpe:/o:cisco:ios_xe:3.5.0e cpe:/o:cisco:ios_xe:3.5.0sq cpe:/o:cisco:ios_xe:3.5.1e cpe:/o:cisco:ios_xe:3.5.1sq cpe:/o:cisco:ios_xe:3.5.2e cpe:/o:cisco:ios_xe:3.5.2sq cpe:/o:cisco:ios_xe:3.5.3e cpe:/o:cisco:ios_xe:3.5.3sq cpe:/o:cisco:ios_xe:3.5.4sq cpe:/o:cisco:ios_xe:3.5.5sq cpe:/o:cisco:ios_xe:3.5.6sq cpe:/o:cisco:ios_xe:3.5.7sq cpe:/o:cisco:ios_xe:3.6.0ae cpe:/o:cisco:ios_xe:3.6.0be cpe:/o:cisco:ios_xe:3.6.0e cpe:/o:cisco:ios_xe:3.6.1e cpe:/o:cisco:ios_xe:3.6.2ae cpe:/o:cisco:ios_xe:3.6.2e cpe:/o:cisco:ios_xe:3.6.3e cpe:/o:cisco:ios_xe:3.6.4e cpe:/o:cisco:ios_xe:3.6.5ae cpe:/o:cisco:ios_xe:3.6.5be cpe:/o:cisco:ios_xe:3.6.5e cpe:/o:cisco:ios_xe:3.6.6e cpe:/o:cisco:ios_xe:3.7.0e cpe:/o:cisco:ios_xe:3.7.1e cpe:/o:cisco:ios_xe:3.7.2e cpe:/o:cisco:ios_xe:3.7.3e cpe:/o:cisco:ios_xe:3.7.4e cpe:/o:cisco:ios_xe:3.7.5e cpe:/o:cisco:ios_xe:3.8.0e cpe:/o:cisco:ios_xe:3.8.1e cpe:/o:cisco:ios_xe:3.8.2e cpe:/o:cisco:ios_xe:3.8.3e cpe:/o:cisco:ios_xe:3.8.4e cpe:/o:cisco:ios_xe:3.8.5ae cpe:/o:cisco:ios_xe:3.8.5e cpe:/o:cisco:ios_xe:3.9.0e cpe:/o:cisco:ios_xe:3.9.1e cpe:/o:cisco:ios_xe:3.9.2be cpe:/o:cisco:ios_xe:3.9.2e cpe:/o:cisco:ios_xe:3.10.4s cpe:/o:cisco:ios_xe:3.12.0as cpe:/o:cisco:ios_xe:3.15.0s cpe:/o:cisco:ios_xe:3.15.1cs cpe:/o:cisco:ios_xe:3.15.1s cpe:/o:cisco:ios_xe:3.15.2s cpe:/o:cisco:ios_xe:3.15.3s cpe:/o:cisco:ios_xe:3.15.4s cpe:/o:cisco:ios_xe:3.16.0bs cpe:/o:cisco:ios_xe:3.16.0cs cpe:/o:cisco:ios_xe:3.16.0s cpe:/o:cisco:ios_xe:3.16.1as cpe:/o:cisco:ios_xe:3.16.1s cpe:/o:cisco:ios_xe:3.16.2s cpe:/o:cisco:ios_xe:3.16.3s cpe:/o:cisco:ios_xe:3.16.4as cpe:/o:cisco:ios_xe:3.16.4bs cpe:/o:cisco:ios_xe:3.16.4cs cpe:/o:cisco:ios_xe:3.16.4ds cpe:/o:cisco:ios_xe:3.16.4es cpe:/o:cisco:ios_xe:3.16.4gs cpe:/o:cisco:ios_xe:3.16.5as cpe:/o:cisco:ios_xe:3.16.5bs cpe:/o:cisco:ios_xe:3.16.5s cpe:/o:cisco:ios_xe:3.16.6bs cpe:/o:cisco:ios_xe:3.16.6s cpe:/o:cisco:ios_xe:3.17.0s cpe:/o:cisco:ios_xe:3.17.1s cpe:/o:cisco:ios_xe:3.17.3s cpe:/o:cisco:ios_xe:3.17.4s cpe:/o:cisco:ios_xe:16.1.1 cpe:/o:cisco:ios_xe:16.1.2 cpe:/o:cisco:ios_xe:16.1.3 cpe:/o:cisco:ios_xe:16.2.1 cpe:/o:cisco:ios_xe:16.2.2 cpe:/o:cisco:ios_xe:16.3.1 cpe:/o:cisco:ios_xe:16.3.1a cpe:/o:cisco:ios_xe:16.3.2 cpe:/o:cisco:ios_xe:16.3.3 cpe:/o:cisco:ios_xe:16.3.4 cpe:/o:cisco:ios_xe:16.3.5 cpe:/o:cisco:ios_xe:16.3.5b cpe:/o:cisco:ios_xe:16.4.1 cpe:/o:cisco:ios_xe:16.4.2 cpe:/o:cisco:ios_xe:16.5.1 cpe:/o:cisco:ios_xe:16.5.1a cpe:/o:cisco:ios_xe:16.5.1b cpe:/o:cisco:ios_xe:16.5.2 cpe:/o:cisco:ios_xe:16.6.1 cpe:/o:cisco:ios_xe:16.6.2 cpe:/o:cisco:ios_xe:16.7.1

CVE-2018-0197

2018-10-05T10:29:00.387-04:00

2019-10-09T19:31:26.190-04:00

3.3

ADJACENT_NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 105424 CISCO 20180926 Cisco IOS and IOS XE Software VLAN Trunking Protocol Denial of Service Vulnerability A vulnerability in the VLAN Trunking Protocol (VTP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to corrupt the internal VTP database on an affected device and cause a denial of service (DoS) condition. The vulnerability is due to a logic error in how the affected software handles a subset of VTP packets. An attacker could exploit this vulnerability by sending VTP packets in a sequence that triggers a timeout in the VTP message processing code of the affected software. A successful exploit could allow the attacker to impact the ability to create, modify, or delete VLANs and cause a DoS condition. There are workarounds that address this vulnerability. This vulnerability affects Cisco devices that are running a vulnerable release of Cisco IOS Software or Cisco IOS XE Software, are operating in VTP client mode or VTP server mode, and do not have a VTP domain name configured. The default configuration for Cisco devices that are running Cisco IOS Software or Cisco IOS XE Software and support VTP is to operate in VTP server mode with no domain name configured.

cpe:/a:cisco:unified_communications_manager

CVE-2018-0198

2018-03-27T05:29:00.343-04:00

2019-10-09T19:31:28.333-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 102965 SECTRACK 1040342 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-ucm1 A vulnerability in the web framework of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to view sensitive data. The vulnerability is due to insufficient protection of database tables. An attacker could exploit this vulnerability by browsing to a specific URL. A successful exploit could allow the attacker to view data library information. Cisco Bug IDs: CSCvh66592.

cpe:/a:cisco:jabber:-::~~~mac_os_x~~ cpe:/a:cisco:jabber:11.9::~~~windows~~ cpe:/a:cisco:jabber:11.9%280%29::~~~windows~~

CVE-2018-0199

2018-02-21T19:29:00.597-05:00

2019-10-09T19:31:28.487-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103143 SECTRACK 1040407 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-jcf A vulnerability in Cisco Jabber Client Framework (JCF) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of an affected device. The vulnerability is due to improper neutralization of script in attributes in a web page. An attacker could exploit this vulnerability by executing arbitrary JavaScript in the Jabber client of the recipient. An exploit could allow the attacker to perform remote code execution. Cisco Bug IDs: CSCve53989.

cpe:/a:cisco:prime_service_catalog:-

CVE-2018-0200

2018-02-21T19:29:00.640-05:00

2019-10-09T19:31:28.597-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103128 SECTRACK 1040408 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-psc A vulnerability in the web-based interface of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based interface of an affected product. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvh65713.

cpe:/a:cisco:jabber:-::~~~mac_os_x~~ cpe:/a:cisco:jabber:11.9::~~~windows~~ cpe:/a:cisco:jabber:11.9%28.0%29::~~~windows~~

CVE-2018-0201

2018-02-21T19:29:00.687-05:00

2019-10-09T19:31:28.707-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103133 SECTRACK 1040406 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-jcf1 A vulnerability in Cisco Jabber Client Framework (JCF) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of an affected device. The vulnerability is due to improper neutralization of input during web page generation. An attacker could exploit this vulnerability by embedding media in instant messages. An exploit could allow the attacker to cause the recipient chat client to make outbound requests. Cisco Bug IDs: CSCve54001.

cpe:/a:clamav:clamav:0.99.3 cpe:/o:canonical:ubuntu_linux:12.04::~~esm~~~ cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:17.10 cpe:/o:debian:debian_linux:7.0

CVE-2018-0202

2018-03-27T05:29:00.387-04:00

2019-03-26T12:02:42.133-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-03-19T14:46:31.520-04:00

CONFIRM https://bugzilla.clamav.net/show_bug.cgi?id=11973 CONFIRM https://bugzilla.clamav.net/show_bug.cgi?id=11980 MLIST [debian-lts-announce] 20180316 [SECURITY] [DLA 1307-1] clamav security update GENTOO GLSA-201804-16 UBUNTU USN-3592-1 UBUNTU USN-3592-2 clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format (.pdf) files sent to an affected device. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted .pdf file to an affected device. This action could cause an out-of-bounds read when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition. This concerns pdf_parse_array and pdf_parse_string in libclamav/pdfng.c. Cisco Bug IDs: CSCvh91380, CSCvh91400.

cpe:/a:cisco:unity_connection:-

CVE-2018-0203

2018-02-21T19:29:00.737-05:00

2019-10-09T19:31:28.847-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103142 SECTRACK 1040413 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-cuc A vulnerability in the SMTP relay of Cisco Unity Connection could allow an unauthenticated, remote attacker to send unsolicited email messages, aka a Mail Relay Vulnerability. The vulnerability is due to improper handling of domain information in the affected software. An unauthenticated, remote attacker could exploit this vulnerability by sending crafted requests to the targeted application. A successful exploit could allow the attacker to send email messages to arbitrary addresses. Cisco Bug IDs: CSCvg62215.

cpe:/a:cisco:prime_collaboration_provisioning:12.1

CVE-2018-0204

2018-02-21T19:29:00.797-05:00

2019-10-09T19:31:28.973-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 103150 SECTRACK 1040410 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-pcpt A vulnerability in the web portal of the Cisco Prime Collaboration Provisioning Tool could allow an unauthenticated, remote attacker to create a denial of service (DoS) condition for individual users. The vulnerability is due to weak login controls. An attacker could exploit this vulnerability by using a brute-force attack (Repeated Bad Login Attempts). A successful exploit could allow the attacker to restrict user access. Manual administrative intervention is required to restore access. Cisco Bug IDs: CSCvd07264.

cpe:/a:cisco:prime_collaboration_provisioning:12.1

CVE-2018-0205

2018-02-21T19:29:00.877-05:00

2019-10-09T19:31:29.083-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103145 SECTRACK 1040409 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-pcpt1 A vulnerability in the User Provisioning tab in the Cisco Prime Collaboration Provisioning Tool could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by placing a malicious string in the Prime Collaboration Provisioning database. A successful exploit could allow the attacker to access Cisco Prime Collaboration Provisioning by injecting crafted data into the database. Cisco Bug IDs: CSCvd86609.

cpe:/a:cisco:unified_communications_manager:11.5%281.13900.52%29

CVE-2018-0206

2018-02-21T19:29:00.937-05:00

2019-10-09T19:31:29.190-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103146 SECTRACK 1040411 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-ucm A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the web-based management interface to click a link that submits malicious input to the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvg74815.

cpe:/a:cisco:secure_access_control_server_solution_engine:5.8%280.8%29

CVE-2018-0207

2018-03-08T02:29:00.427-05:00

2019-10-09T19:31:29.487-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103343 SECTRACK 1040470 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-acs A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker to gain read access to certain information in the affected system. The vulnerability is due to improper handling of XML External Entities (XXEs) when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file. Cisco Bug IDs: CSCve70595.

cpe:/a:cisco:email_encryption:5.3.0

CVE-2018-0208

2018-03-08T02:29:00.487-05:00

2019-10-09T19:31:29.630-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103337 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-res A vulnerability in the web-based management interface of the (cloud based) Cisco Registered Envelope Service could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected service. The vulnerability is due to insufficient validation of user-supplied input that is processed by the web-based management interface of the affected service. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information. Cisco Bug IDs: CSCvg74126.

cpe:/o:cisco:small_business_500_series_stackable_managed_switches_firmware:2.2.5.68 cpe:/o:cisco:small_business_500_series_stackable_managed_switches_firmware:2.3.0.130

CVE-2018-0209

2018-03-08T02:29:00.533-05:00

2019-10-09T19:31:29.737-04:00

6.8

NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov BID 103406 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-550x A vulnerability in the Simple Network Management Protocol (SNMP) subsystem communication channel through the Cisco 550X Series Stackable Managed Switches could allow an authenticated, remote attacker to cause the device to reload unexpectedly, causing a denial of service (DoS) condition. The device nay need to be manually reloaded to recover. The vulnerability is due to lack of proper input throttling of ingress SNMP traffic over an internal interface. An attacker could exploit this vulnerability by sending a crafted, heavy stream of SNMP traffic to the targeted device. An exploit could allow the attacker to cause the device to reload unexpectedly, causing a DoS condition. Cisco Bug IDs: CSCvg22135.

cpe:/a:cisco:data_center_network_manager:10.4%281.128%29 cpe:/a:cisco:data_center_network_manager:10.4%282%29

CVE-2018-0210

2018-03-08T02:29:00.597-05:00

2019-10-09T19:31:29.910-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 103335 SECTRACK 1040465 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-dcnm A vulnerability in the web-based management interface of Cisco Data Center Network Manager could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections on the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user. Cisco Bug IDs: CSCvg88291.

cpe:/a:cisco:identity_services_engine:2.1%280.474%29 cpe:/a:cisco:identity_services_engine:2.2%281.145%29 cpe:/a:cisco:identity_services_engine:2.4%280.247%29

CVE-2018-0211

2018-03-08T02:29:00.643-05:00

2019-10-09T19:31:30.020-04:00

4.9

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103334 SECTRACK 1040471 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-ise A vulnerability in specific CLI commands for the Cisco Identity Services Engine could allow an authenticated, local attacker to cause a denial of service (DoS) condition. The device may need to be manually rebooted to recover. The vulnerability is due to lack of proper input validation of the CLI user input for certain CLI commands. An attacker could exploit this vulnerability by authenticating to the device and issuing a crafted, malicious CLI command on the targeted device. A successful exploit could allow the attacker to cause a DoS condition. The attacker must have valid administrative privileges on the device to exploit this vulnerability. Cisco Bug IDs: CSCvf63414, CSCvh51992.

cpe:/a:cisco:identity_services_engine:2.1%280.474%29 cpe:/a:cisco:identity_services_engine:2.1%280.904%29 cpe:/a:cisco:identity_services_engine:2.2%280.470%29 cpe:/a:cisco:identity_services_engine:2.3%280.298%29

CVE-2018-0212

2018-03-08T02:29:00.677-05:00

2019-10-09T19:31:30.130-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103333 SECTRACK 1040471 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-ise1 A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvf69963.

cpe:/a:cisco:identity_services_engine:2.1%280.904%29

CVE-2018-0213

2018-03-08T02:29:00.753-05:00

2019-10-09T19:31:30.237-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov BID 103332 SECTRACK 1040471 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-ise2 A vulnerability in the credential reset functionality for Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to gain elevated privileges. The vulnerability is due to a lack of proper input validation. An attacker could exploit this vulnerability by authenticating to the device and sending a crafted HTTP request. A successful exploit could allow the attacker to gain elevated privileges to access functionality that should be restricted. The attacker must have valid user credentials to the device to exploit this vulnerability. Cisco Bug IDs: CSCvf69753.

cpe:/a:cisco:identity_services_engine:2.1%28102.103%29

CVE-2018-0214

2018-03-08T02:29:00.800-05:00

2019-10-09T19:31:30.347-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

ALLOWS_USER_ACCESS

BID 103331 SECTRACK 1040471 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-ise3 A vulnerability in certain CLI commands of Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to execute arbitrary commands on the host operating system with the privileges of the local user, aka Command Injection. These commands should have been restricted from this user. The vulnerability is due to insufficient input validation of CLI command user input. An attacker could exploit this vulnerability by authenticating to the targeted device and issuing a CLI command with crafted user input. A successful exploit could allow the attacker to execute arbitrary commands on the affected system that should be restricted. The attacker would need to have valid user credentials for the device. Cisco Bug IDs: CSCvf49844.

cpe:/a:cisco:identity_services_engine:2.0%280.234%29

CVE-2018-0215

2018-03-08T02:29:00.847-05:00

2019-10-09T19:31:30.487-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 103324 SECTRACK 1040471 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-ise4 A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections on the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user. Cisco Bug IDs: CSCuv32863.

cpe:/a:cisco:identity_services_engine:2.0%280.249%29 cpe:/a:cisco:identity_services_engine:2.1%280.476%29 cpe:/a:cisco:identity_services_engine:2.2%280.471%29 cpe:/a:cisco:identity_services_engine:2.3%280.298%29

CVE-2018-0216

2018-03-08T02:29:00.910-05:00

2019-10-09T19:31:30.597-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103336 SECTRACK 1040471 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-ise5 A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user. Cisco Bug IDs: CSCvf69805.

cpe:/o:cisco:asr_5000_firmware:21.3.0.67664 cpe:/o:cisco:asr_5000_firmware:21.7.0 cpe:/o:cisco:asr_5500_firmware:21.3.0.67664 cpe:/o:cisco:asr_5500_firmware:21.7.0 cpe:/o:cisco:asr_5700_firmware:21.3.0.67664 cpe:/o:cisco:asr_5700_firmware:21.7.0

CVE-2018-0217

2018-03-08T02:29:00.957-05:00

2019-10-09T19:31:30.707-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103346 SECTRACK 1040466 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-staros A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series Aggregation Services Routers could allow an authenticated, local attacker to perform a command injection attack on an affected system. The vulnerability is due to insufficient validation of commands that are supplied to certain configurations in the CLI of the affected operating system. An attacker could exploit this vulnerability by injecting crafted arguments into a vulnerable CLI command for an affected system. A successful exploit could allow the attacker to insert and execute arbitrary commands in the CLI of the affected system. To exploit this vulnerability, the attacker would need to authenticate to an affected system by using valid administrator credentials. Cisco Bug IDs: CSCvg29441.

cpe:/a:cisco:secure_access_control_server_solution_engine:5.8%280.8%29

CVE-2018-0218

2018-03-08T02:29:01.003-05:00

2019-10-09T19:31:30.847-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103345 SECTRACK 1040470 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-acs1 A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker to gain read access to certain information in the affected system. The vulnerability is due to improper handling of XML External Entities (XXEs) when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file. Cisco Bug IDs: CSCve70616.

cpe:/a:cisco:unified_computing_system_director:6.6%280.0%29

CVE-2018-0219

2018-03-08T02:29:01.050-05:00

2019-10-09T19:31:30.957-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103326 SECTRACK 1040467 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-ucs A vulnerability in the web-based management interface of Cisco Unified Computing System (UCS) Director could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvg86518.

cpe:/a:cisco:videoscape_anyres_live:9.7.6

CVE-2018-0220

2018-03-08T02:29:01.097-05:00

2019-10-09T19:31:31.050-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103342 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-val A vulnerability in the web-based management interface of Cisco Videoscape AnyRes Live could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvg87525.

cpe:/a:cisco:identity_services_engine:2.0%280.249%29 cpe:/a:cisco:identity_services_engine:2.1%280.474%29 cpe:/a:cisco:identity_services_engine:2.2%280.470%29 cpe:/a:cisco:identity_services_engine:2.2%280.903%29 cpe:/a:cisco:identity_services_engine:2.3%280.298%29 cpe:/a:cisco:identity_services_engine:2.4%280.192%29

CVE-2018-0221

2018-03-08T02:29:01.160-05:00

2019-10-09T19:31:31.160-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103347 SECTRACK 1040471 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-ise6 A vulnerability in specific CLI commands for the Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to perform command injection to the underlying operating system or cause a hang or disconnect of the user session. The attacker needs valid administrator credentials for the device. The vulnerability is due to incomplete input validation of user input for certain CLI ISE configuration commands. An attacker could exploit this vulnerability by authenticating as an administrative user, issuing a specific CLI command, and entering crafted, malicious user input for the command parameters. An exploit could allow the attacker to perform command injection to the lower-level Linux operating system. It is also possible the attacker could cause the ISE user interface for this management session to hang or disconnect. Cisco Bug IDs: CSCvg95479.

CVE-2018-0222

2018-05-16T23:29:00.217-04:00

2019-10-09T19:31:31.287-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 104193 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-dnac A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to log in to an affected system by using an administrative account that has default, static user credentials. The vulnerability is due to the presence of undocumented, static user credentials for the default administrative account for the affected software. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands with root privileges. This vulnerability affects all releases of Cisco DNA Center Software prior to Release 1.1.3. Cisco Bug IDs: CSCvh98929.

cpe:/a:cisco:security_manager:4.9%280%29qa99

CVE-2018-0223

2018-03-08T02:29:01.207-05:00

2019-10-09T19:31:31.410-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103341 SECTRACK 1040468 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-sm A vulnerability in DesktopServlet in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCuy79668.

cpe:/o:cisco:staros:21.3.0.67664 cpe:/o:cisco:staros:21.5.0

CVE-2018-0224

2018-03-08T02:29:01.283-05:00

2019-10-09T19:31:31.520-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103344 SECTRACK 1040466 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-staros1 A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series Aggregation Services Routers could allow an authenticated, local attacker to execute arbitrary commands with root privileges on an affected operating system. The vulnerability is due to insufficient validation of user-supplied input by the affected operating system. An attacker could exploit this vulnerability by authenticating to an affected system and injecting malicious arguments into a vulnerable CLI command. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the affected system. Cisco Bug IDs: CSCvg38807.

cpe:/a:cisco:appdynamics_app_iq:4.4.3 cpe:/a:cisco:appdynamics_app_iq:4.4.3.9459:hf1 cpe:/a:cisco:appdynamics_app_iq:4.4.3.10005:hf2 cpe:/a:cisco:appdynamics_app_iq:4.4.3.10393:hf3

CVE-2018-0225

2018-06-08T16:29:00.220-04:00

2019-03-29T12:22:15.260-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-03-20T10:07:51.717-04:00

CONFIRM https://docs.appdynamics.com/display/PRO44/Release+Notes#ReleaseNotes-4.4.3.10598(HF4)Updates The Enterprise Console in Cisco AppDynamics App iQ Platform before 4.4.3.10598 (HF4) allows SQL injection, aka the Security Advisory 2089 issue.

cpe:/o:cisco:mobility_express_software:8.3%2890.65%29 cpe:/o:cisco:mobility_express_software:8.4%281.65%29

CVE-2018-0226

2018-05-02T18:29:00.247-04:00

2019-10-09T19:31:31.660-04:00

6.0

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov BID 104124 SECTRACK 1040817 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-aironet-ssh A vulnerability in the assignment and management of default user accounts for Secure Shell (SSH) access to Cisco Aironet 1800, 2800, and 3800 Series Access Points that are running Cisco Mobility Express Software could allow an authenticated, remote attacker to gain elevated privileges on an affected access point. The vulnerability exists because the Cisco Mobility Express controller of the affected software configures the default SSH user account for an access point to be the first SSH user account that was created for the Mobility Express controller, if an administrator added user accounts directly to the controller instead of using the default configuration or the SSH username creation wizard. Although the user account has read-only privileges for the Mobility Express controller, the account could have administrative privileges for an associated access point. An attacker who has valid user credentials for an affected controller could exploit this vulnerability by using the default SSH user account to authenticate to an affected access point via SSH. A successful exploit could allow the attacker to log in to the affected access point with administrative privileges and perform arbitrary administrative actions. This vulnerability affects the following Cisco products: Aironet 1800 Series Access Points that are running Cisco Mobility Express Software Releases 8.2.121.0 through 8.5.105.0, Aironet 2800 Series Access Points that are running Cisco Mobility Express Software Releases 8.3.102.0 through 8.5.105.0, Aironet 3800 Series Access Points that are running Cisco Mobility Express Software Releases 8.3.102.0 through 8.5.105.0. Cisco Bug IDs: CSCva68116.

cpe:/a:cisco:firepower_threat_defense:6.0 cpe:/a:cisco:firepower_threat_defense:6.0.0 cpe:/a:cisco:firepower_threat_defense:6.0.0.1 cpe:/a:cisco:firepower_threat_defense:6.0.1 cpe:/a:cisco:firepower_threat_defense:6.0.1.1 cpe:/a:cisco:firepower_threat_defense:6.0.1.2 cpe:/a:cisco:firepower_threat_defense:6.0.1.3 cpe:/a:cisco:firepower_threat_defense:6.0.1.4 cpe:/a:cisco:firepower_threat_defense:6.1.0 cpe:/a:cisco:firepower_threat_defense:6.1.0.1 cpe:/a:cisco:firepower_threat_defense:6.1.0.2 cpe:/a:cisco:firepower_threat_defense:6.1.0.3 cpe:/a:cisco:firepower_threat_defense:6.1.0.4 cpe:/a:cisco:firepower_threat_defense:6.1.0.5 cpe:/o:cisco:adaptive_security_appliance_software:9.4.3.1 cpe:/o:cisco:adaptive_security_appliance_software:9.4.3.2 cpe:/o:cisco:adaptive_security_appliance_software:9.5.2.7 cpe:/o:cisco:adaptive_security_appliance_software:9.5.2.8

CVE-2018-0227

2018-04-19T16:29:00.300-04:00

2019-10-09T19:31:31.787-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104018 SECTRACK 1040723 MISC https://ics-cert.us-cert.gov/advisories/ICSA-18-184-01 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa1 A vulnerability in the Secure Sockets Layer (SSL) Virtual Private Network (VPN) Client Certificate Authentication feature for Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to establish an SSL VPN connection and bypass certain SSL certificate verification steps. The vulnerability is due to incorrect verification of the SSL Client Certificate. An attacker could exploit this vulnerability by connecting to the ASA VPN without a proper private key and certificate pair. A successful exploit could allow the attacker to establish an SSL VPN connection to the ASA when the connection should have been rejected. This vulnerability affects Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software that is running on the following Cisco products: 3000 Series Industrial Security Appliances (ISA), ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, Adaptive Security Virtual Appliances (ASAv), Firepower 4110 Security Appliances, Firepower 9300 ASA Security Modules. Cisco Bug IDs: CSCvg40155.

cpe:/a:cisco:adaptive_security_appliance_software:9.1 cpe:/a:cisco:adaptive_security_appliance_software:9.1%28.2%29 cpe:/a:cisco:adaptive_security_appliance_software:9.1%28.3%29 cpe:/a:cisco:adaptive_security_appliance_software:9.1%28.5%29 cpe:/a:cisco:adaptive_security_appliance_software:9.1%281%29 cpe:/a:cisco:adaptive_security_appliance_software:9.1%281.7%29 cpe:/a:cisco:adaptive_security_appliance_software:9.1%282%29 cpe:/a:cisco:adaptive_security_appliance_software:9.1%283%29 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%294 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%296 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%297 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%299 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2911 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2912 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2913 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2915 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2916 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2919 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2920 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2921 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2923 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2925 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2929 cpe:/a:cisco:adaptive_security_appliance_software:9.1.1 cpe:/a:cisco:adaptive_security_appliance_software:9.1.4.5 cpe:/a:cisco:adaptive_security_appliance_software:9.1.5.12 cpe:/a:cisco:adaptive_security_appliance_software:9.1.5.21 cpe:/a:cisco:adaptive_security_appliance_software:9.1.6 cpe:/a:cisco:adaptive_security_appliance_software:9.1.6.8 cpe:/a:cisco:adaptive_security_appliance_software:9.1.6.10 cpe:/a:cisco:adaptive_security_appliance_software:9.1.7.4 cpe:/a:cisco:adaptive_security_appliance_software:9.1.7.6 cpe:/a:cisco:adaptive_security_appliance_software:9.1.7.7 cpe:/a:cisco:adaptive_security_appliance_software:9.1.7.9 cpe:/a:cisco:adaptive_security_appliance_software:9.1.7.11 cpe:/a:cisco:adaptive_security_appliance_software:9.1.7.12 cpe:/a:cisco:adaptive_security_appliance_software:9.2%280.0%29 cpe:/a:cisco:adaptive_security_appliance_software:9.2%280.104%29 cpe:/a:cisco:adaptive_security_appliance_software:9.2%283.1%29 cpe:/a:cisco:adaptive_security_appliance_software:9.2%284%2920 cpe:/a:cisco:adaptive_security_appliance_software:9.2%284%2922 cpe:/a:cisco:adaptive_security_appliance_software:9.2%284%2924 cpe:/a:cisco:adaptive_security_appliance_software:9.2%284%2925 cpe:/a:cisco:adaptive_security_appliance_software:9.2%284%2926 cpe:/a:cisco:adaptive_security_appliance_software:9.2%284%2927 cpe:/a:cisco:adaptive_security_appliance_software:9.2%284%2928 cpe:/a:cisco:adaptive_security_appliance_software:9.2%284%2933 cpe:/a:cisco:adaptive_security_appliance_software:9.2.2.7 cpe:/a:cisco:adaptive_security_appliance_software:9.2.2.8 cpe:/a:cisco:adaptive_security_appliance_software:9.2.3.3 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4.2 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4.4 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4.8 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4.10 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4.13 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4.14 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4.16 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4.17 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4.18 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4.19 cpe:/a:cisco:adaptive_security_appliance_software:9.3 cpe:/a:cisco:adaptive_security_appliance_software:9.3%28.2%29 cpe:/a:cisco:adaptive_security_appliance_software:9.3%281%29 cpe:/a:cisco:adaptive_security_appliance_software:9.3%281.50%29 cpe:/a:cisco:adaptive_security_appliance_software:9.3%282%29 cpe:/a:cisco:adaptive_security_appliance_software:9.3%282.200%29 cpe:/a:cisco:adaptive_security_appliance_software:9.3%282.243%29 cpe:/a:cisco:adaptive_security_appliance_software:9.3%283%29 cpe:/a:cisco:adaptive_security_appliance_software:9.3.1.1 cpe:/a:cisco:adaptive_security_appliance_software:9.3.2 cpe:/a:cisco:adaptive_security_appliance_software:9.3.2.2 cpe:/a:cisco:adaptive_security_appliance_software:9.3.3.5 cpe:/a:cisco:adaptive_security_appliance_software:9.3.3.6 cpe:/a:cisco:adaptive_security_appliance_software:9.3.3.9 cpe:/a:cisco:adaptive_security_appliance_software:9.3.3.10 cpe:/a:cisco:adaptive_security_appliance_software:9.3.3.11 cpe:/a:cisco:adaptive_security_appliance_software:9.3.5 cpe:/a:cisco:adaptive_security_appliance_software:9.4 cpe:/a:cisco:adaptive_security_appliance_software:9.4%281%29 cpe:/a:cisco:adaptive_security_appliance_software:9.4%281.1%29 cpe:/a:cisco:adaptive_security_appliance_software:9.4%281.152%29 cpe:/a:cisco:adaptive_security_appliance_software:9.4%281.200%29 cpe:/a:cisco:adaptive_security_appliance_software:9.4%281.225%29 cpe:/a:cisco:adaptive_security_appliance_software:9.4%282%29 cpe:/a:cisco:adaptive_security_appliance_software:9.4%282.145%29 cpe:/a:cisco:adaptive_security_appliance_software:9.4%283%29 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%292 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%295 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%296 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%298 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%2910 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%2912 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%2913 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%2914 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%2916 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%2917 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%2918 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284.5%29 cpe:/a:cisco:adaptive_security_appliance_software:9.4.1 cpe:/a:cisco:adaptive_security_appliance_software:9.4.1.1 cpe:/a:cisco:adaptive_security_appliance_software:9.4.1.2 cpe:/a:cisco:adaptive_security_appliance_software:9.4.1.3 cpe:/a:cisco:adaptive_security_appliance_software:9.4.1.5 cpe:/a:cisco:adaptive_security_appliance_software:9.4.2 cpe:/a:cisco:adaptive_security_appliance_software:9.4.2.3 cpe:/a:cisco:adaptive_security_appliance_software:9.4.3 cpe:/a:cisco:adaptive_security_appliance_software:9.4.3.4 cpe:/a:cisco:adaptive_security_appliance_software:9.4.3.6 cpe:/a:cisco:adaptive_security_appliance_software:9.4.3.8 cpe:/a:cisco:adaptive_security_appliance_software:9.4.3.11 cpe:/a:cisco:adaptive_security_appliance_software:9.4.3.12 cpe:/a:cisco:adaptive_security_appliance_software:9.4.4 cpe:/a:cisco:adaptive_security_appliance_software:9.5 cpe:/a:cisco:adaptive_security_appliance_software:9.5%281%29 cpe:/a:cisco:adaptive_security_appliance_software:9.5.1 cpe:/a:cisco:adaptive_security_appliance_software:9.5.2 cpe:/a:cisco:adaptive_security_appliance_software:9.5.2.6 cpe:/a:cisco:adaptive_security_appliance_software:9.5.2.10 cpe:/a:cisco:adaptive_security_appliance_software:9.5.2.14 cpe:/a:cisco:adaptive_security_appliance_software:9.5.3 cpe:/a:cisco:adaptive_security_appliance_software:9.5.3.1 cpe:/a:cisco:adaptive_security_appliance_software:9.5.3.2 cpe:/a:cisco:adaptive_security_appliance_software:9.5.3.3 cpe:/a:cisco:adaptive_security_appliance_software:9.5.3.6 cpe:/a:cisco:adaptive_security_appliance_software:9.5.3.7 cpe:/a:cisco:adaptive_security_appliance_software:9.6 cpe:/a:cisco:adaptive_security_appliance_software:9.6%281%29 cpe:/a:cisco:adaptive_security_appliance_software:9.6%282%29 cpe:/a:cisco:adaptive_security_appliance_software:9.6%283%293 cpe:/a:cisco:adaptive_security_appliance_software:9.6%283%298 cpe:/a:cisco:adaptive_security_appliance_software:9.6%283%299 cpe:/a:cisco:adaptive_security_appliance_software:9.6%283%2911 cpe:/a:cisco:adaptive_security_appliance_software:9.6%283%2912 cpe:/a:cisco:adaptive_security_appliance_software:9.6%283%2914 cpe:/a:cisco:adaptive_security_appliance_software:9.6%283%2917 cpe:/a:cisco:adaptive_security_appliance_software:9.6%283.1%29 cpe:/a:cisco:adaptive_security_appliance_software:9.6%284%29 cpe:/a:cisco:adaptive_security_appliance_software:9.6%284%293 cpe:/a:cisco:adaptive_security_appliance_software:9.6%284%295 cpe:/a:cisco:adaptive_security_appliance_software:9.6%284%296 cpe:/a:cisco:adaptive_security_appliance_software:9.6%284%298 cpe:/a:cisco:adaptive_security_appliance_software:9.6.0 cpe:/a:cisco:adaptive_security_appliance_software:9.6.1 cpe:/a:cisco:adaptive_security_appliance_software:9.6.1.3 cpe:/a:cisco:adaptive_security_appliance_software:9.6.1.5 cpe:/a:cisco:adaptive_security_appliance_software:9.6.1.10 cpe:/a:cisco:adaptive_security_appliance_software:9.6.2 cpe:/a:cisco:adaptive_security_appliance_software:9.6.2.1 cpe:/a:cisco:adaptive_security_appliance_software:9.6.2.2 cpe:/a:cisco:adaptive_security_appliance_software:9.6.2.3 cpe:/a:cisco:adaptive_security_appliance_software:9.6.2.7 cpe:/a:cisco:adaptive_security_appliance_software:9.7 cpe:/a:cisco:adaptive_security_appliance_software:9.7%281%29 cpe:/a:cisco:adaptive_security_appliance_software:9.7%281%291 cpe:/a:cisco:adaptive_security_appliance_software:9.7%281%292 cpe:/a:cisco:adaptive_security_appliance_software:9.7%281%294 cpe:/a:cisco:adaptive_security_appliance_software:9.7%281%298 cpe:/a:cisco:adaptive_security_appliance_software:9.7%281%2915 cpe:/a:cisco:adaptive_security_appliance_software:9.7%281%2916 cpe:/a:cisco:adaptive_security_appliance_software:9.7%281%2921 cpe:/a:cisco:adaptive_security_appliance_software:9.7%281%2924 cpe:/a:cisco:adaptive_security_appliance_software:9.7%281.4%29 cpe:/a:cisco:adaptive_security_appliance_software:9.8 cpe:/a:cisco:adaptive_security_appliance_software:9.8%280.56%29 cpe:/a:cisco:adaptive_security_appliance_software:9.8%281%29 cpe:/a:cisco:adaptive_security_appliance_software:9.8%281.200%29 cpe:/a:cisco:adaptive_security_appliance_software:9.8%282%29 cpe:/a:cisco:adaptive_security_appliance_software:9.8%282%298 cpe:/a:cisco:adaptive_security_appliance_software:9.8%282%2914 cpe:/a:cisco:adaptive_security_appliance_software:9.8%282%2917 cpe:/a:cisco:adaptive_security_appliance_software:9.8%282%2920 cpe:/a:cisco:adaptive_security_appliance_software:9.8%282%2924 cpe:/a:cisco:adaptive_security_appliance_software:9.8%282%2926 cpe:/a:cisco:adaptive_security_appliance_software:9.8%282%2928 cpe:/a:cisco:adaptive_security_appliance_software:9.8%283%29 cpe:/a:cisco:adaptive_security_appliance_software:9.9 cpe:/a:cisco:adaptive_security_appliance_software:9.9%281%29 cpe:/a:cisco:adaptive_security_appliance_software:9.9%282%29 cpe:/a:cisco:adaptive_security_appliance_software:9.9%282%291 cpe:/a:cisco:adaptive_security_appliance_software:98.1%2812.187%29 cpe:/a:cisco:firepower_threat_defense:6.0 cpe:/a:cisco:firepower_threat_defense:6.0.0 cpe:/a:cisco:firepower_threat_defense:6.0.0.1 cpe:/a:cisco:firepower_threat_defense:6.0.1 cpe:/a:cisco:firepower_threat_defense:6.0.1.1 cpe:/a:cisco:firepower_threat_defense:6.0.1.2 cpe:/a:cisco:firepower_threat_defense:6.0.1.3 cpe:/a:cisco:firepower_threat_defense:6.0.1.4 cpe:/a:cisco:firepower_threat_defense:6.1.0 cpe:/a:cisco:firepower_threat_defense:6.1.0.1 cpe:/a:cisco:firepower_threat_defense:6.1.0.2 cpe:/a:cisco:firepower_threat_defense:6.1.0.3 cpe:/a:cisco:firepower_threat_defense:6.1.0.4 cpe:/a:cisco:firepower_threat_defense:6.1.0.5 cpe:/a:cisco:firepower_threat_defense:6.2.0 cpe:/a:cisco:firepower_threat_defense:6.2.0.1 cpe:/a:cisco:firepower_threat_defense:6.2.0.2 cpe:/a:cisco:firepower_threat_defense:6.2.0.3 cpe:/a:cisco:firepower_threat_defense:6.2.0.4 cpe:/a:cisco:firepower_threat_defense:6.2.1 cpe:/a:cisco:firepower_threat_defense:6.2.2 cpe:/a:cisco:firepower_threat_defense:6.2.2.1

CVE-2018-0228

2018-04-19T16:29:00.363-04:00

2019-10-09T19:31:31.927-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 104220 SECTRACK 1040724 MISC https://ics-cert.us-cert.gov/advisories/ICSA-18-184-01 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa2 A vulnerability in the ingress flow creation functionality of Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause the CPU to increase upwards of 100% utilization, causing a denial of service (DoS) condition on an affected system. The vulnerability is due to incorrect handling of an internal software lock that could prevent other system processes from getting CPU cycles, causing a high CPU condition. An attacker could exploit this vulnerability by sending a steady stream of malicious IP packets that can cause connections to be created on the targeted device. A successful exploit could allow the attacker to exhaust CPU resources, resulting in a DoS condition during which traffic through the device could be delayed. This vulnerability applies to either IPv4 or IPv6 ingress traffic. This vulnerability affects Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software that is running on the following Cisco products: 3000 Series Industrial Security Appliances (ISA), ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, Adaptive Security Virtual Appliances (ASAv), Firepower 2100 Series Security Appliances, Firepower 4110 Security Appliances, Firepower 9300 ASA Security Modules. Cisco Bug IDs: CSCvf63718.

cpe:/a:cisco:adaptive_security_appliance_software:9.8%281.245%29 cpe:/a:cisco:anyconnect_secure_mobility_client:4.6%28200%29

CVE-2018-0229

2018-04-19T16:29:00.410-04:00

2019-10-09T19:31:32.050-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103939 SECTRACK 1040711 SECTRACK 1040712 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asaanyconnect A vulnerability in the implementation of Security Assertion Markup Language (SAML) Single Sign-On (SSO) authentication for Cisco AnyConnect Secure Mobility Client for Desktop Platforms, Cisco Adaptive Security Appliance (ASA) Software, and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to establish an authenticated AnyConnect session through an affected device running ASA or FTD Software. The authentication would need to be done by an unsuspecting third party, aka Session Fixation. The vulnerability exists because there is no mechanism for the ASA or FTD Software to detect that the authentication request originates from the AnyConnect client directly. An attacker could exploit this vulnerability by persuading a user to click a crafted link and authenticating using the company's Identity Provider (IdP). A successful exploit could allow the attacker to hijack a valid authentication token and use that to establish an authenticated AnyConnect session through an affected device running ASA or FTD Software. This vulnerability affects the Cisco AnyConnect Secure Mobility Client, and ASA Software and FTD Software configured for SAML 2.0-based SSO for AnyConnect Remote Access VPN that is running on the following Cisco products: 3000 Series Industrial Security Appliances (ISA), ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4100 Series Security Appliance, Firepower 9300 ASA Security Module, FTD Virtual (FTDv). Cisco Bug IDs: CSCvg65072, CSCvh87448.

cpe:/a:cisco:adaptive_security_appliance_software:9.8%282%29 cpe:/a:cisco:firepower_threat_defense:6.2.1 cpe:/a:cisco:firepower_threat_defense:6.2.2

CVE-2018-0230

2018-04-19T16:29:00.473-04:00

2019-10-09T19:31:32.160-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103931 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-fp2100 A vulnerability in the internal packet-processing functionality of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series Security Appliances could allow an unauthenticated, remote attacker to cause an affected device to stop processing traffic, resulting in a denial of service (DoS) condition. The vulnerability is due to the affected software improperly validating IP Version 4 (IPv4) and IP Version 6 (IPv6) packets after the software reassembles the packets (following IP Fragmentation). An attacker could exploit this vulnerability by sending a series of malicious, fragmented IPv4 or IPv6 packets to an affected device. A successful exploit could allow the attacker to cause Snort processes on the affected device to hang at 100% CPU utilization, which could cause the device to stop processing traffic and result in a DoS condition until the device is reloaded manually. This vulnerability affects Cisco Firepower Threat Defense (FTD) Software Releases 6.2.1 and 6.2.2, if the software is running on a Cisco Firepower 2100 Series Security Appliance. Cisco Bug IDs: CSCvf91098.

cpe:/a:cisco:adaptive_security_appliance_software:9.8%281%29 cpe:/a:cisco:adaptive_security_appliance_software:98.1%281.154%29 cpe:/a:cisco:firepower_threat_defense:6.0 cpe:/a:cisco:firepower_threat_defense:6.0.0 cpe:/a:cisco:firepower_threat_defense:6.0.0.1 cpe:/a:cisco:firepower_threat_defense:6.0.1 cpe:/a:cisco:firepower_threat_defense:6.0.1.1 cpe:/a:cisco:firepower_threat_defense:6.0.1.2 cpe:/a:cisco:firepower_threat_defense:6.0.1.3 cpe:/a:cisco:firepower_threat_defense:6.0.1.4 cpe:/a:cisco:firepower_threat_defense:6.1.0 cpe:/a:cisco:firepower_threat_defense:6.1.0.1 cpe:/a:cisco:firepower_threat_defense:6.1.0.2 cpe:/a:cisco:firepower_threat_defense:6.1.0.3 cpe:/a:cisco:firepower_threat_defense:6.1.0.4 cpe:/a:cisco:firepower_threat_defense:6.1.0.5 cpe:/a:cisco:firepower_threat_defense:6.2.1 cpe:/a:cisco:firepower_threat_defense:6.2.2

CVE-2018-0231

2018-04-19T16:29:00.533-04:00

2019-10-09T19:31:32.287-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1040725 MISC https://ics-cert.us-cert.gov/advisories/ICSA-18-184-01 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa3 A vulnerability in the Transport Layer Security (TLS) library of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a reload of the affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a malicious TLS message to an interface enabled for Secure Layer Socket (SSL) services on an affected device. Messages using SSL Version 3 (SSLv3) or SSL Version 2 (SSLv2) cannot be be used to exploit this vulnerability. An exploit could allow the attacker to cause a buffer underflow, triggering a crash on an affected device. This vulnerability affects Cisco ASA Software and Cisco FTD Software that is running on the following Cisco products: Adaptive Security Virtual Appliance (ASAv), Firepower Threat Defense Virtual (FTDv), Firepower 2100 Series Security Appliance. Cisco Bug IDs: CSCve18902, CSCve34335, CSCve38446.

cpe:/a:cisco:firepower_management_center:5.4.0 cpe:/a:cisco:firepower_management_center:6.0.0 cpe:/a:cisco:firepower_management_center:6.1.0 cpe:/a:cisco:firepower_management_center:6.2.0 cpe:/a:cisco:firepower_management_center:6.2.1

CVE-2018-0233

2018-04-19T16:29:00.580-04:00

2019-10-09T19:31:32.410-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103930 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-fpsnort A vulnerability in the Secure Sockets Layer (SSL) packet reassembly functionality of the detection engine in Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause the detection engine to consume excessive system memory on an affected device, which could cause a denial of service (DoS) condition. The vulnerability is due to the affected software improperly handling changes to SSL connection states. An attacker could exploit this vulnerability by sending crafted SSL connections through an affected device. A successful exploit could allow the attacker to cause the detection engine to consume excessive system memory on the affected device, which could cause a DoS condition. The device may need to be reloaded manually to recover from this condition. This vulnerability affects Cisco Firepower System Software Releases 6.0.0 and later, running on any of the following Cisco products: Adaptive Security Appliance (ASA) 5500-X Series Firewalls with FirePOWER Services, Adaptive Security Appliance (ASA) 5500-X Series Next-Generation Firewalls, Advanced Malware Protection (AMP) for Networks, 7000 Series Appliances, Advanced Malware Protection (AMP) for Networks, 8000 Series Appliances, Firepower 4100 Series Appliances, FirePOWER 7000 Series Appliances, FirePOWER 8000 Series Appliances, Firepower 9300 Series Security Appliances, Firepower Threat Defense for Integrated Services Routers (ISRs), Firepower Threat Defense Virtual for VMware, Industrial Security Appliance 3000, Sourcefire 3D System Appliances. Cisco Bug IDs: CSCve23031.

cpe:/o:cisco:aironet_access_point_software:8.4%28100.0%29 cpe:/o:cisco:aironet_access_point_software:8.5%28103.0%29 cpe:/o:cisco:aironet_access_point_software:8.5%28105.0%29

CVE-2018-0234

2018-05-02T18:29:00.323-04:00

2019-10-09T19:31:32.537-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 104081 SECTRACK 1040820 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-ap-ptp A vulnerability in the implementation of Point-to-Point Tunneling Protocol (PPTP) functionality in Cisco Aironet 1810, 1830, and 1850 Series Access Points could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient validation of Generic Routing Encapsulation (GRE) frames that pass through the data plane of an affected access point. An attacker could exploit this vulnerability by initiating a PPTP connection to an affected access point from a device that is registered to the same wireless network as the access point and sending a malicious GRE frame through the data plane of the access point. A successful exploit could allow the attacker to cause the NSS core process on the affected access point to crash, which would cause the access point to reload and result in a DoS condition. This vulnerability affects Cisco Aironet 1810, 1830, and 1850 Series Access Points that are running Cisco Mobility Express Software Release 8.4.100.0, 8.5.103.0, or 8.5.105.0 and are configured as a master, subordinate, or standalone access point. Cisco Bug IDs: CSCvf73890.

cpe:/o:cisco:wireless_lan_controller_software:8.6%281.106%29 cpe:/o:cisco:wireless_lan_controller_software:8.6%281.114%29

CVE-2018-0235

2018-05-02T18:29:00.387-04:00

2019-10-09T19:31:32.660-04:00

6.1

ADJACENT_NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 104080 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-wlc-mfdos A vulnerability in the 802.11 frame validation functionality of the Cisco Wireless LAN Controller (WLC) could allow an unauthenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to incomplete input validation of certain 802.11 management information element frames that an affected device receives from wireless clients. An attacker could exploit this vulnerability by sending a malformed 802.11 management frame to an affected device. A successful exploit could allow the attacker to cause the affected device to reload unexpectedly, resulting in a DoS condition. This vulnerability affects only Cisco Wireless LAN Controllers that are running Cisco Mobility Express Release 8.5.103.0. Cisco Bug IDs: CSCvg07024.

CVE-2018-0236

2019-03-21T11:28:19.997-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

cpe:/a:cisco:advanced_malware_protection_for_endpoints:1.4%285%29::~~~mac_os_x~~

CVE-2018-0237

2018-04-19T16:29:00.643-04:00

2019-10-09T19:31:32.787-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-amp MISC https://wwws.nightwatchcybersecurity.com/2018/02/25/research-compressed-files-auto-detection-on-macos/ A vulnerability in the file type detection mechanism of the Cisco Advanced Malware Protection (AMP) for Endpoints macOS Connector could allow an unauthenticated, remote attacker to bypass malware detection. The vulnerability occurs because the software relies on only the file extension for detecting DMG files. An attacker could exploit this vulnerability by sending a DMG file with a nonstandard extension to a device that is running an affected AMP for Endpoints macOS Connector. An exploit could allow the attacker to bypass configured malware detection. Cisco Bug IDs: CSCve34034.

cpe:/a:cisco:unified_computing_system_director:6.5%280.0%29 cpe:/a:cisco:unified_computing_system_director:6.5%280.1%29

CVE-2018-0238

2018-04-19T16:29:00.707-04:00

2019-10-09T19:31:32.880-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov BID 103919 SECTRACK 1040708 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-uscd A vulnerability in the role-based resource checking functionality of the Cisco Unified Computing System (UCS) Director could allow an authenticated, remote attacker to view unauthorized information for any virtual machine in the UCS Director end-user portal and perform any permitted operations on any virtual machine. The permitted operations can be configured for the end user on the virtual machines with either of the following settings: The virtual machine is associated to a Virtual Data Center (VDC) that has an end user self-service policy attached to the VDC. The end user role has VM Management Actions settings configured under User Permissions. This is a global configuration, so all the virtual machines visible in the end-user portal will have the VM management actions available. The vulnerability is due to improper user authentication checks. An attacker could exploit this vulnerability by logging in to the UCS Director with a modified username and valid password. A successful exploit could allow the attacker to gain visibility into and perform actions against all virtual machines in the UCS Director end-user portal of the affected system. This vulnerability affects Cisco Unified Computing System (UCS) Director releases 6.0 and 6.5 prior to patch 3 that are in a default configuration. Cisco Bug IDs: CSCvh53501.

cpe:/o:cisco:staros:21.0.v0.65819 cpe:/o:cisco:staros:21.0.v4 cpe:/o:cisco:staros:21.1.v6 cpe:/o:cisco:staros:21.3.1 cpe:/o:cisco:staros:21.4.0

CVE-2018-0239

2018-04-19T16:29:00.770-04:00

2019-10-09T19:31:32.987-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 103923 SECTRACK 1040720 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-staros A vulnerability in the egress packet processing functionality of the Cisco StarOS operating system for Cisco Aggregation Services Router (ASR) 5700 Series devices and Virtualized Packet Core (VPC) System Software could allow an unauthenticated, remote attacker to cause an interface on the device to cease forwarding packets. The device may need to be manually reloaded to clear this Interface Forwarding Denial of Service condition. The vulnerability is due to the failure to properly check that the length of a packet to transmit does not exceed the maximum supported length of the network interface card (NIC). An attacker could exploit this vulnerability by sending a crafted IP packet or a series of crafted IP fragments through an interface on the targeted device. A successful exploit could allow the attacker to cause the network interface to cease forwarding packets. This vulnerability could be triggered by either IPv4 or IPv6 network traffic. This vulnerability affects the following Cisco products when they are running the StarOS operating system and a virtual interface card is installed on the device: Aggregation Services Router (ASR) 5700 Series, Virtualized Packet Core-Distributed Instance (VPC-DI) System Software, Virtualized Packet Core-Single Instance (VPC-SI) System Software. Cisco Bug IDs: CSCvf32385.

cpe:/a:cisco:adaptive_security_appliance_software:9.6%284%29 cpe:/a:cisco:adaptive_security_appliance_software:9.6.1 cpe:/a:cisco:adaptive_security_appliance_software:9.6.1.3 cpe:/a:cisco:adaptive_security_appliance_software:9.6.1.5 cpe:/a:cisco:adaptive_security_appliance_software:9.6.1.10 cpe:/a:cisco:adaptive_security_appliance_software:9.6.2 cpe:/a:cisco:adaptive_security_appliance_software:9.6.2.1 cpe:/a:cisco:adaptive_security_appliance_software:9.6.2.2 cpe:/a:cisco:adaptive_security_appliance_software:9.6.2.3 cpe:/a:cisco:adaptive_security_appliance_software:9.6.2.7 cpe:/a:cisco:adaptive_security_appliance_software:9.7%281%29 cpe:/a:cisco:adaptive_security_appliance_software:9.7%281.17%29 cpe:/a:cisco:adaptive_security_appliance_software:9.8%282.12%29 cpe:/a:cisco:adaptive_security_appliance_software:9.8%282.21%29 cpe:/a:cisco:adaptive_security_appliance_software:9.9%281.77%29 cpe:/a:cisco:adaptive_security_appliance_software:99.1%2820.190%29 cpe:/a:cisco:adaptive_security_appliance_software:99.2%280.32%29 cpe:/a:cisco:adaptive_security_appliance_software:101.3%281.23%29 cpe:/a:cisco:adaptive_security_appliance_software:101.3%281.51%29 cpe:/a:cisco:adaptive_security_appliance_software:101.4%281.24%29 cpe:/a:cisco:adaptive_security_virtual_appliance:v5 cpe:/a:cisco:adaptive_security_virtual_appliance:v10 cpe:/a:cisco:adaptive_security_virtual_appliance:v30 cpe:/a:cisco:adaptive_security_virtual_appliance:v50 cpe:/a:cisco:firepower_threat_defense_virtual:-

CVE-2018-0240

2018-04-19T16:29:00.817-04:00

2019-10-09T19:31:33.113-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103934 SECTRACK 1040722 MISC https://ics-cert.us-cert.gov/advisories/ICSA-18-184-01 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa_inspect Multiple vulnerabilities in the Application Layer Protocol Inspection feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerabilities are due to logical errors during traffic inspection. An attacker could exploit these vulnerabilities by sending a high volume of malicious traffic across an affected device. An exploit could allow the attacker to cause a deadlock condition, resulting in a reload of an affected device. These vulnerabilities affect Cisco ASA Software and Cisco FTD Software configured for Application Layer Protocol Inspection running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4100 Series Security Appliance, Firepower 9300 ASA Security Module, FTD Virtual (FTDv). Cisco Bug IDs: CSCve61540, CSCvh23085, CSCvh95456.

cpe:/o:cisco:ios_xr:4.0.4.base cpe:/o:cisco:ios_xr:4.1.3.base cpe:/o:cisco:ios_xr:4.2.4.base cpe:/o:cisco:ios_xr:4.3.4.base cpe:/o:cisco:ios_xr:4.4.3.ce cpe:/o:cisco:ios_xr:5.0.3.ce cpe:/o:cisco:ios_xr:5.1.4.base cpe:/o:cisco:ios_xr:5.2.5.ce cpe:/o:cisco:ios_xr:5.3.4.base cpe:/o:cisco:ios_xr:5.4.3.ce cpe:/o:cisco:ios_xr:6.0.4.base cpe:/o:cisco:ios_xr:6.1.4.base cpe:/o:cisco:ios_xr:6.2.3.base

CVE-2018-0241

2018-04-19T16:29:00.877-04:00

2019-10-09T19:31:33.427-04:00

6.1

ADJACENT_NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 103929 SECTRACK 1040710 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-iosxr A vulnerability in the UDP broadcast forwarding function of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on the affected device. The vulnerability is due to improper handling of UDP broadcast packets that are forwarded to an IPv4 helper address. An attacker could exploit this vulnerability by sending multiple UDP broadcast packets to the affected device. An exploit could allow the attacker to cause a buffer leak on the affected device, eventually resulting in a DoS condition requiring manual intervention to recover. This vulnerability affects all Cisco IOS XR platforms running 6.3.1, 6.2.3, or earlier releases of Cisco IOS XR Software when at least one IPv4 helper address is configured on an interface of the device. Cisco Bug IDs: CSCvi35625.

cpe:/a:cisco:adaptive_security_appliance_software:9.1%287.245%29 cpe:/a:cisco:adaptive_security_appliance_software:9.6%283%29 cpe:/a:cisco:adaptive_security_appliance_software:9.8%281%29 cpe:/a:cisco:adaptive_security_appliance_software:9.8%282%29

CVE-2018-0242

2018-04-19T16:29:00.927-04:00

2019-10-09T19:31:33.567-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103932 SECTRACK 1040713 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asawvpn A vulnerability in the WebVPN web-based management interface of Cisco Adaptive Security Appliance could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvg33985.

cpe:/a:cisco:firepower_threat_defense:5.3.0 cpe:/a:cisco:firepower_threat_defense:5.4.0 cpe:/a:cisco:firepower_threat_defense:6.0 cpe:/a:cisco:firepower_threat_defense:6.0.0 cpe:/a:cisco:firepower_threat_defense:6.0.0.1 cpe:/a:cisco:firepower_threat_defense:6.0.1 cpe:/a:cisco:firepower_threat_defense:6.0.1.1 cpe:/a:cisco:firepower_threat_defense:6.0.1.2 cpe:/a:cisco:firepower_threat_defense:6.0.1.3 cpe:/a:cisco:firepower_threat_defense:6.0.1.4 cpe:/a:cisco:firepower_threat_defense:6.1.0 cpe:/a:cisco:firepower_threat_defense:6.1.0.1 cpe:/a:cisco:firepower_threat_defense:6.1.0.2 cpe:/a:cisco:firepower_threat_defense:6.1.0.3 cpe:/a:cisco:firepower_threat_defense:6.1.0.4 cpe:/a:cisco:firepower_threat_defense:6.1.0.5 cpe:/a:cisco:firepower_threat_defense:6.1.0.6 cpe:/a:cisco:firepower_threat_defense:6.1.0.7 cpe:/a:cisco:firepower_threat_defense:6.2.0 cpe:/a:cisco:firepower_threat_defense:6.2.0.1 cpe:/a:cisco:firepower_threat_defense:6.2.0.2 cpe:/a:cisco:firepower_threat_defense:6.2.0.3 cpe:/a:cisco:firepower_threat_defense:6.2.0.4 cpe:/a:cisco:firepower_threat_defense:6.2.0.5 cpe:/a:cisco:firepower_threat_defense:6.2.1 cpe:/a:cisco:firepower_threat_defense:6.2.2 cpe:/a:cisco:firepower_threat_defense:6.2.2.1 cpe:/a:cisco:firepower_threat_defense:6.2.2.2 cpe:/a:cisco:firepower_threat_defense:6.2.2.3 cpe:/a:cisco:firepower_threat_defense:6.2.2.4 cpe:/a:cisco:firepower_threat_defense:6.2.2.5

CVE-2018-0243

2018-04-19T16:29:00.973-04:00

2019-10-09T19:31:33.707-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103943 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-fss A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a configured file action policy that is intended to drop the Server Message Block Version 2 (SMB2) and SMB Version 3 (SMB3) protocols if malware is detected. The vulnerability is due to incorrect detection of an SMB2 or SMB3 file based on the total file length. An attacker could exploit this vulnerability by sending a crafted SMB2 or SMB3 transfer request through the targeted device. An exploit could allow the attacker to pass SMB2 or SMB3 files that could be malware even though the device is configured to block them. This vulnerability does not exist for SMB Version 1 (SMB1) files. This vulnerability affects Cisco Firepower System Software when one or more file action policies are configured, on software releases prior to 6.2.3. Cisco Bug IDs: CSCvg68807.

CVE-2018-0244

2018-04-19T16:29:01.020-04:00

2019-10-09T19:31:33.817-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103945 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-fss1 A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a configured file action policy to drop the Server Message Block (SMB) protocol if a malware file is detected. The vulnerability is due to how the SMB protocol handles a case in which a large file transfer fails. This case occurs when some pieces of the file are successfully transferred to the remote endpoint, but ultimately the file transfer fails and is reset. An attacker could exploit this vulnerability by sending a crafted SMB file transfer request through the targeted device. An exploit could allow the attacker to pass an SMB file that contains malware, which the device is configured to block. This vulnerability affects Cisco Firepower System Software when one or more file action policies are configured, on software releases prior to 6.2.3. Cisco Bug IDs: CSCvc20141.

cpe:/o:cisco:wireless_lan_controller_software:8.3%28133.0%29 cpe:/o:cisco:wireless_lan_controller_software:8.5%28105.0%29

CVE-2018-0245

2018-05-02T18:29:00.450-04:00

2019-10-09T19:31:33.927-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104123 SECTRACK 1040823 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-wlc-id A vulnerability in the REST API of Cisco 5500 and 8500 Series Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to view system information that under normal circumstances should be prohibited. The vulnerability is due to incomplete input and validation checking mechanisms in the REST API URL request. An attacker could exploit this vulnerability by sending a malicious URL to the REST API. If successful, an exploit could allow the attacker to view sensitive system information. Cisco Bug IDs: CSCvg89442.

CVE-2018-0246

2019-03-21T11:28:20.010-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

cpe:/o:cisco:aironet_access_point_software:8.3%28104.105%29 cpe:/o:cisco:aironet_access_point_software:8.5%28107.52%29 cpe:/o:cisco:wireless_lan_controller_software:8.3%28104.105%29

CVE-2018-0247

2018-05-02T18:29:00.513-04:00

2019-10-09T19:31:34.050-04:00

3.3

ADJACENT_NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104087 SECTRACK 1040814 SECTRACK 1040815 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-aironet-auth A vulnerability in Web Authentication (WebAuth) clients for the Cisco Wireless LAN Controller (WLC) and Aironet Access Points running Cisco IOS Software could allow an unauthenticated, adjacent attacker to bypass authentication and pass traffic. The vulnerability is due to incorrect implementation of authentication for WebAuth clients in a specific configuration. An attacker could exploit this vulnerability by sending traffic to local network resources without having gone through authentication. A successful exploit could allow the attacker to bypass authentication and pass traffic. This affects Cisco Aironet Access Points running Cisco IOS Software and Cisco Wireless LAN Controller (WLC) releases prior to 8.5.110.0 for the following specific WLC configuration only: (1) The Access Point (AP) is configured in FlexConnect Mode with NAT. (2) The WLAN is configured for central switching, meaning the client is being assigned a unique IP address. (3) The AP is configured with a Split Tunnel access control list (ACL) for access to local network resources, meaning the AP is doing the NAT on the connection. (4) The client is using WebAuth. This vulnerability does not apply to .1x clients in the same configuration. Cisco Bug IDs: CSCvc79502, CSCvf71789.

cpe:/a:cisco:wireless_lan_controller_software:7.4.1.1 cpe:/a:cisco:wireless_lan_controller_software:7.4.1.19 cpe:/a:cisco:wireless_lan_controller_software:7.4.100.60 cpe:/a:cisco:wireless_lan_controller_software:7.6.1.62 cpe:/a:cisco:wireless_lan_controller_software:7.6.110.0 cpe:/a:cisco:wireless_lan_controller_software:7.6.120.0 cpe:/a:cisco:wireless_lan_controller_software:7.6.130.0 cpe:/a:cisco:wireless_lan_controller_software:8.0.72.140 cpe:/a:cisco:wireless_lan_controller_software:8.0.100 cpe:/a:cisco:wireless_lan_controller_software:8.0.115.0 cpe:/a:cisco:wireless_lan_controller_software:8.0.120.0 cpe:/a:cisco:wireless_lan_controller_software:8.0_base cpe:/a:cisco:wireless_lan_controller_software:8.1.0 cpe:/a:cisco:wireless_lan_controller_software:8.1.104.37 cpe:/a:cisco:wireless_lan_controller_software:8.1.111.0 cpe:/a:cisco:wireless_lan_controller_software:8.1.122.0

CVE-2018-0248

2019-04-17T18:29:00.217-04:00

2019-10-09T19:31:34.177-04:00

6.8

NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov BID 108009 CISCO 20190417 Cisco Wireless LAN Controller Software GUI Configuration Denial of Service Vulnerabilities A vulnerability in the administrative GUI configuration feature of Cisco Wireless LAN Controller (WLC) Software could allow an aUTHENTICated, remote attacker to cause the device to reload unexpectedly during device configuration when the administrator is using this GUI, causing a denial of service (DoS) condition on an affected device. The attacker would need to have valid administrator credentials on the device. This vulnerability is due to incomplete input validation for unexpected configuration options that the attacker could submit while accessing the GUI configuration menus. An attacker could exploit these vulnerabilities by authenticating to the device and submitting crafted user input when using the administrative GUI configuration feature. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition. Software versions prior to 8.3.150.0, 8.5.140.0, 8.8.111.0 are affected by this vulnerability.

cpe:/o:cisco:aironet_access_point_software:8.2%28161.0%29

CVE-2018-0249

2018-05-02T18:29:00.573-04:00

2019-10-09T19:31:34.363-04:00

3.3

ADJACENT_NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1040816 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-aironet-dos A vulnerability when handling incoming 802.11 Association Requests for Cisco Aironet 1800 Series Access Point (APs) on Qualcomm Atheros (QCA) based hardware platforms could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected system. A successful exploit could prevent new clients from joining the AP. The vulnerability is due to incorrect handling of malformed or invalid 802.11 Association Requests. An attacker could exploit this vulnerability by sending a malformed stream of 802.11 Association Requests to the local interface of the targeted device. A successful exploit could allow the attacker to cause a DoS situation on an affected system, causing new client 802.11 Association Requests to fail. This vulnerability affects the following Cisco products: Aironet 1560 Series Access Points, Aironet 1810 Series OfficeExtend Access Points, Aironet 1810w Series Access Points, Aironet 1815 Series Access Points, Aironet 1830 Series Access Points, Aironet 1850 Series Access Points, Aironet 2800 Series Access Points, Aironet 3800 Series Access Points. Cisco Bug IDs: CSCvg02116.

cpe:/o:cisco:aironet_access_point_software:8.2%28160.0%29 cpe:/o:cisco:aironet_access_point_software:8.4%28100.0%29 cpe:/o:cisco:aironet_access_point_software:8.7%281.3%29

CVE-2018-0250

2018-05-02T18:29:00.637-04:00

2019-10-09T19:31:34.473-04:00

2.7

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1040818 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-ap-acl A vulnerability in Central Web Authentication (CWA) with FlexConnect Access Points (APs) for Cisco Aironet 1560, 1810, 1810w, 1815, 1830, 1850, 2800, and 3800 Series APs could allow an authenticated, adjacent attacker to bypass a configured FlexConnect access control list (ACL). The vulnerability is due to the AP ignoring the ACL download from the client during authentication. An attacker could exploit this vulnerability by connecting to the targeted device with a vulnerable configuration. A successful exploit could allow the attacker to bypass a configured client FlexConnect ACL. This vulnerability affects the following Cisco products if they are running a vulnerable release of Central Web Authentication with FlexConnect Access Points Software: Aironet 1560 Series Access Points, Aironet 1810 Series OfficeExtend Access Points, Aironet 1810w Series Access Points, Aironet 1815 Series Access Points, Aironet 1830 Series Access Points, Aironet 1850 Series Access Points, Aironet 2800 Series Access Points, Aironet 3800 Series Access Points. Note: Central Web Authentication with FlexConnect Access Points was an unsupported configuration until 8.5.100.0. Cisco Bug IDs: CSCve17756.

cpe:/a:cisco:adaptive_security_appliance_software:9.8%282.15%29 cpe:/a:cisco:adaptive_security_appliance_software:9.9%281%29

CVE-2018-0251

2018-04-19T16:29:01.080-04:00

2019-10-09T19:31:34.613-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103926 SECTRACK 1040714 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asawvpn2 A vulnerability in the Web Server Authentication Required screen of the Clientless Secure Sockets Layer (SSL) VPN portal of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of that portal on an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the portal or allow the attacker to access sensitive browser-based information. This vulnerability affects the following Cisco products if they are running a vulnerable release of Cisco ASA Software: 3000 Series Industrial Security Appliances, Adaptive Security Virtual Appliance (ASAv), ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches, ASA Services Module for Cisco 7600 Series Routers. Cisco Bug IDs: CSCvh20742.

cpe:/o:cisco:wireless_lan_controller_software:8.4%28100.0%29 cpe:/o:cisco:wireless_lan_controller_software:8.5%28107.30%29 cpe:/o:cisco:wireless_lan_controller_software:8.5%28107.41%29 cpe:/o:cisco:wireless_lan_controller_software:8.6%281.108%29

CVE-2018-0252

2018-05-02T18:29:00.683-04:00

2019-10-09T19:31:34.833-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1040822 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-wlc-ip A vulnerability in the IP Version 4 (IPv4) fragment reassembly function of Cisco 3500, 5500, and 8500 Series Wireless LAN Controller Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to a corruption of an internal data structure process that occurs when the affected software reassembles certain IPv4 packets. An attacker could exploit this vulnerability by sending certain malformed IPv4 fragments to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition. This vulnerability affects all releases of 8.4 until the first fixed release for the 5500 and 8500 Series Wireless LAN Controllers and releases 8.5.103.0 and 8.5.105.0 for the 3500, 5500, and 8500 Series Wireless LAN Controllers. Cisco Bug IDs: CSCvf89222.

cpe:/a:cisco:secure_access_control_system:- cpe:/a:cisco:secure_access_control_system:5.3.0.40.1 cpe:/a:cisco:secure_access_control_system:5.3.0.40.2 cpe:/a:cisco:secure_access_control_system:5.3.0.40.3 cpe:/a:cisco:secure_access_control_system:5.3.0.40.4 cpe:/a:cisco:secure_access_control_system:5.3.0.40.5 cpe:/a:cisco:secure_access_control_system:5.3.0.40.6 cpe:/a:cisco:secure_access_control_system:5.3.0.40.7 cpe:/a:cisco:secure_access_control_system:5.3.0.40.8 cpe:/a:cisco:secure_access_control_system:5.3.0.40.9 cpe:/a:cisco:secure_access_control_system:5.4.0.46.1 cpe:/a:cisco:secure_access_control_system:5.4.0.46.2 cpe:/a:cisco:secure_access_control_system:5.4.0.46.3 cpe:/a:cisco:secure_access_control_system:5.4.0.46.4 cpe:/a:cisco:secure_access_control_system:5.4.0.46.5 cpe:/a:cisco:secure_access_control_system:5.4.0.46.6 cpe:/a:cisco:secure_access_control_system:5.5%280.1%29 cpe:/a:cisco:secure_access_control_system:5.5.0.46 cpe:/a:cisco:secure_access_control_system:5.7%280.15%29 cpe:/a:cisco:secure_access_control_system:5.8 cpe:/a:cisco:secure_access_control_system:5.8:p1 cpe:/a:cisco:secure_access_control_system:5.8:p2 cpe:/a:cisco:secure_access_control_system:5.8:p3 cpe:/a:cisco:secure_access_control_system:5.8:p4 cpe:/a:cisco:secure_access_control_system:5.8:p6 cpe:/a:cisco:secure_access_control_system:5.8%280.8%29

CVE-2018-0253

2018-05-02T18:29:00.747-04:00

2019-10-09T19:31:34.943-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 104075 SECTRACK 1040808 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-acs1 A vulnerability in the ACS Report component of Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected system. Commands executed by the attacker are processed at the targeted user's privilege level. The vulnerability is due to insufficient validation of the Action Message Format (AMF) protocol. An attacker could exploit this vulnerability by sending a crafted AMF message that contains malicious code to a targeted user. A successful exploit could allow the attacker to execute arbitrary commands on the ACS device. This vulnerability affects all releases of Cisco Secure ACS prior to Release 5.8 Patch 7. Cisco Bug IDs: CSCve69037.

cpe:/a:cisco:firepower_threat_defense:6.1.0.5 cpe:/a:cisco:firepower_threat_defense:6.2.0.2 cpe:/a:cisco:firepower_threat_defense:6.2.1 cpe:/a:cisco:firepower_threat_defense:6.2.2

CVE-2018-0254

2018-04-19T16:29:01.127-04:00

2019-10-09T19:31:35.050-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103940 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-fss2 A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass configured file action policies if an Intelligent Application Bypass (IAB) with a drop percentage threshold is also configured. The vulnerability is due to incorrect counting of the percentage of dropped traffic. An attacker could exploit this vulnerability by sending network traffic to a targeted device. An exploit could allow the attacker to bypass configured file action policies, and traffic that should be dropped could be allowed into the network. Cisco Bug IDs: CSCvf86435.

cpe:/o:cisco:ios:15.2%285%29e

CVE-2018-0255

2018-04-19T16:29:01.177-04:00

2019-10-09T19:31:35.193-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1040715 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-iess A vulnerability in the device manager web interface of Cisco Industrial Ethernet Switches could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of an affected system. The vulnerability is due to insufficient CSRF protection by the device manager web interface. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link or visit an attacker-controlled website. A successful exploit could allow the attacker to submit arbitrary requests to an affected device via the device manager web interface with the privileges of the user. This vulnerability affects the following Cisco Industrial Ethernet (IE) Switches if they are running a vulnerable release of Cisco IOS Software: IE 2000 Series, IE 2000U Series, IE 3000 Series, IE 3010 Series, IE 4000 Series, IE 4010 Series, IE 5000 Series. Cisco Bug IDs: CSCvc96405.

cpe:/o:cisco:asr_5000_series_software:20.3.0.66671 cpe:/o:cisco:asr_5000_series_software:p2p_2.16.879

CVE-2018-0256

2018-04-19T16:29:01.253-04:00

2019-10-09T19:31:35.300-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 103951 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-pdng A vulnerability in the peer-to-peer message processing functionality of Cisco Packet Data Network Gateway could allow an unauthenticated, remote attacker to cause the Session Manager (SESSMGR) process on an affected device to restart, resulting in a denial of service (DoS) condition. The vulnerability is due to incorrect validation of peer-to-peer packet headers. An attacker could exploit this vulnerability by sending a crafted peer-to-peer packet through an affected device. A successful exploit could allow the attacker to cause the SESSMGR process on the affected device to restart unexpectedly, which could briefly impact traffic while the SESSMGR process restarts and result in a DoS condition. Cisco Bug IDs: CSCvg88786.

cpe:/o:cisco:ios_xe:3.18.0as cpe:/o:cisco:ios_xe:3.18.0s cpe:/o:cisco:ios_xe:15.6%282%29sp cpe:/o:cisco:ios_xe:16.4 cpe:/o:cisco:ios_xe:16.5

CVE-2018-0257

2018-04-19T16:29:01.317-04:00

2019-10-09T19:31:35.410-04:00

3.3

ADJACENT_NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 103948 SECTRACK 1040716 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-cbr8 A vulnerability in Cisco IOS XE Software running on Cisco cBR Series Converged Broadband Routers could allow an unauthenticated, adjacent attacker to cause high CPU usage on an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to the incorrect handling of certain DHCP packets. An attacker could exploit this vulnerability by sending certain DHCP packets to a specific segment of an affected device. A successful exploit could allow the attacker to increase CPU usage on the affected device and cause a DoS condition. Cisco Bug IDs: CSCvg73687.

cpe:/a:cisco:prime_data_center_network_manager:10.0%281%29 cpe:/a:cisco:prime_data_center_network_manager:10.2%281%29 cpe:/a:cisco:prime_infrastructure:3.3%280.0%29

CVE-2018-0258

2018-05-02T18:29:00.793-04:00

2019-10-09T19:31:35.583-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 104074 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-prime-upload MISC https://www.tenable.com/security/research/tra-2018-11 A vulnerability in the Cisco Prime File Upload servlet affecting multiple Cisco products could allow a remote attacker to upload arbitrary files to any directory of a vulnerable device (aka Path Traversal) and execute those files. This vulnerability affects the following products: Cisco Prime Data Center Network Manager (DCNM) Version 10.0 and later, and Cisco Prime Infrastructure (PI) All versions. Cisco Bug IDs: CSCvf32411, CSCvf81727.

cpe:/a:cisco:mate_collector:7.1

CVE-2018-0259

2018-04-19T16:29:01.377-04:00

2019-10-09T19:31:35.693-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 103928 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-MATE A vulnerability in the web-based management interface of Cisco MATE Collector could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user. Cisco Bug IDs: CSCvh31222.

cpe:/a:cisco:mate_live:1.3

CVE-2018-0260

2018-04-19T16:29:01.427-04:00

2019-10-09T19:31:35.800-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103946 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-MATE1 A vulnerability in the web interface of Cisco MATE Live could allow an unauthenticated, remote attacker to view and download the contents of certain web application virtual directories. The vulnerability is due to lack of proper input validation and authorization of HTTP requests. An attacker could exploit this vulnerability by sending a malicious HTTP request to the targeted application. An exploit could allow the attacker to view sensitive information that should require authentication. Cisco Bug IDs: CSCvh31272.

cpe:/a:cisco:meeting_server:1.9 cpe:/a:cisco:meeting_server:2.0 cpe:/a:cisco:meeting_server:2.1 cpe:/a:cisco:meeting_server:2.2 cpe:/a:cisco:meeting_server:2.3 cpe:/a:cisco:meeting_server:2.4

CVE-2018-0262

2018-05-02T18:29:00.857-04:00

2019-10-09T19:31:35.927-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 104079 SECTRACK 1040819 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-cms-cx A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker to gain unauthorized access to components of, or sensitive information in, an affected system, leading to Remote Code Execution. The vulnerability is due to incorrect default configuration of the device, which can expose internal interfaces and ports on the external interface of the system. A successful exploit could allow the attacker to gain unauthenticated access to configuration and database files as well as sensitive meeting information on an affected system. Additionally, if the Traversal Using Relay NAT (TURN) service is enabled and utilizing Transport Layer Security (TLS) connections, an attacker could utilize TURN credentials to forward traffic to device daemons, allowing for remote exploitation. This vulnerability affects Cisco Meeting Server (CMS) Acano X-series platforms that are running a CMS Software release prior to 2.2.11. Cisco Bug IDs: CSCvg76469.

cpe:/a:cisco:meeting_server:1.7_base cpe:/a:cisco:meeting_server:1.8.15 cpe:/a:cisco:meeting_server:1.8_base cpe:/a:cisco:meeting_server:1.9.0 cpe:/a:cisco:meeting_server:1.9.2 cpe:/a:cisco:meeting_server:1.9_base cpe:/a:cisco:meeting_server:2.0.0 cpe:/a:cisco:meeting_server:2.0.1 cpe:/a:cisco:meeting_server:2.0.2 cpe:/a:cisco:meeting_server:2.0.3 cpe:/a:cisco:meeting_server:2.0.4 cpe:/a:cisco:meeting_server:2.0.5 cpe:/a:cisco:meeting_server:2.0.6 cpe:/a:cisco:meeting_server:2.0.7 cpe:/a:cisco:meeting_server:2.0.8 cpe:/a:cisco:meeting_server:2.0.9 cpe:/a:cisco:meeting_server:2.0.10 cpe:/a:cisco:meeting_server:2.0.11 cpe:/a:cisco:meeting_server:2.0.12 cpe:/a:cisco:meeting_server:2.0.13 cpe:/a:cisco:meeting_server:2.0.14 cpe:/a:cisco:meeting_server:2.0.15 cpe:/a:cisco:meeting_server:2.0.16 cpe:/a:cisco:meeting_server:2.1.0 cpe:/a:cisco:meeting_server:2.1.1 cpe:/a:cisco:meeting_server:2.1.2 cpe:/a:cisco:meeting_server:2.1.3 cpe:/a:cisco:meeting_server:2.1.4 cpe:/a:cisco:meeting_server:2.1.5 cpe:/a:cisco:meeting_server:2.1.6 cpe:/a:cisco:meeting_server:2.1.7 cpe:/a:cisco:meeting_server:2.1.8 cpe:/a:cisco:meeting_server:2.1.9 cpe:/a:cisco:meeting_server:2.1.10 cpe:/a:cisco:meeting_server:2.1.11 cpe:/a:cisco:meeting_server:2.1.12 cpe:/a:cisco:meeting_server:2.2.0 cpe:/a:cisco:meeting_server:2.2.1 cpe:/a:cisco:meeting_server:2.2.2 cpe:/a:cisco:meeting_server:2.2.3 cpe:/a:cisco:meeting_server:2.2.4 cpe:/a:cisco:meeting_server:2.2.5 cpe:/a:cisco:meeting_server:2.2.6 cpe:/a:cisco:meeting_server:2.2.7 cpe:/a:cisco:meeting_server:2.2.8 cpe:/a:cisco:meeting_server:2.2.9 cpe:/a:cisco:meeting_server:2.2.10 cpe:/a:cisco:meeting_server:2.2.11 cpe:/a:cisco:meeting_server:2.2.12 cpe:/a:cisco:meeting_server:2.2.13 cpe:/a:cisco:meeting_server:2.2.14 cpe:/a:cisco:meeting_server:2.3.0 cpe:/a:cisco:meeting_server:2.3.1 cpe:/a:cisco:meeting_server:2.3.2 cpe:/a:cisco:meeting_server:2.3.3

CVE-2018-0263

2018-06-07T08:29:00.307-04:00

2019-10-09T19:31:36.050-04:00

3.3

ADJACENT_NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104419 SECTRACK 1041065 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-cms-id A vulnerability in Cisco Meeting Server (CMS) could allow an unauthenticated, adjacent attacker to access services running on internal device interfaces of an affected system. The vulnerability is due to incorrect default configuration of the device, which can expose internal interfaces and ports on the external interface of the system. A successful exploit could allow the attacker to gain unauthenticated access to configuration and database files and sensitive meeting information on an affected system. This vulnerability affects Cisco Meeting Server (CMS) 2000 Platforms that are running a CMS Software release prior to Release 2.2.13 or Release 2.3.4. Cisco Bug IDs: CSCvg76471.

cpe:/a:cisco:webex_business_suite_31:31.1 cpe:/a:cisco:webex_business_suite_31:31.2 cpe:/a:cisco:webex_business_suite_31:31.3 cpe:/a:cisco:webex_business_suite_31:31.4 cpe:/a:cisco:webex_business_suite_31:31.5 cpe:/a:cisco:webex_business_suite_31:31.5.20 cpe:/a:cisco:webex_business_suite_31:31.6 cpe:/a:cisco:webex_business_suite_31:31.7 cpe:/a:cisco:webex_business_suite_31:31.8 cpe:/a:cisco:webex_business_suite_31:31.9 cpe:/a:cisco:webex_business_suite_31:31.10 cpe:/a:cisco:webex_business_suite_31:31.11 cpe:/a:cisco:webex_business_suite_31:31.12 cpe:/a:cisco:webex_business_suite_31:31.13 cpe:/a:cisco:webex_business_suite_31:31.14 cpe:/a:cisco:webex_business_suite_31:31.15 cpe:/a:cisco:webex_business_suite_31:31.16 cpe:/a:cisco:webex_business_suite_31:31.17 cpe:/a:cisco:webex_business_suite_31:31.18 cpe:/a:cisco:webex_business_suite_31:31.19 cpe:/a:cisco:webex_business_suite_31:31.20 cpe:/a:cisco:webex_business_suite_31:31.21 cpe:/a:cisco:webex_business_suite_31:31.22 cpe:/a:cisco:webex_business_suite_31:31.23 cpe:/a:cisco:webex_business_suite_31:31.23.0 cpe:/a:cisco:webex_business_suite_31:31.24 cpe:/a:cisco:webex_business_suite_31:31.25 cpe:/a:cisco:webex_business_suite_31:31.26 cpe:/a:cisco:webex_business_suite_31:31.27 cpe:/a:cisco:webex_business_suite_31:31.28 cpe:/a:cisco:webex_business_suite_31:31.29 cpe:/a:cisco:webex_business_suite_31:31.30 cpe:/a:cisco:webex_business_suite_32:- cpe:/a:cisco:webex_business_suite_32:32.15.10 cpe:/a:cisco:webex_meetings:8.0_base::~~~android~~ cpe:/a:cisco:webex_meetings:9.5::~~~android~~ cpe:/a:cisco:webex_meetings:9.6::~~~android~~ cpe:/a:cisco:webex_meetings:9.8::~~~android~~ cpe:/a:cisco:webex_meetings:10.0::~~~android~~ cpe:/a:cisco:webex_meetings:10.1::~~~android~~ cpe:/a:cisco:webex_meetings:10.2::~~~android~~ cpe:/a:cisco:webex_meetings:10.3::~~~android~~ cpe:/a:cisco:webex_meetings:10.4::~~~android~~ cpe:/a:cisco:webex_meetings:10.5::~~~android~~ cpe:/a:cisco:webex_meetings:10.6::~~~android~~ cpe:/a:cisco:webex_meetings:10.7::~~~android~~ cpe:/a:cisco:webex_meetings:11.0::~~~android~~ cpe:/a:cisco:webex_meetings:11.1::~~~android~~ cpe:/a:cisco:webex_meetings:11.2::~~~android~~ cpe:/a:cisco:webex_meetings:11.3::~~~android~~ cpe:/a:cisco:webex_meetings:11.4::~~~android~~ cpe:/a:cisco:webex_meetings:11.5::~~~android~~ cpe:/a:cisco:webex_meetings:11.6::~~~android~~ cpe:/a:cisco:webex_meetings:11.7::~~~android~~ cpe:/a:cisco:webex_meetings:11.7.0.236::~~~android~~ cpe:/a:cisco:webex_meetings:t29 cpe:/a:cisco:webex_meetings:t30 cpe:/a:cisco:webex_meetings:t31 cpe:/a:cisco:webex_meetings:t31.11.2 cpe:/a:cisco:webex_meetings:t32

CVE-2018-0264

2018-05-02T18:29:00.903-04:00

2019-10-09T19:31:36.177-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 104073 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-war A vulnerability in the Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow an unauthenticated, remote attacker to execute arbitrary code on the system of a targeted user. An attacker could exploit this vulnerability by sending the user a link or email attachment with a malicious ARF file and persuading the user to follow the link or open the file. Successful exploitation could allow the attacker to execute arbitrary code on the user's system. This vulnerability affects Cisco WebEx Business Suite meeting sites, Cisco WebEx Meetings sites, Cisco WebEx Meetings Server, and Cisco WebEx ARF players. The following client builds of Cisco WebEx Business Suite (WBS31 and WBS32), Cisco WebEx Meetings, and Cisco WebEx Meetings Server are affected: Cisco WebEx Business Suite (WBS31) client builds prior to T31.23.4, Cisco WebEx Business Suite (WBS32) client builds prior to T32.12, Cisco WebEx Meetings with client builds prior to T32.12, Cisco WebEx Meeting Server builds prior to 3.0 Patch 1. Cisco Bug IDs: CSCvh85410, CSCvh85430, CSCvh85440, CSCvh85442, CSCvh85453, CSCvh85457.

CVE-2018-0265

2019-03-21T11:28:20.027-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

cpe:/a:cisco:unified_communications_manager:10.5%282.10000.5%29 cpe:/a:cisco:unified_communications_manager:11.0%281.10000.10%29 cpe:/a:cisco:unified_communications_manager:11.5%281.10000.6%29 cpe:/a:cisco:unified_communications_manager:12.0%281.10000.10%29

CVE-2018-0266

2018-04-19T16:29:01.487-04:00

2019-10-09T19:31:36.317-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov BID 103933 SECTRACK 1040718 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-ucm A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view sensitive data. The vulnerability is due to insufficient protection of database tables over the web interface. An attacker could exploit this vulnerability by browsing to a specific URL. An exploit could allow the attacker to view configuration parameters. Cisco Bug IDs: CSCvf20218.

CVE-2018-0267

2018-04-19T16:29:01.533-04:00

2019-10-09T19:31:36.427-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103937 SECTRACK 1040719 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-ucm1 A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, local attacker to view sensitive data that should be restricted. This could include LDAP credentials. The vulnerability is due to insufficient protection of database tables over the web interface. An attacker could exploit this vulnerability by browsing to a specific URL. An exploit could allow the attacker to view sensitive information that should have been restricted. Cisco Bug IDs: CSCvf22116.

cpe:/a:cisco:digital_network_architecture_center:1.1.3

CVE-2018-0268

2018-05-16T23:29:00.263-04:00

2019-10-09T19:31:36.537-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 104192 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-dna A vulnerability in the container management subsystem of Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authentication and gain elevated privileges. This vulnerability is due to an insecure default configuration of the Kubernetes container management subsystem within DNA Center. An attacker who has the ability to access the Kubernetes service port could execute commands with elevated privileges within provisioned containers. A successful exploit could result in a complete compromise of affected containers. This vulnerability affects Cisco DNA Center Software Releases 1.1.3 and prior. Cisco Bug IDs: CSCvi47253.

cpe:/a:cisco:digital_network_architecture_center:1.1

CVE-2018-0269

2018-04-19T16:29:01.580-04:00

2019-10-09T19:31:36.647-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103950 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-dna1 A vulnerability in the web framework of the Cisco Digital Network Architecture Center (DNA Center) could allow an unauthenticated, remote attacker to communicate with the Kong API server without restriction. The vulnerability is due to an overly permissive Cross Origin Resource Sharing (CORS) policy. An attacker could exploit this vulnerability by convincing a user to follow a malicious link. An exploit could allow the attacker to communicate with the API and exfiltrate sensitive information. Cisco Bug IDs: CSCvh99208.

cpe:/a:cisco:iot_field_network_director:4.2%280.4%29

CVE-2018-0270

2018-05-16T23:29:00.310-04:00

2019-10-09T19:31:36.753-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 104242 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-fnd A vulnerability in the web-based management interface of Cisco IoT Field Network Director (IoT-FND) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and alter the data of existing users and groups on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. If the user has administrative privileges, the attacker could create a new, privileged account to obtain full control over the device interface. This vulnerability affects Connected Grid Network Management System, if running a software release prior to IoT-FND Release 3.0; and IoT Field Network Director, if running a software release prior to IoT-FND Release 4.1.1-6 or 4.2.0-123. Cisco Bug IDs: CSCvi02448.

CVE-2018-0271

2018-05-16T23:29:00.357-04:00

2019-10-09T19:31:36.863-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 104191 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-dna2 A vulnerability in the API gateway of the Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authentication and access critical services. The vulnerability is due to a failure to normalize URLs prior to servicing requests. An attacker could exploit this vulnerability by submitting a crafted URL designed to exploit the issue. A successful exploit could allow the attacker to gain unauthenticated access to critical services, resulting in elevated privileges in DNA Center. This vulnerability affects Cisco DNA Center Software Releases prior to 1.1.2. Cisco Bug IDs: CSCvi09394.

cpe:/a:cisco:firepower:6.2.1 cpe:/a:cisco:firepower:6.2.2.1

CVE-2018-0272

2018-04-19T16:29:01.643-04:00

2019-10-09T19:31:36.973-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 103925 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-firepower A vulnerability in the Secure Sockets Layer (SSL) Engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to improper error handling while processing SSL traffic. An attacker could exploit this vulnerability by sending a large volume of crafted SSL traffic to the vulnerable device. A successful exploit could allow the attacker to degrade the device performance by triggering a persistent high CPU utilization condition. Cisco Bug IDs: CSCvh89340.

cpe:/o:cisco:staros:19.4.2.65120 cpe:/o:cisco:staros:19.6.0 cpe:/o:cisco:staros:21.2.0 cpe:/o:cisco:staros:21.2.6 cpe:/o:cisco:staros:21.4.0

CVE-2018-0273

2018-04-19T16:29:01.707-04:00

2019-10-09T19:31:37.083-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 103935 SECTRACK 1040721 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-starosasr A vulnerability in the IPsec Manager of Cisco StarOS for Cisco Aggregation Services Router (ASR) 5000 Series Routers and Virtualized Packet Core (VPC) System Software could allow an unauthenticated, remote attacker to terminate all active IPsec VPN tunnels and prevent new tunnels from being established, resulting in a denial of service (DoS) condition. The vulnerability is due to improper processing of corrupted Internet Key Exchange Version 2 (IKEv2) messages. An attacker could exploit this vulnerability by sending crafted IKEv2 messages toward an affected router. A successful exploit could allow the attacker to cause the ipsecmgr service to reload. A reload of this service could cause all IPsec VPN tunnels to be terminated and prevent new tunnels from being established until the service has restarted, resulting in a DoS condition. This vulnerability affects the following Cisco products when they are running Cisco StarOS: Cisco Aggregation Services Router (ASR) 5000 Series Routers, Virtualized Packet Core (VPC) System Software. Cisco Bug IDs: CSCve29605.

CVE-2018-0274

2018-06-07T08:29:00.340-04:00

2019-10-09T19:31:37.193-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov BID 104449 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-nso A vulnerability in the CLI parser of Cisco Network Services Orchestrator (NSO) could allow an authenticated, remote attacker to execute arbitrary shell commands with the privileges of the root user. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by injecting malicious arguments into vulnerable commands. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the affected system. This vulnerability affects the following releases of Cisco Network Services Orchestrator (NSO): 4.1 through 4.1.6.0, 4.2 through 4.2.4.0, 4.3 through 4.3.3.0, 4.4 through 4.4.2.0. Cisco Bug IDs: CSCvf99982.

cpe:/h:cisco:identity_services_engine:-

CVE-2018-0275

2018-04-19T16:29:01.783-04:00

2019-10-09T19:31:37.300-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1040717 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-ise A vulnerability in the support tunnel feature of Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to access the device's shell. The vulnerability is due to improper configuration of the support tunnel feature. An attacker could exploit this vulnerability by tricking the device into unlocking the support user account and accessing the tunnel password and device serial number. A successful exploit could allow the attacker to run any system command with root access. This affects Cisco Identity Services Engine (ISE) software versions prior to 2.2.0.470. Cisco Bug IDs: CSCvf54409.

cpe:/a:cisco:webex_connect_im:-

CVE-2018-0276

2018-04-19T16:29:01.830-04:00

2019-10-09T19:31:37.410-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 103921 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-webcon A vulnerability in Cisco WebEx Connect IM could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of an affected system. The vulnerability is due to insufficient input validation of some parameters that are passed to the web server of the affected system. An attacker could exploit this vulnerability by convincing a user to follow a malicious link or by intercepting a user request and injecting malicious code into the request. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected web interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvi07812.

cpe:/a:cisco:identity_services_engine:2.0%280.306%29 cpe:/a:cisco:identity_services_engine:2.0%281.130%29 cpe:/a:cisco:identity_services_engine:2.1%280.474%29 cpe:/a:cisco:identity_services_engine:2.2%280.470%29

CVE-2018-0277

2018-05-16T23:29:00.433-04:00

2019-10-09T19:31:37.537-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 104212 SECTRACK 1040922 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-iseeap A vulnerability in the Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) certificate validation during EAP authentication for the Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause the ISE application server to restart unexpectedly, causing a denial of service (DoS) condition on an affected system. The vulnerability is due to incomplete input validation of the client EAP-TLS certificate. An attacker could exploit this vulnerability by initiating EAP authentication over TLS to the ISE with a crafted EAP-TLS certificate. A successful exploit could allow the attacker to restart the ISE application server, resulting in a DoS condition on the affected system. The ISE application could continue to restart while the client attempts to establish the EAP authentication connection. If an attacker attempted to import the same EAP-TLS certificate to the ISE trust store, it could trigger a DoS condition on the affected system. This exploit vector would require the attacker to have valid administrator credentials. The vulnerability affects Cisco ISE, Cisco ISE Express, and Cisco ISE Virtual Appliance. Cisco Bug IDs: CSCve31857.

cpe:/a:cisco:firepower_management_center:6.1.0 cpe:/a:cisco:firepower_management_center:6.2.0 cpe:/a:cisco:firepower_management_center:6.2.1 cpe:/a:cisco:firepower_management_center:6.2.2 cpe:/a:cisco:firepower_management_center:6.2.3

CVE-2018-0278

2018-05-02T18:29:00.967-04:00

2019-10-09T19:31:37.647-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104122 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-fpwr-dos A vulnerability in the management console of Cisco Firepower System Software could allow an unauthenticated, remote attacker to access sensitive data about the system. The vulnerability is due to improper cross-origin domain protections for the WebSocket protocol. An attacker could exploit this vulnerability by convincing a user to visit a malicious website designed to send requests to the affected application while the user is logged into the application with an active session cookie. A successful exploit could allow the attacker to retrieve policy or configuration information from the affected software and to perform another attack against the management console. Cisco Bug IDs: CSCvh68311.

cpe:/a:cisco:enterprise_nfv_infrastructure_software:3.7.1

CVE-2018-0279

2018-05-16T23:29:00.467-04:00

2019-10-09T19:31:37.770-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov BID 104243 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-nfvis A vulnerability in the Secure Copy Protocol (SCP) server of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to access the shell of the underlying Linux operating system on the affected device. The vulnerability is due to improper input validation of command arguments. An attacker could exploit this vulnerability by using crafted arguments when opening a connection to the affected device. An exploit could allow the attacker to gain shell access with a non-root user account to the underlying Linux operating system on the affected device. Due to the system design, access to the Linux shell could allow execution of additional attacks that may have a significant impact on the affected system. This vulnerability affects Cisco devices that are running release 3.7.1, 3.6.3, or earlier releases of Cisco Enterprise NFV Infrastructure Software (NFVIS) when access to the SCP server is allowed on the affected device. Cisco NFVIS Releases 3.5.x and 3.6.x do allow access to the SCP server by default, while Cisco NFVIS Release 3.7.1 does not. Cisco Bug IDs: CSCvh25026.

cpe:/a:cisco:meeting_server:2.0 cpe:/a:cisco:meeting_server:2.1 cpe:/a:cisco:meeting_server:2.2 cpe:/a:cisco:meeting_server:2.2.5 cpe:/a:cisco:meeting_server:2.2.8 cpe:/a:cisco:meeting_server:2.3

CVE-2018-0280

2018-05-16T23:29:00.527-04:00

2019-10-09T19:31:37.880-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 104209 SECTRACK 1040923 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-msms A vulnerability in the Real-Time Transport Protocol (RTP) bitstream processing of the Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to insufficient input validation of incoming RTP bitstreams. An attacker could exploit this vulnerability by sending a crafted RTP bitstream to an affected Cisco Meeting Server. A successful exploit could allow the attacker to deny audio and video services by causing media process crashes resulting in a DoS condition on the affected product. This vulnerability affects Cisco Meeting Server deployments that are running Cisco Meeting Server Software Releases 2.0, 2.1, 2.2, and 2.3. Cisco Bug IDs: CSCve79693, CSCvf91393, CSCvg64656, CSCvh30725, CSCvi86363.

CVE-2018-0281

2018-05-02T18:29:01.027-04:00

2019-10-09T19:31:38.020-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 104096 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-fpwr-txdos A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to restart an instance of the Snort detection engine on an affected device, resulting in a brief denial of service (DoS) condition. The vulnerability is due to the incorrect handling of a Transport Layer Security (TLS) extension during TLS connection setup for the affected software. An attacker could exploit this vulnerability by sending a crafted TLS connection setup request to an affected device. A successful exploit could allow the attacker to cause the Snort detection engine on the affected device to restart, resulting in a DoS condition. Cisco Bug IDs: CSCvg97808.

cpe:/o:cisco:ios:15.2%282%29e4 cpe:/o:cisco:ios_xe:-

CVE-2018-0282

2019-01-09T19:29:00.297-05:00

2019-10-09T19:31:38.147-04:00

7.1

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 106510 CISCO 20190109 Cisco IOS and IOS XE Software TCP Denial of Service Vulnerability A vulnerability in the TCP socket code of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to a state condition between the socket state and the transmission control block (TCB) state. While this vulnerability potentially affects all TCP applications, the only affected application observed so far is the HTTP server. An attacker could exploit this vulnerability by sending specific HTTP requests at a sustained rate to a reachable IP address of the affected software. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a denial of service (DoS) condition on an affected device.

cpe:/a:cisco:firepower_management_center:6.1.0 cpe:/a:cisco:firepower_management_center:6.2.0 cpe:/a:cisco:firepower_management_center:6.2.2 cpe:/a:cisco:firepower_management_center:6.2.3

CVE-2018-0283

2018-05-02T18:29:01.120-04:00

2019-10-09T19:31:38.443-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 104121 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-fpwr-codp A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to restart an instance of the Snort detection engine on an affected device, resulting in a brief denial of service (DoS) condition. The vulnerability is due to the incorrect handling of Transport Layer Security (TLS) TCP connection setup for the affected software. An attacker could exploit this vulnerability by sending crafted TLS traffic to an affected device. A successful exploit could allow the attacker to cause the Snort detection engine on the affected device to restart, resulting in a DoS condition. Cisco Bug IDs: CSCvg99327.

CVE-2018-0284

2018-11-08T11:29:00.227-05:00

2019-10-09T19:31:38.567-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 105878 CISCO 20181107 Cisco Meraki Local Status Page Privilege Escalation Vulnerability A vulnerability in the local status page functionality of the Cisco Meraki MR, MS, MX, Z1, and Z3 product lines could allow an authenticated, remote attacker to modify device configuration files. The vulnerability occurs when handling requests to the local status page. An exploit could allow the attacker to establish an interactive session to the device with elevated privileges. The attacker could then use the elevated privileges to further compromise the device or obtain additional configuration data from the device that is being exploited.

cpe:/a:cisco:prime_service_catalog:11.1.2

CVE-2018-0285

2018-05-02T18:29:01.200-04:00

2019-10-09T19:31:38.800-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov BID 104082 SECTRACK 1040826 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-psc A vulnerability in service logging for Cisco Prime Service Catalog could allow an authenticated, remote attacker to deny service to the user interface. The vulnerability is due to exhaustion of disk space. An attacker could exploit this vulnerability by performing certain operations that lead to excessive logging. A successful exploit could allow the attacker to deny service to the user interface. Cisco Bug IDs: CSCvd39568.

cpe:/o:cisco:ios_xr:6.3.1.base cpe:/o:cisco:ios_xr:6.3.2.base cpe:/o:cisco:ios_xr:6.5.1.base

CVE-2018-0286

2018-05-02T18:29:01.263-04:00

2019-10-09T19:31:38.927-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 104083 SECTRACK 1040827 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-iosxr A vulnerability in the netconf interface of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on affected system. The vulnerability is due to improper handling of malformed requests processed by the netconf process. An attacker could exploit this vulnerability by sending malicious requests to the affected software. An exploit could allow the attacker to cause the targeted process to restart, resulting in a DoS condition on the affected system. Cisco Bug IDs: CSCvg95792.

cpe:/a:cisco:webex_meetings_online:t30 cpe:/a:cisco:webex_meetings_online:t32.7

CVE-2018-0287

2018-05-02T18:29:01.323-04:00

2019-10-09T19:31:39.037-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 104128 SECTRACK 1040824 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-webex-rce A vulnerability in the Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow an unauthenticated, remote attacker to execute arbitrary code on an affected system. The vulnerability is due to a design flaw in the affected software. An attacker could exploit this vulnerability by sending a user an email attachment or link to a malicious ARF file and persuading the user to open the file or follow the link. A successful exploit could allow the attacker to execute arbitrary code on the user's system. This vulnerability affects Cisco WebEx Business Suite meeting sites, Cisco WebEx Meetings sites, Cisco WebEx Meetings Server, and Cisco WebEx ARF players. Cisco Bug IDs: CSCvh70213, CSCvh70222, CSCvh70228.

cpe:/a:cisco:webex_meetings_online:t31.20 cpe:/a:cisco:webex_meetings_online:t31.20.2

CVE-2018-0288

2018-05-02T18:29:01.387-04:00

2019-10-09T19:31:39.147-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104091 SECTRACK 1040825 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-webex-id A vulnerability in Cisco WebEx Recording Format (WRF) Player could allow an unauthenticated, remote attacker to access sensitive data about the application. An attacker could exploit this vulnerability to gain information to conduct additional reconnaissance attacks. The vulnerability is due to a design flaw in Cisco WRF Player. An attacker could exploit this vulnerability by utilizing a maliciously crafted file that could bypass checks in the code and enable an attacker to read memory from outside the bounds of the mapped file. This vulnerability affects Cisco WebEx Business Suite meeting sites, Cisco WebEx Meetings sites, and Cisco WebEx WRF players. Cisco Bug IDs: CSCvh89107, CSCvh89113, CSCvh89132, CSCvh89142.

cpe:/a:cisco:identity_services_engine_software:2.3%280.298%29 cpe:/a:cisco:identity_services_engine_software:2.4%280.223%29

CVE-2018-0289

2018-05-16T23:29:00.573-04:00

2019-10-09T19:31:39.287-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104196 SECTRACK 1040925 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-ise-xss A vulnerability in the logs component of Cisco Identity Services Engine could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability is due to improper validation of requests stored in logs in the application management interface. An attacker could exploit this vulnerability by sending malicious requests to the targeted system. An exploit could allow the attacker to conduct cross-site scripting attacks when an administrator views the log files. Cisco Bug IDs: CSCvh11308.

cpe:/a:cisco:socialminer:11.6%281%29

CVE-2018-0290

2018-05-16T23:29:00.620-04:00

2019-10-09T19:31:39.410-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 104201 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-socmin-dos A vulnerability in the TCP stack of Cisco SocialMiner could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition in the notification system. The vulnerability is due to faulty handling of new TCP connections to the affected application. An attacker could exploit this vulnerability by sending a malicious TCP packet to the vulnerable service. An exploit could allow the attacker to create a DoS condition by interrupting certain phone services. A manual restart of the service may be required to restore full functionalities. Cisco Bug IDs: CSCvh48368.

cpe:/o:cisco:nx-os:- cpe:/o:cisco:nx-os:1.0%281.110a%29 cpe:/o:cisco:nx-os:1.0%281e%29 cpe:/o:cisco:nx-os:1.1%281g%29 cpe:/o:cisco:nx-os:2.3 cpe:/o:cisco:nx-os:2.3.1.130 cpe:/o:cisco:nx-os:2.4 cpe:/o:cisco:nx-os:2.4.1.122 cpe:/o:cisco:nx-os:4.0 cpe:/o:cisco:nx-os:4.0%280%29n1%281a%29 cpe:/o:cisco:nx-os:4.0%280%29n1%282%29 cpe:/o:cisco:nx-os:4.0%280%29n1%282a%29 cpe:/o:cisco:nx-os:4.0%281a%29n1%281%29 cpe:/o:cisco:nx-os:4.0%281a%29n1%281a%29 cpe:/o:cisco:nx-os:4.0%281a%29n2%281%29 cpe:/o:cisco:nx-os:4.0%281a%29n2%281a%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%281%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%282%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%283%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%283a%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%283b%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%283c%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%283d%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281b%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281c%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281d%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281e%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281f%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281g%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281h%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281i%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281j%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281k%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281m%29 cpe:/o:cisco:nx-os:4.1%283%29n1%281%29 cpe:/o:cisco:nx-os:4.1%283%29n1%281a%29 cpe:/o:cisco:nx-os:4.1%283%29n2%281%29 cpe:/o:cisco:nx-os:4.1%283%29n2%281a%29 cpe:/o:cisco:nx-os:4.1.%282%29 cpe:/o:cisco:nx-os:4.1.%283%29 cpe:/o:cisco:nx-os:4.1.%284%29 cpe:/o:cisco:nx-os:4.1.%285%29 cpe:/o:cisco:nx-os:4.2 cpe:/o:cisco:nx-os:4.2%281%29 cpe:/o:cisco:nx-os:4.2%281%29n1%281%29 cpe:/o:cisco:nx-os:4.2%281%29n2%281%29 cpe:/o:cisco:nx-os:4.2%281%29n2%281a%29 cpe:/o:cisco:nx-os:4.2%281%29sv1%284%29 cpe:/o:cisco:nx-os:4.2%281%29sv1%284a%29 cpe:/o:cisco:nx-os:4.2%281%29sv1%285.1%29 cpe:/o:cisco:nx-os:4.2%282%29 cpe:/o:cisco:nx-os:4.2%283%29 cpe:/o:cisco:nx-os:4.2%284%29 cpe:/o:cisco:nx-os:4.2%286%29 cpe:/o:cisco:nx-os:4.2%288%29 cpe:/o:cisco:nx-os:4.2.%282a%29 cpe:/o:cisco:nx-os:5.0 cpe:/o:cisco:nx-os:5.0%282%29 cpe:/o:cisco:nx-os:5.0%282%29n1%281%29 cpe:/o:cisco:nx-os:5.0%282%29n2%281%29 cpe:/o:cisco:nx-os:5.0%282%29n2%281a%29 cpe:/o:cisco:nx-os:5.0%282a%29 cpe:/o:cisco:nx-os:5.0%283%29 cpe:/o:cisco:nx-os:5.0%283%29n1%281%29 cpe:/o:cisco:nx-os:5.0%283%29n1%281a%29 cpe:/o:cisco:nx-os:5.0%283%29n1%281b%29 cpe:/o:cisco:nx-os:5.0%283%29n1%281c%29 cpe:/o:cisco:nx-os:5.0%283%29n2%281%29 cpe:/o:cisco:nx-os:5.0%283%29n2%282%29 cpe:/o:cisco:nx-os:5.0%283%29n2%282a%29 cpe:/o:cisco:nx-os:5.0%283%29n2%282b%29 cpe:/o:cisco:nx-os:5.0%283%29u1%281%29 cpe:/o:cisco:nx-os:5.0%283%29u1%281a%29 cpe:/o:cisco:nx-os:5.0%283%29u1%281b%29 cpe:/o:cisco:nx-os:5.0%283%29u1%281d%29 cpe:/o:cisco:nx-os:5.0%283%29u1%282%29 cpe:/o:cisco:nx-os:5.0%283%29u1%282a%29 cpe:/o:cisco:nx-os:5.0%283%29u2%281%29 cpe:/o:cisco:nx-os:5.0%283%29u2%282%29 cpe:/o:cisco:nx-os:5.0%283%29u2%282a%29 cpe:/o:cisco:nx-os:5.0%283%29u2%282b%29 cpe:/o:cisco:nx-os:5.0%283%29u2%282c%29 cpe:/o:cisco:nx-os:5.0%283%29u2%282d%29 cpe:/o:cisco:nx-os:5.0%283%29u3%281%29 cpe:/o:cisco:nx-os:5.0%283%29u3%282%29 cpe:/o:cisco:nx-os:5.0%283%29u3%282a%29 cpe:/o:cisco:nx-os:5.0%283%29u3%282b%29 cpe:/o:cisco:nx-os:5.0%283%29u4%281%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281a%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281b%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281c%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281d%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281e%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281f%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281g%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281h%29 cpe:/o:cisco:nx-os:5.0%285%29 cpe:/o:cisco:nx-os:5.1 cpe:/o:cisco:nx-os:5.1%281%29 cpe:/o:cisco:nx-os:5.1%281a%29 cpe:/o:cisco:nx-os:5.1%282%29 cpe:/o:cisco:nx-os:5.1%283%29 cpe:/o:cisco:nx-os:5.1%283%29n1%281%29 cpe:/o:cisco:nx-os:5.1%283%29n1%281a%29 cpe:/o:cisco:nx-os:5.1%283%29n2%281%29 cpe:/o:cisco:nx-os:5.1%283%29n2%281a%29 cpe:/o:cisco:nx-os:5.1%283%29n2%281b%29 cpe:/o:cisco:nx-os:5.1%283%29n2%281c%29 cpe:/o:cisco:nx-os:5.1%284%29 cpe:/o:cisco:nx-os:5.1%285%29 cpe:/o:cisco:nx-os:5.1%286%29 cpe:/o:cisco:nx-os:5.1.3 cpe:/o:cisco:nx-os:5.2 cpe:/o:cisco:nx-os:5.2%281%29 cpe:/o:cisco:nx-os:5.2%281%29n1%281%29 cpe:/o:cisco:nx-os:5.2%281%29n1%281a%29 cpe:/o:cisco:nx-os:5.2%281%29n1%281b%29 cpe:/o:cisco:nx-os:5.2%281%29n1%282%29 cpe:/o:cisco:nx-os:5.2%281%29n1%282a%29 cpe:/o:cisco:nx-os:5.2%281%29n1%283%29 cpe:/o:cisco:nx-os:5.2%281%29n1%284%29 cpe:/o:cisco:nx-os:5.2%281%29n1%285%29 cpe:/o:cisco:nx-os:5.2%281%29n1%286%29 cpe:/o:cisco:nx-os:5.2%281%29n1%287%29 cpe:/o:cisco:nx-os:5.2%281%29n1%288%29 cpe:/o:cisco:nx-os:5.2%281%29n1%288a%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.1%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.3%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.5a%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.5b%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.6%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.10%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%282.8%29 cpe:/o:cisco:nx-os:5.2%283%29 cpe:/o:cisco:nx-os:5.2%283a%29 cpe:/o:cisco:nx-os:5.2%284%29 cpe:/o:cisco:nx-os:5.2%285%29 cpe:/o:cisco:nx-os:5.2%287%29 cpe:/o:cisco:nx-os:5.2%289%29 cpe:/o:cisco:nx-os:5.2%289%29n1%281%29 cpe:/o:cisco:nx-os:5.3.0 cpe:/o:cisco:nx-os:6.0%281%29 cpe:/o:cisco:nx-os:6.0%282%29 cpe:/o:cisco:nx-os:6.0%282%29a6%281%29 cpe:/o:cisco:nx-os:6.0%282%29a6%282%29 cpe:/o:cisco:nx-os:6.0%282%29a6%283%29 cpe:/o:cisco:nx-os:6.0%282%29a6%284%29 cpe:/o:cisco:nx-os:6.0%282%29a6%285%29 cpe:/o:cisco:nx-os:6.0%282%29a6%286%29 cpe:/o:cisco:nx-os:6.0%282%29a6%287%29 cpe:/o:cisco:nx-os:6.0%282%29a6%288%29 cpe:/o:cisco:nx-os:6.0%282%29a7%281%29 cpe:/o:cisco:nx-os:6.0%282%29a7%282%29 cpe:/o:cisco:nx-os:6.0%282%29a7%282a%29 cpe:/o:cisco:nx-os:6.0%282%29a8%282%29 cpe:/o:cisco:nx-os:6.0%282%29n1%281%29 cpe:/o:cisco:nx-os:6.0%282%29n1%282%29 cpe:/o:cisco:nx-os:6.0%282%29n1%282a%29 cpe:/o:cisco:nx-os:6.0%282%29n2%281%29 cpe:/o:cisco:nx-os:6.0%282%29n2%281b%29 cpe:/o:cisco:nx-os:6.0%282%29n2%282%29 cpe:/o:cisco:nx-os:6.0%282%29n2%283%29 cpe:/o:cisco:nx-os:6.0%282%29n2%284%29 cpe:/o:cisco:nx-os:6.0%282%29n2%285%29 cpe:/o:cisco:nx-os:6.0%282%29n2%285a%29 cpe:/o:cisco:nx-os:6.0%282%29n2%286%29 cpe:/o:cisco:nx-os:6.0%282%29n2%287%29 cpe:/o:cisco:nx-os:6.0%282%29u1%281%29 cpe:/o:cisco:nx-os:6.0%282%29u1%281a%29 cpe:/o:cisco:nx-os:6.0%282%29u1%282%29 cpe:/o:cisco:nx-os:6.0%282%29u1%283%29 cpe:/o:cisco:nx-os:6.0%282%29u1%284%29 cpe:/o:cisco:nx-os:6.0%282%29u2%281%29 cpe:/o:cisco:nx-os:6.0%282%29u2%282%29 cpe:/o:cisco:nx-os:6.0%282%29u2%283%29 cpe:/o:cisco:nx-os:6.0%282%29u2%284%29 cpe:/o:cisco:nx-os:6.0%282%29u2%285%29 cpe:/o:cisco:nx-os:6.0%282%29u2%286%29 cpe:/o:cisco:nx-os:6.0%282%29u3%281%29 cpe:/o:cisco:nx-os:6.0%282%29u3%282%29 cpe:/o:cisco:nx-os:6.0%282%29u3%283%29 cpe:/o:cisco:nx-os:6.0%282%29u3%284%29 cpe:/o:cisco:nx-os:6.0%282%29u3%285%29 cpe:/o:cisco:nx-os:6.0%282%29u4%281%29 cpe:/o:cisco:nx-os:6.0%282%29u4%282%29 cpe:/o:cisco:nx-os:6.0%282%29u4%283%29 cpe:/o:cisco:nx-os:6.0%282%29u5%281%29 cpe:/o:cisco:nx-os:6.0%282%29u5%281.41%29 cpe:/o:cisco:nx-os:6.0%282%29u5%282%29 cpe:/o:cisco:nx-os:6.0%282%29u5%283%29 cpe:/o:cisco:nx-os:6.0%282%29u5%284%29 cpe:/o:cisco:nx-os:6.0%282%29u6%281%29 cpe:/o:cisco:nx-os:6.0%282%29u6%282%29 cpe:/o:cisco:nx-os:6.0%282%29u6%283%29 cpe:/o:cisco:nx-os:6.0%282%29u6%284%29 cpe:/o:cisco:nx-os:6.0%282%29u6%285%29 cpe:/o:cisco:nx-os:6.0%282%29u6%286%29 cpe:/o:cisco:nx-os:6.0%282%29u6%287%29 cpe:/o:cisco:nx-os:6.0%282%29u6%288%29 cpe:/o:cisco:nx-os:6.0%283%29 cpe:/o:cisco:nx-os:6.0%284%29 cpe:/o:cisco:nx-os:6.1 cpe:/o:cisco:nx-os:6.1%281%29 cpe:/o:cisco:nx-os:6.1%282%29 cpe:/o:cisco:nx-os:6.1%282%29i2%282%29 cpe:/o:cisco:nx-os:6.1%282%29i2%282a%29 cpe:/o:cisco:nx-os:6.1%282%29i2%282b%29 cpe:/o:cisco:nx-os:6.1%282%29i2%283%29 cpe:/o:cisco:nx-os:6.1%282%29i3%281%29 cpe:/o:cisco:nx-os:6.1%282%29i3%282%29 cpe:/o:cisco:nx-os:6.1%282%29i3%283%29 cpe:/o:cisco:nx-os:6.1%282%29i3%283.78%29 cpe:/o:cisco:nx-os:6.1%282%29i3%284%29 cpe:/o:cisco:nx-os:6.1%283%29 cpe:/o:cisco:nx-os:6.1%284%29 cpe:/o:cisco:nx-os:6.1%284a%29 cpe:/o:cisco:nx-os:6.1%285%29 cpe:/o:cisco:nx-os:6.2%281%29 cpe:/o:cisco:nx-os:6.2%281n%29 cpe:/o:cisco:nx-os:6.2%282%29 cpe:/o:cisco:nx-os:6.2%282a%29 cpe:/o:cisco:nx-os:6.2%283%29 cpe:/o:cisco:nx-os:6.2%283n%29 cpe:/o:cisco:nx-os:6.2%285%29 cpe:/o:cisco:nx-os:6.2%285a%29 cpe:/o:cisco:nx-os:6.2%286%29 cpe:/o:cisco:nx-os:6.2%286b%29 cpe:/o:cisco:nx-os:6.2%287%29 cpe:/o:cisco:nx-os:6.2%288%29 cpe:/o:cisco:nx-os:6.2%288a%29 cpe:/o:cisco:nx-os:6.2%288b%29 cpe:/o:cisco:nx-os:6.2%2810%29 cpe:/o:cisco:nx-os:6.2%2811b%29 cpe:/o:cisco:nx-os:6.2%2812%29 cpe:/o:cisco:nx-os:6.2%2814%29s1 cpe:/o:cisco:nx-os:7.0 cpe:/o:cisco:nx-os:7.0%280%29n1%281%29 cpe:/o:cisco:nx-os:7.0%281%29n1%281%29 cpe:/o:cisco:nx-os:7.0%281%29n1%283%29 cpe:/o:cisco:nx-os:7.0%282%29n1%281%29 cpe:/o:cisco:nx-os:7.0%283%29 cpe:/o:cisco:nx-os:7.0%283%29i1%281a%29 cpe:/o:cisco:nx-os:7.0%283%29i1%281b%29 cpe:/o:cisco:nx-os:7.0%283%29i1%282%29 cpe:/o:cisco:nx-os:7.0%283%29i2%280.373%29 cpe:/o:cisco:nx-os:7.0%283%29i7 cpe:/o:cisco:nx-os:7.0%283%29n1%281%29 cpe:/o:cisco:nx-os:7.0%284%29n1%281%29 cpe:/o:cisco:nx-os:7.0%285%29n1%281%29 cpe:/o:cisco:nx-os:7.0%285%29n1%281a%29 cpe:/o:cisco:nx-os:7.0%286%29n1%281%29 cpe:/o:cisco:nx-os:7.0%287%29n1%281%29 cpe:/o:cisco:nx-os:7.0%288%29n1%281%29 cpe:/o:cisco:nx-os:7.1%280%29n1%281a%29 cpe:/o:cisco:nx-os:7.1%280%29n1%281b%29 cpe:/o:cisco:nx-os:7.1%281%29n1%281%29 cpe:/o:cisco:nx-os:7.1%282%29n1%281%29 cpe:/o:cisco:nx-os:7.1%283%29n1%281%29 cpe:/o:cisco:nx-os:7.1%283%29n1%282%29 cpe:/o:cisco:nx-os:7.1%283%29n1%282.1%29 cpe:/o:cisco:nx-os:7.1%283%29n1%283.12%29 cpe:/o:cisco:nx-os:7.1%284%29n1%281%29 cpe:/o:cisco:nx-os:7.2%280%29n1%280.1%29 cpe:/o:cisco:nx-os:7.2%280%29n1%281%29 cpe:/o:cisco:nx-os:7.2%280%29zz%2899.1%29 cpe:/o:cisco:nx-os:7.2%280%29zz%2899.3%29 cpe:/o:cisco:nx-os:7.2%281%29n1%281%29 cpe:/o:cisco:nx-os:7.3 cpe:/o:cisco:nx-os:7.3%280%29n1%281%29 cpe:/o:cisco:nx-os:7.3%280%29zn%280.9%29 cpe:/o:cisco:nx-os:7.3%280%29zn%280.81%29 cpe:/o:cisco:nx-os:7.3%280%29zn%280.83%29 cpe:/o:cisco:nx-os:7.3%282%29n1%280.296%29 cpe:/o:cisco:nx-os:7.3%282%29n1%280.395%29 cpe:/o:cisco:nx-os:8.0 cpe:/o:cisco:nx-os:8.0%281%29s2 cpe:/o:cisco:nx-os:8.1 cpe:/o:cisco:nx-os:8.1%280.2%29s0 cpe:/o:cisco:nx-os:8.1%280.59%29s0 cpe:/o:cisco:nx-os:8.1%280.112%29s0 cpe:/o:cisco:nx-os:8.1%281%29 cpe:/o:cisco:nx-os:8.1%281%29s5 cpe:/o:cisco:nx-os:8.1%281b%29

CVE-2018-0291

2018-06-20T17:29:00.217-04:00

2019-10-09T19:31:39.520-04:00

6.8

NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1041169 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-nxossnmp A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco NX-OS Software could allow an authenticated, remote attacker to cause the SNMP application on an affected device to restart unexpectedly. The vulnerability is due to improper validation of SNMP protocol data units (PDUs) in SNMP packets. An attacker could exploit this vulnerability by sending a crafted SNMP packet to an affected device. A successful exploit could allow the attacker to cause the SNMP application to restart multiple times, leading to a system-level restart and a denial of service (DoS) condition. This vulnerability affects Nexus 2000 Series Switches, Nexus 3000 Series Switches, Nexus 3500 Platform Switches, Nexus 3600 Platform Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Switches in standalone NX-OS mode, Nexus 9500 R-Series Line Cards and Fabric Modules, UCS 6100 Series Fabric Interconnects, UCS 6200 Series Fabric Interconnects, UCS 6300 Series Fabric Interconnects. Cisco Bug IDs: CSCuw99630, CSCvg71290, CSCvj67977.

cpe:/o:cisco:nx-os:6.0%281%29 cpe:/o:cisco:nx-os:6.0%282%29 cpe:/o:cisco:nx-os:6.0%282%29a6%281%29 cpe:/o:cisco:nx-os:6.0%282%29a6%282%29 cpe:/o:cisco:nx-os:6.0%282%29a6%283%29 cpe:/o:cisco:nx-os:6.0%282%29a6%284%29 cpe:/o:cisco:nx-os:6.0%282%29a6%285%29 cpe:/o:cisco:nx-os:6.0%282%29a6%286%29 cpe:/o:cisco:nx-os:6.0%282%29a6%287%29 cpe:/o:cisco:nx-os:6.0%282%29a6%288%29 cpe:/o:cisco:nx-os:6.0%282%29a7%281%29 cpe:/o:cisco:nx-os:6.0%282%29a7%282%29 cpe:/o:cisco:nx-os:6.0%282%29a7%282a%29 cpe:/o:cisco:nx-os:6.0%282%29a8%282%29 cpe:/o:cisco:nx-os:6.0%282%29n1%281%29 cpe:/o:cisco:nx-os:6.0%282%29n1%282%29 cpe:/o:cisco:nx-os:6.0%282%29n1%282a%29 cpe:/o:cisco:nx-os:6.0%282%29n2%281%29 cpe:/o:cisco:nx-os:6.0%282%29n2%281b%29 cpe:/o:cisco:nx-os:6.0%282%29n2%282%29 cpe:/o:cisco:nx-os:6.0%282%29n2%283%29 cpe:/o:cisco:nx-os:6.0%282%29n2%284%29 cpe:/o:cisco:nx-os:6.0%282%29n2%285%29 cpe:/o:cisco:nx-os:6.0%282%29n2%285a%29 cpe:/o:cisco:nx-os:6.0%282%29n2%286%29 cpe:/o:cisco:nx-os:6.0%282%29n2%287%29 cpe:/o:cisco:nx-os:6.0%282%29u1%281%29 cpe:/o:cisco:nx-os:6.0%282%29u1%281a%29 cpe:/o:cisco:nx-os:6.0%282%29u1%282%29 cpe:/o:cisco:nx-os:6.0%282%29u1%283%29 cpe:/o:cisco:nx-os:6.0%282%29u1%284%29 cpe:/o:cisco:nx-os:6.0%282%29u2%281%29 cpe:/o:cisco:nx-os:6.0%282%29u2%282%29 cpe:/o:cisco:nx-os:6.0%282%29u2%283%29 cpe:/o:cisco:nx-os:6.0%282%29u2%284%29 cpe:/o:cisco:nx-os:6.0%282%29u2%285%29 cpe:/o:cisco:nx-os:6.0%282%29u2%286%29 cpe:/o:cisco:nx-os:6.0%282%29u3%281%29 cpe:/o:cisco:nx-os:6.0%282%29u3%282%29 cpe:/o:cisco:nx-os:6.0%282%29u3%283%29 cpe:/o:cisco:nx-os:6.0%282%29u3%284%29 cpe:/o:cisco:nx-os:6.0%282%29u3%285%29 cpe:/o:cisco:nx-os:6.0%282%29u4%281%29 cpe:/o:cisco:nx-os:6.0%282%29u4%282%29 cpe:/o:cisco:nx-os:6.0%282%29u4%283%29 cpe:/o:cisco:nx-os:6.0%282%29u5%281%29 cpe:/o:cisco:nx-os:6.0%282%29u5%281.41%29 cpe:/o:cisco:nx-os:6.0%282%29u5%282%29 cpe:/o:cisco:nx-os:6.0%282%29u5%283%29 cpe:/o:cisco:nx-os:6.0%282%29u5%284%29 cpe:/o:cisco:nx-os:6.0%282%29u6%281%29 cpe:/o:cisco:nx-os:6.0%282%29u6%282%29 cpe:/o:cisco:nx-os:6.0%282%29u6%283%29 cpe:/o:cisco:nx-os:6.0%282%29u6%284%29 cpe:/o:cisco:nx-os:6.0%282%29u6%285%29 cpe:/o:cisco:nx-os:6.0%282%29u6%286%29 cpe:/o:cisco:nx-os:6.0%282%29u6%287%29 cpe:/o:cisco:nx-os:6.0%282%29u6%288%29 cpe:/o:cisco:nx-os:6.0%283%29 cpe:/o:cisco:nx-os:6.0%284%29 cpe:/o:cisco:nx-os:6.1 cpe:/o:cisco:nx-os:6.1%281%29 cpe:/o:cisco:nx-os:6.1%282%29 cpe:/o:cisco:nx-os:6.1%282%29i2%282%29 cpe:/o:cisco:nx-os:6.1%282%29i2%282a%29 cpe:/o:cisco:nx-os:6.1%282%29i2%282b%29 cpe:/o:cisco:nx-os:6.1%282%29i2%283%29 cpe:/o:cisco:nx-os:6.1%282%29i3%281%29 cpe:/o:cisco:nx-os:6.1%282%29i3%282%29 cpe:/o:cisco:nx-os:6.1%282%29i3%283%29 cpe:/o:cisco:nx-os:6.1%282%29i3%283.78%29 cpe:/o:cisco:nx-os:6.1%282%29i3%284%29 cpe:/o:cisco:nx-os:6.1%283%29 cpe:/o:cisco:nx-os:6.1%284%29 cpe:/o:cisco:nx-os:6.1%284a%29 cpe:/o:cisco:nx-os:6.1%285%29 cpe:/o:cisco:nx-os:6.2%281%29 cpe:/o:cisco:nx-os:6.2%281n%29 cpe:/o:cisco:nx-os:6.2%282%29 cpe:/o:cisco:nx-os:6.2%282a%29 cpe:/o:cisco:nx-os:6.2%283%29 cpe:/o:cisco:nx-os:6.2%283n%29 cpe:/o:cisco:nx-os:6.2%285%29 cpe:/o:cisco:nx-os:6.2%285a%29 cpe:/o:cisco:nx-os:6.2%286%29 cpe:/o:cisco:nx-os:6.2%286b%29 cpe:/o:cisco:nx-os:6.2%287%29 cpe:/o:cisco:nx-os:6.2%288%29 cpe:/o:cisco:nx-os:6.2%288a%29 cpe:/o:cisco:nx-os:6.2%288b%29 cpe:/o:cisco:nx-os:6.2%2810%29 cpe:/o:cisco:nx-os:6.2%2811b%29 cpe:/o:cisco:nx-os:6.2%2812%29 cpe:/o:cisco:nx-os:6.2%2814%29s1 cpe:/o:cisco:nx-os:7.0%280%29n1%281%29 cpe:/o:cisco:nx-os:7.0%281%29n1%281%29 cpe:/o:cisco:nx-os:7.0%281%29n1%283%29 cpe:/o:cisco:nx-os:7.0%282%29n1%281%29 cpe:/o:cisco:nx-os:7.0%283%29 cpe:/o:cisco:nx-os:7.0%283%29i1%281a%29 cpe:/o:cisco:nx-os:7.0%283%29i1%281b%29 cpe:/o:cisco:nx-os:7.0%283%29i1%282%29 cpe:/o:cisco:nx-os:7.0%283%29i2%280.373%29 cpe:/o:cisco:nx-os:7.0%283%29i4 cpe:/o:cisco:nx-os:7.0%283%29i7 cpe:/o:cisco:nx-os:7.0%283%29n1%281%29 cpe:/o:cisco:nx-os:7.0%284%29n1%281%29 cpe:/o:cisco:nx-os:7.0%285%29n1%281%29 cpe:/o:cisco:nx-os:7.0%285%29n1%281a%29 cpe:/o:cisco:nx-os:7.0%286%29n1%281%29 cpe:/o:cisco:nx-os:7.0%287%29n1%281%29 cpe:/o:cisco:nx-os:7.0%288%29n1%281%29 cpe:/o:cisco:nx-os:7.1%280%29n1%281a%29 cpe:/o:cisco:nx-os:7.1%280%29n1%281b%29 cpe:/o:cisco:nx-os:7.1%281%29n1%281%29 cpe:/o:cisco:nx-os:7.1%282%29n1%281%29 cpe:/o:cisco:nx-os:7.1%283%29n1%281%29 cpe:/o:cisco:nx-os:7.1%283%29n1%282%29 cpe:/o:cisco:nx-os:7.1%283%29n1%282.1%29 cpe:/o:cisco:nx-os:7.1%283%29n1%283.12%29 cpe:/o:cisco:nx-os:7.1%284%29n1%281%29 cpe:/o:cisco:nx-os:7.2%280%29n1%280.1%29 cpe:/o:cisco:nx-os:7.2%280%29n1%281%29 cpe:/o:cisco:nx-os:7.2%280%29zz%2899.1%29 cpe:/o:cisco:nx-os:7.2%280%29zz%2899.3%29 cpe:/o:cisco:nx-os:7.2%281%29n1%281%29 cpe:/o:cisco:nx-os:7.3 cpe:/o:cisco:nx-os:7.3%280%29n1%281%29 cpe:/o:cisco:nx-os:7.3%280%29zn%280.9%29 cpe:/o:cisco:nx-os:7.3%280%29zn%280.81%29 cpe:/o:cisco:nx-os:7.3%280%29zn%280.83%29 cpe:/o:cisco:nx-os:7.3%282%29n1%280.296%29 cpe:/o:cisco:nx-os:7.3%282%29n1%280.395%29 cpe:/o:cisco:nx-os:8.0 cpe:/o:cisco:nx-os:8.0%281%29s2 cpe:/o:cisco:nx-os:8.1 cpe:/o:cisco:nx-os:8.1%280.2%29s0 cpe:/o:cisco:nx-os:8.1%280.59%29s0 cpe:/o:cisco:nx-os:8.1%280.112%29s0 cpe:/o:cisco:nx-os:8.1%281%29 cpe:/o:cisco:nx-os:8.1%281%29s5 cpe:/o:cisco:nx-os:8.1%281b%29

CVE-2018-0292

2018-06-20T17:29:00.297-04:00

2019-10-09T19:31:39.847-04:00

8.3

ADJACENT_NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1041169 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-nxosigmp A vulnerability in the Internet Group Management Protocol (IGMP) Snooping feature of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code and gain full control of an affected system. The attacker could also cause an affected system to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to a buffer overflow condition in the IGMP Snooping subsystem. An attacker could exploit this vulnerability by sending crafted IGMP packets to an affected system. An exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a DoS condition. This vulnerability affects Nexus 2000 Series Switches, Nexus 3000 Series Switches, Nexus 3500 Platform Switches, Nexus 3600 Platform Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode, Nexus 9000 Series Switches in standalone NX-OS mode. Cisco Bug IDs: CSCuv79620, CSCvg71263.

cpe:/o:cisco:nx-os:5.2 cpe:/o:cisco:nx-os:5.2%281%29 cpe:/o:cisco:nx-os:5.2%281%29n1%281%29 cpe:/o:cisco:nx-os:5.2%281%29n1%281a%29 cpe:/o:cisco:nx-os:5.2%281%29n1%281b%29 cpe:/o:cisco:nx-os:5.2%281%29n1%282%29 cpe:/o:cisco:nx-os:5.2%281%29n1%282a%29 cpe:/o:cisco:nx-os:5.2%281%29n1%283%29 cpe:/o:cisco:nx-os:5.2%281%29n1%284%29 cpe:/o:cisco:nx-os:5.2%281%29n1%285%29 cpe:/o:cisco:nx-os:5.2%281%29n1%286%29 cpe:/o:cisco:nx-os:5.2%281%29n1%287%29 cpe:/o:cisco:nx-os:5.2%281%29n1%288%29 cpe:/o:cisco:nx-os:5.2%281%29n1%288a%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.1%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.3%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.5a%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.5b%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.6%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.10%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%282.8%29 cpe:/o:cisco:nx-os:5.2%283%29 cpe:/o:cisco:nx-os:5.2%283a%29 cpe:/o:cisco:nx-os:5.2%284%29 cpe:/o:cisco:nx-os:5.2%285%29 cpe:/o:cisco:nx-os:5.2%287%29 cpe:/o:cisco:nx-os:5.2%289%29 cpe:/o:cisco:nx-os:5.2%289%29n1%281%29 cpe:/o:cisco:nx-os:5.3.0 cpe:/o:cisco:nx-os:6.0%281%29 cpe:/o:cisco:nx-os:6.0%282%29 cpe:/o:cisco:nx-os:6.0%282%29a6%281%29 cpe:/o:cisco:nx-os:6.0%282%29a6%282%29 cpe:/o:cisco:nx-os:6.0%282%29a6%283%29 cpe:/o:cisco:nx-os:6.0%282%29a6%284%29 cpe:/o:cisco:nx-os:6.0%282%29a6%285%29 cpe:/o:cisco:nx-os:6.0%282%29a6%286%29 cpe:/o:cisco:nx-os:6.0%282%29a6%287%29 cpe:/o:cisco:nx-os:6.0%282%29a6%288%29 cpe:/o:cisco:nx-os:6.0%282%29a7%281%29 cpe:/o:cisco:nx-os:6.0%282%29a7%282%29 cpe:/o:cisco:nx-os:6.0%282%29a7%282a%29 cpe:/o:cisco:nx-os:6.0%282%29a8%282%29 cpe:/o:cisco:nx-os:6.0%282%29n1%281%29 cpe:/o:cisco:nx-os:6.0%282%29n1%282%29 cpe:/o:cisco:nx-os:6.0%282%29n1%282a%29 cpe:/o:cisco:nx-os:6.0%282%29n2%281%29 cpe:/o:cisco:nx-os:6.0%282%29n2%281b%29 cpe:/o:cisco:nx-os:6.0%282%29n2%282%29 cpe:/o:cisco:nx-os:6.0%282%29n2%283%29 cpe:/o:cisco:nx-os:6.0%282%29n2%284%29 cpe:/o:cisco:nx-os:6.0%282%29n2%285%29 cpe:/o:cisco:nx-os:6.0%282%29n2%285a%29 cpe:/o:cisco:nx-os:6.0%282%29n2%286%29 cpe:/o:cisco:nx-os:6.0%282%29n2%287%29 cpe:/o:cisco:nx-os:6.0%282%29u1%281%29 cpe:/o:cisco:nx-os:6.0%282%29u1%281a%29 cpe:/o:cisco:nx-os:6.0%282%29u1%282%29 cpe:/o:cisco:nx-os:6.0%282%29u1%283%29 cpe:/o:cisco:nx-os:6.0%282%29u1%284%29 cpe:/o:cisco:nx-os:6.0%282%29u2%281%29 cpe:/o:cisco:nx-os:6.0%282%29u2%282%29 cpe:/o:cisco:nx-os:6.0%282%29u2%283%29 cpe:/o:cisco:nx-os:6.0%282%29u2%284%29 cpe:/o:cisco:nx-os:6.0%282%29u2%285%29 cpe:/o:cisco:nx-os:6.0%282%29u2%286%29 cpe:/o:cisco:nx-os:6.0%282%29u3%281%29 cpe:/o:cisco:nx-os:6.0%282%29u3%282%29 cpe:/o:cisco:nx-os:6.0%282%29u3%283%29 cpe:/o:cisco:nx-os:6.0%282%29u3%284%29 cpe:/o:cisco:nx-os:6.0%282%29u3%285%29 cpe:/o:cisco:nx-os:6.0%282%29u4%281%29 cpe:/o:cisco:nx-os:6.0%282%29u4%282%29 cpe:/o:cisco:nx-os:6.0%282%29u4%283%29 cpe:/o:cisco:nx-os:6.0%282%29u5%281%29 cpe:/o:cisco:nx-os:6.0%282%29u5%281.41%29 cpe:/o:cisco:nx-os:6.0%282%29u5%282%29 cpe:/o:cisco:nx-os:6.0%282%29u5%283%29 cpe:/o:cisco:nx-os:6.0%282%29u5%284%29 cpe:/o:cisco:nx-os:6.0%282%29u6%281%29 cpe:/o:cisco:nx-os:6.0%282%29u6%282%29 cpe:/o:cisco:nx-os:6.0%282%29u6%283%29 cpe:/o:cisco:nx-os:6.0%282%29u6%284%29 cpe:/o:cisco:nx-os:6.0%282%29u6%285%29 cpe:/o:cisco:nx-os:6.0%282%29u6%286%29 cpe:/o:cisco:nx-os:6.0%282%29u6%287%29 cpe:/o:cisco:nx-os:6.0%282%29u6%288%29 cpe:/o:cisco:nx-os:6.0%283%29 cpe:/o:cisco:nx-os:6.0%284%29 cpe:/o:cisco:nx-os:6.1 cpe:/o:cisco:nx-os:6.1%281%29 cpe:/o:cisco:nx-os:6.1%282%29 cpe:/o:cisco:nx-os:6.1%282%29i2%282%29 cpe:/o:cisco:nx-os:6.1%282%29i2%282a%29 cpe:/o:cisco:nx-os:6.1%282%29i2%282b%29 cpe:/o:cisco:nx-os:6.1%282%29i2%283%29 cpe:/o:cisco:nx-os:6.1%282%29i3%281%29 cpe:/o:cisco:nx-os:6.1%282%29i3%282%29 cpe:/o:cisco:nx-os:6.1%282%29i3%283%29 cpe:/o:cisco:nx-os:6.1%282%29i3%283.78%29 cpe:/o:cisco:nx-os:6.1%282%29i3%284%29 cpe:/o:cisco:nx-os:6.1%283%29 cpe:/o:cisco:nx-os:6.1%284%29 cpe:/o:cisco:nx-os:6.1%284a%29 cpe:/o:cisco:nx-os:6.1%285%29 cpe:/o:cisco:nx-os:6.2%281%29 cpe:/o:cisco:nx-os:6.2%281n%29 cpe:/o:cisco:nx-os:6.2%282%29 cpe:/o:cisco:nx-os:6.2%282a%29 cpe:/o:cisco:nx-os:6.2%283%29 cpe:/o:cisco:nx-os:6.2%283n%29 cpe:/o:cisco:nx-os:6.2%285%29 cpe:/o:cisco:nx-os:6.2%285a%29 cpe:/o:cisco:nx-os:6.2%286%29 cpe:/o:cisco:nx-os:6.2%286b%29 cpe:/o:cisco:nx-os:6.2%287%29 cpe:/o:cisco:nx-os:6.2%288%29 cpe:/o:cisco:nx-os:6.2%288a%29 cpe:/o:cisco:nx-os:6.2%288b%29 cpe:/o:cisco:nx-os:6.2%2810%29 cpe:/o:cisco:nx-os:6.2%2811b%29 cpe:/o:cisco:nx-os:6.2%2812%29 cpe:/o:cisco:nx-os:6.2%2814%29s1 cpe:/o:cisco:nx-os:7.0%280%29n1%281%29 cpe:/o:cisco:nx-os:7.0%281%29n1%281%29 cpe:/o:cisco:nx-os:7.0%281%29n1%283%29 cpe:/o:cisco:nx-os:7.0%282%29n1%281%29 cpe:/o:cisco:nx-os:7.0%283%29 cpe:/o:cisco:nx-os:7.0%283%29i1%281a%29 cpe:/o:cisco:nx-os:7.0%283%29i1%281b%29 cpe:/o:cisco:nx-os:7.0%283%29i1%282%29 cpe:/o:cisco:nx-os:7.0%283%29i2%280.373%29 cpe:/o:cisco:nx-os:7.0%283%29i7 cpe:/o:cisco:nx-os:7.0%283%29n1%281%29 cpe:/o:cisco:nx-os:7.0%284%29n1%281%29 cpe:/o:cisco:nx-os:7.0%285%29n1%281%29 cpe:/o:cisco:nx-os:7.0%285%29n1%281a%29 cpe:/o:cisco:nx-os:7.0%286%29n1%281%29 cpe:/o:cisco:nx-os:7.0%287%29n1%281%29 cpe:/o:cisco:nx-os:7.0%288%29n1%281%29 cpe:/o:cisco:nx-os:7.1%280%29n1%281a%29 cpe:/o:cisco:nx-os:7.1%280%29n1%281b%29 cpe:/o:cisco:nx-os:7.1%281%29n1%281%29 cpe:/o:cisco:nx-os:7.1%282%29n1%281%29 cpe:/o:cisco:nx-os:7.1%283%29n1%281%29 cpe:/o:cisco:nx-os:7.1%283%29n1%282%29 cpe:/o:cisco:nx-os:7.1%283%29n1%282.1%29 cpe:/o:cisco:nx-os:7.1%283%29n1%283.12%29 cpe:/o:cisco:nx-os:7.1%284%29n1%281%29 cpe:/o:cisco:nx-os:7.2%280%29n1%280.1%29 cpe:/o:cisco:nx-os:7.2%280%29n1%281%29 cpe:/o:cisco:nx-os:7.2%280%29zz%2899.1%29 cpe:/o:cisco:nx-os:7.2%280%29zz%2899.3%29 cpe:/o:cisco:nx-os:7.2%281%29n1%281%29 cpe:/o:cisco:nx-os:7.3 cpe:/o:cisco:nx-os:7.3%280%29n1%281%29 cpe:/o:cisco:nx-os:7.3%280%29zn%280.9%29 cpe:/o:cisco:nx-os:7.3%280%29zn%280.81%29 cpe:/o:cisco:nx-os:7.3%280%29zn%280.83%29 cpe:/o:cisco:nx-os:7.3%282%29n1%280.296%29 cpe:/o:cisco:nx-os:7.3%282%29n1%280.395%29 cpe:/o:cisco:nx-os:8.0 cpe:/o:cisco:nx-os:8.0%281%29s2 cpe:/o:cisco:nx-os:8.1 cpe:/o:cisco:nx-os:8.1%280.2%29s0 cpe:/o:cisco:nx-os:8.1%280.59%29s0 cpe:/o:cisco:nx-os:8.1%280.112%29s0

CVE-2018-0293

2018-06-20T17:29:00.343-04:00

2019-10-09T19:31:40.113-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov BID 104520 SECTRACK 1041169 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-nxosrbac A vulnerability in role-based access control (RBAC) for Cisco NX-OS Software could allow an authenticated, remote attacker to execute CLI commands that should be restricted for a nonadministrative user. The attacker would have to possess valid user credentials for the device. The vulnerability is due to incorrect RBAC privilege assignment for certain CLI commands. An attacker could exploit this vulnerability by authenticating to a device as a nonadministrative user and executing specific commands from the CLI. An exploit could allow the attacker to run commands that should be restricted to administrative users. These commands could modify the configuration or boot image on the device. This vulnerability affects MDS 9000 Series Multilayer Switches, Nexus 2000 Series Switches, Nexus 3000 Series Switches, Nexus 3500 Platform Switches, Nexus 3600 Platform Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Switches in standalone NX-OS mode, Nexus 9500 R-Series Line Cards and Fabric Modules. Cisco Bug IDs: CSCvd77904.

cpe:/o:cisco:nx-os:4.1%282%29e1%281a%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.10%29 cpe:/o:cisco:nx-os:7.0%283%29i2%284a%29 cpe:/o:cisco:nx-os:7.3%282%29n1%280.354%29 cpe:/o:cisco:nx-os:8.8%283.5%29s0

CVE-2018-0294

2018-06-20T17:29:00.390-04:00

2019-10-09T19:31:40.363-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1041169 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-nxosadmin A vulnerability in the write-erase feature of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to configure an unauthorized administrator account for an affected device. The vulnerability exists because the affected software does not properly delete sensitive files when certain CLI commands are used to clear the device configuration and reload a device. An attacker could exploit this vulnerability by logging into an affected device as an administrative user and configuring an unauthorized account for the device. The account would not require a password for authentication and would be accessible only via a Secure Shell (SSH) connection to the device. A successful exploit could allow the attacker to configure an unauthorized account that has administrative privileges, does not require a password for authentication, and does not appear in the running configuration or the audit logs for the affected device. This vulnerability affects Firepower 4100 Series Next-Generation Firewalls, Firepower 9300 Security Appliance, Nexus 1000V Series Switches, Nexus 1100 Series Cloud Services Platforms, Nexus 2000 Series Fabric Extenders, Nexus 3500 Platform Switches, Nexus 4000 Series Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, UCS 6100 Series Fabric Interconnects, UCS 6200 Series Fabric Interconnects, UCS 6300 Series Fabric Interconnects. Cisco Bug IDs: CSCvd13993, CSCvd34845, CSCvd34857, CSCvd34862, CSCvd34879, CSCve35753.

CVE-2018-0295

2018-06-20T17:29:00.437-04:00

2019-10-09T19:31:40.660-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1041169 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-nxosbgp A vulnerability in the Border Gateway Protocol (BGP) implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition due to the device unexpectedly reloading. The vulnerability is due to incomplete input validation of the BGP update messages. An attacker could exploit this vulnerability by sending a crafted BGP update message to the targeted device. An exploit could allow the attacker to cause the switch to reload unexpectedly. The Cisco implementation of the BGP protocol only accepts incoming BGP traffic from explicitly defined peers. To exploit this vulnerability, an attacker must be able to send the malicious packets over a TCP connection that appears to come from a trusted BGP peer or inject malformed messages into the victim's BGP network. This would require obtaining information about the BGP peers in the affected system's trusted network. The vulnerability may be triggered when the router receives a malformed BGP message from a peer on an existing BGP session. At least one BGP neighbor session must be established for a router to be vulnerable. This vulnerability affects Nexus 2000 Series Switches, Nexus 3000 Series Switches, Nexus 3500 Platform Switches, Nexus 3600 Platform Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode, Nexus 9000 Series Switches in standalone NX-OS mode, Nexus 9500 R-Series Line Cards and Fabric Modules. Cisco Bug IDs: CSCve79599, CSCve87784, CSCve91371, CSCve91387.

cpe:/a:cisco:adaptive_security_appliance_software:8.1%282.5%29 cpe:/a:cisco:adaptive_security_appliance_software:9.1 cpe:/a:cisco:adaptive_security_appliance_software:9.1%28.2%29 cpe:/a:cisco:adaptive_security_appliance_software:9.1%28.3%29 cpe:/a:cisco:adaptive_security_appliance_software:9.1%28.5%29 cpe:/a:cisco:adaptive_security_appliance_software:9.1%281%29 cpe:/a:cisco:adaptive_security_appliance_software:9.1%281.7%29 cpe:/a:cisco:adaptive_security_appliance_software:9.1%282%29 cpe:/a:cisco:adaptive_security_appliance_software:9.1%283%29 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%294 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%296 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%297 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%299 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2911 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2912 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2913 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2915 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2916 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2919 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2920 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2921 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2923 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2925 cpe:/a:cisco:adaptive_security_appliance_software:9.1%287%2929 cpe:/a:cisco:adaptive_security_appliance_software:9.1.1 cpe:/a:cisco:adaptive_security_appliance_software:9.1.4.5 cpe:/a:cisco:adaptive_security_appliance_software:9.1.5.12 cpe:/a:cisco:adaptive_security_appliance_software:9.1.5.21 cpe:/a:cisco:adaptive_security_appliance_software:9.1.6 cpe:/a:cisco:adaptive_security_appliance_software:9.1.6.8 cpe:/a:cisco:adaptive_security_appliance_software:9.1.6.10 cpe:/a:cisco:adaptive_security_appliance_software:9.1.7.4 cpe:/a:cisco:adaptive_security_appliance_software:9.1.7.6 cpe:/a:cisco:adaptive_security_appliance_software:9.1.7.7 cpe:/a:cisco:adaptive_security_appliance_software:9.1.7.9 cpe:/a:cisco:adaptive_security_appliance_software:9.1.7.11 cpe:/a:cisco:adaptive_security_appliance_software:9.1.7.12 cpe:/a:cisco:adaptive_security_appliance_software:9.2%280.0%29 cpe:/a:cisco:adaptive_security_appliance_software:9.2%280.104%29 cpe:/a:cisco:adaptive_security_appliance_software:9.2%283.1%29 cpe:/a:cisco:adaptive_security_appliance_software:9.2%284%2920 cpe:/a:cisco:adaptive_security_appliance_software:9.2%284%2922 cpe:/a:cisco:adaptive_security_appliance_software:9.2%284%2924 cpe:/a:cisco:adaptive_security_appliance_software:9.2%284%2925 cpe:/a:cisco:adaptive_security_appliance_software:9.2%284%2926 cpe:/a:cisco:adaptive_security_appliance_software:9.2%284%2927 cpe:/a:cisco:adaptive_security_appliance_software:9.2%284%2928 cpe:/a:cisco:adaptive_security_appliance_software:9.2%284%2933 cpe:/a:cisco:adaptive_security_appliance_software:9.2.2.7 cpe:/a:cisco:adaptive_security_appliance_software:9.2.2.8 cpe:/a:cisco:adaptive_security_appliance_software:9.2.3.3 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4.2 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4.4 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4.8 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4.10 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4.13 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4.14 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4.16 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4.17 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4.18 cpe:/a:cisco:adaptive_security_appliance_software:9.2.4.19 cpe:/a:cisco:adaptive_security_appliance_software:9.3 cpe:/a:cisco:adaptive_security_appliance_software:9.3%28.2%29 cpe:/a:cisco:adaptive_security_appliance_software:9.3%281%29 cpe:/a:cisco:adaptive_security_appliance_software:9.3%281.50%29 cpe:/a:cisco:adaptive_security_appliance_software:9.3%282%29 cpe:/a:cisco:adaptive_security_appliance_software:9.3%282.200%29 cpe:/a:cisco:adaptive_security_appliance_software:9.3%282.243%29 cpe:/a:cisco:adaptive_security_appliance_software:9.3%283%29 cpe:/a:cisco:adaptive_security_appliance_software:9.3.1.1 cpe:/a:cisco:adaptive_security_appliance_software:9.3.2 cpe:/a:cisco:adaptive_security_appliance_software:9.3.2.2 cpe:/a:cisco:adaptive_security_appliance_software:9.3.3.5 cpe:/a:cisco:adaptive_security_appliance_software:9.3.3.6 cpe:/a:cisco:adaptive_security_appliance_software:9.3.3.9 cpe:/a:cisco:adaptive_security_appliance_software:9.3.3.10 cpe:/a:cisco:adaptive_security_appliance_software:9.3.3.11 cpe:/a:cisco:adaptive_security_appliance_software:9.3.5 cpe:/a:cisco:adaptive_security_appliance_software:9.4 cpe:/a:cisco:adaptive_security_appliance_software:9.4%281%29 cpe:/a:cisco:adaptive_security_appliance_software:9.4%281.1%29 cpe:/a:cisco:adaptive_security_appliance_software:9.4%281.152%29 cpe:/a:cisco:adaptive_security_appliance_software:9.4%281.200%29 cpe:/a:cisco:adaptive_security_appliance_software:9.4%281.225%29 cpe:/a:cisco:adaptive_security_appliance_software:9.4%282%29 cpe:/a:cisco:adaptive_security_appliance_software:9.4%282.145%29 cpe:/a:cisco:adaptive_security_appliance_software:9.4%283%29 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%292 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%295 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%296 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%298 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%2910 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%2912 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%2913 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%2914 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%2916 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%2917 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284%2918 cpe:/a:cisco:adaptive_security_appliance_software:9.4%284.5%29 cpe:/a:cisco:adaptive_security_appliance_software:9.4.1 cpe:/a:cisco:adaptive_security_appliance_software:9.4.1.1 cpe:/a:cisco:adaptive_security_appliance_software:9.4.1.2 cpe:/a:cisco:adaptive_security_appliance_software:9.4.1.3 cpe:/a:cisco:adaptive_security_appliance_software:9.4.1.5 cpe:/a:cisco:adaptive_security_appliance_software:9.4.2 cpe:/a:cisco:adaptive_security_appliance_software:9.4.2.3 cpe:/a:cisco:adaptive_security_appliance_software:9.4.3 cpe:/a:cisco:adaptive_security_appliance_software:9.4.3.4 cpe:/a:cisco:adaptive_security_appliance_software:9.4.3.6 cpe:/a:cisco:adaptive_security_appliance_software:9.4.3.8 cpe:/a:cisco:adaptive_security_appliance_software:9.4.3.11 cpe:/a:cisco:adaptive_security_appliance_software:9.4.3.12 cpe:/a:cisco:adaptive_security_appliance_software:9.4.4 cpe:/a:cisco:adaptive_security_appliance_software:9.5 cpe:/a:cisco:adaptive_security_appliance_software:9.5%281%29 cpe:/a:cisco:adaptive_security_appliance_software:9.5.1 cpe:/a:cisco:adaptive_security_appliance_software:9.5.2 cpe:/a:cisco:adaptive_security_appliance_software:9.5.2.6 cpe:/a:cisco:adaptive_security_appliance_software:9.5.2.10 cpe:/a:cisco:adaptive_security_appliance_software:9.5.2.14 cpe:/a:cisco:adaptive_security_appliance_software:9.5.3 cpe:/a:cisco:adaptive_security_appliance_software:9.5.3.1 cpe:/a:cisco:adaptive_security_appliance_software:9.5.3.2 cpe:/a:cisco:adaptive_security_appliance_software:9.5.3.3 cpe:/a:cisco:adaptive_security_appliance_software:9.5.3.6 cpe:/a:cisco:adaptive_security_appliance_software:9.5.3.7 cpe:/a:cisco:adaptive_security_appliance_software:9.6 cpe:/a:cisco:adaptive_security_appliance_software:9.6%281%29 cpe:/a:cisco:adaptive_security_appliance_software:9.6%282%29 cpe:/a:cisco:adaptive_security_appliance_software:9.6%283%293 cpe:/a:cisco:adaptive_security_appliance_software:9.6%283%298 cpe:/a:cisco:adaptive_security_appliance_software:9.6%283%299 cpe:/a:cisco:adaptive_security_appliance_software:9.6%283%2911 cpe:/a:cisco:adaptive_security_appliance_software:9.6%283%2912 cpe:/a:cisco:adaptive_security_appliance_software:9.6%283%2914 cpe:/a:cisco:adaptive_security_appliance_software:9.6%283%2917 cpe:/a:cisco:adaptive_security_appliance_software:9.6%283.1%29 cpe:/a:cisco:adaptive_security_appliance_software:9.6%284%29 cpe:/a:cisco:adaptive_security_appliance_software:9.6%284%293 cpe:/a:cisco:adaptive_security_appliance_software:9.6%284%295 cpe:/a:cisco:adaptive_security_appliance_software:9.6%284%296 cpe:/a:cisco:adaptive_security_appliance_software:9.6%284%298 cpe:/a:cisco:adaptive_security_appliance_software:9.6.0 cpe:/a:cisco:adaptive_security_appliance_software:9.6.1 cpe:/a:cisco:adaptive_security_appliance_software:9.6.1.3 cpe:/a:cisco:adaptive_security_appliance_software:9.6.1.5 cpe:/a:cisco:adaptive_security_appliance_software:9.6.1.10 cpe:/a:cisco:adaptive_security_appliance_software:9.6.2 cpe:/a:cisco:adaptive_security_appliance_software:9.6.2.1 cpe:/a:cisco:adaptive_security_appliance_software:9.6.2.2 cpe:/a:cisco:adaptive_security_appliance_software:9.6.2.3 cpe:/a:cisco:adaptive_security_appliance_software:9.6.2.7 cpe:/a:cisco:adaptive_security_appliance_software:9.7 cpe:/a:cisco:adaptive_security_appliance_software:9.7%281%29 cpe:/a:cisco:adaptive_security_appliance_software:9.7%281%291 cpe:/a:cisco:adaptive_security_appliance_software:9.7%281%292 cpe:/a:cisco:adaptive_security_appliance_software:9.7%281%294 cpe:/a:cisco:adaptive_security_appliance_software:9.7%281%298 cpe:/a:cisco:adaptive_security_appliance_software:9.7%281%2915 cpe:/a:cisco:adaptive_security_appliance_software:9.7%281%2916 cpe:/a:cisco:adaptive_security_appliance_software:9.7%281%2921 cpe:/a:cisco:adaptive_security_appliance_software:9.7%281%2924 cpe:/a:cisco:adaptive_security_appliance_software:9.7%281.4%29 cpe:/a:cisco:adaptive_security_appliance_software:9.8 cpe:/a:cisco:adaptive_security_appliance_software:9.8%280.56%29 cpe:/a:cisco:adaptive_security_appliance_software:9.8%281%29 cpe:/a:cisco:adaptive_security_appliance_software:9.8%281.200%29 cpe:/a:cisco:adaptive_security_appliance_software:9.8%282%29 cpe:/a:cisco:adaptive_security_appliance_software:9.8%282%298 cpe:/a:cisco:adaptive_security_appliance_software:9.8%282%2914 cpe:/a:cisco:adaptive_security_appliance_software:9.8%282%2917 cpe:/a:cisco:adaptive_security_appliance_software:9.8%282%2920 cpe:/a:cisco:adaptive_security_appliance_software:9.8%282%2924 cpe:/a:cisco:adaptive_security_appliance_software:9.8%282%2926 cpe:/a:cisco:adaptive_security_appliance_software:9.8%282%2928 cpe:/a:cisco:adaptive_security_appliance_software:9.8%283%29 cpe:/a:cisco:adaptive_security_appliance_software:9.9 cpe:/a:cisco:adaptive_security_appliance_software:9.9%281%29 cpe:/a:cisco:adaptive_security_appliance_software:9.9%282%29 cpe:/a:cisco:adaptive_security_appliance_software:9.9%282%291 cpe:/a:cisco:firepower_threat_defense:6.0 cpe:/a:cisco:firepower_threat_defense:6.0.0 cpe:/a:cisco:firepower_threat_defense:6.0.0.1 cpe:/a:cisco:firepower_threat_defense:6.0.1 cpe:/a:cisco:firepower_threat_defense:6.0.1.1 cpe:/a:cisco:firepower_threat_defense:6.0.1.2 cpe:/a:cisco:firepower_threat_defense:6.0.1.3 cpe:/a:cisco:firepower_threat_defense:6.0.1.4 cpe:/a:cisco:firepower_threat_defense:6.2.1 cpe:/a:cisco:firepower_threat_defense:6.2.2 cpe:/a:cisco:firepower_threat_defense:6.2.2.1 cpe:/a:cisco:firepower_threat_defense:6.2.2.2 cpe:/a:cisco:firepower_threat_defense:6.2.3 cpe:/a:cisco:firepower_threat_defense:6.2.3-85.02 cpe:/a:cisco:firepower_threat_defense:6.2.3-851 cpe:/a:cisco:firepower_threat_defense:6.2.3.1

CVE-2018-0296

2018-06-07T08:29:00.403-04:00

2019-08-12T15:15:10.937-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/154017/Cisco-Adaptive-Security-Appliance-Path-Traversal.html BID 104612 SECTRACK 1041076 MISC https://ics-cert.us-cert.gov/advisories/ICSA-18-184-01 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-asaftd EXPLOIT-DB 44956 A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. It is also possible on certain software releases that the ASA will not reload, but an attacker could view sensitive system information without authentication by using directory traversal techniques. The vulnerability is due to lack of proper input validation of the HTTP URL. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to cause a DoS condition or unauthenticated disclosure of information. This vulnerability applies to IPv4 and IPv6 HTTP traffic. This vulnerability affects Cisco ASA Software and Cisco Firepower Threat Defense (FTD) Software that is running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 1000V Cloud Firewall, ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4100 Series Security Appliance, Firepower 9300 ASA Security Module, FTD Virtual (FTDv). Cisco Bug IDs: CSCvi16029.

cpe:/a:cisco:firepower_threat_defense:6.0.0 cpe:/a:cisco:firepower_threat_defense:6.1.0 cpe:/a:cisco:firepower_threat_defense:6.2.0 cpe:/a:cisco:firepower_threat_defense:6.2.2

CVE-2018-0297

2018-05-16T23:29:00.667-04:00

2019-10-09T19:31:41.020-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104197 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-firepwr-pb A vulnerability in the detection engine of Cisco Firepower Threat Defense software could allow an unauthenticated, remote attacker to bypass a configured Secure Sockets Layer (SSL) Access Control (AC) policy to block SSL traffic. The vulnerability is due to the incorrect handling of TCP SSL packets received out of order. An attacker could exploit this vulnerability by sending a crafted SSL connection through the affected device. A successful exploit could allow the attacker to bypass a configured SSL AC policy to block SSL traffic. Cisco Bug IDs: CSCvg09316.

CVE-2018-0298

2018-06-21T07:29:00.240-04:00

2019-10-09T19:31:41.130-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-fxos-dos A vulnerability in the web UI of Cisco FXOS and Cisco UCS Fabric Interconnect Software could allow an unauthenticated, remote attacker to cause a buffer overflow on an affected system. The vulnerability is due to incorrect input validation in the web UI. An attacker could exploit this vulnerability by sending a malicious HTTP or HTTPS packet directed to the physical management interface of an affected system. A successful exploit could allow the attacker to cause the process to crash and possibly reload the device, resulting in a denial of service (DoS) condition on the affected system. This vulnerability affects Firepower 4100 Series Next-Generation Firewall, Firepower 9300 Security Appliance, UCS 6200 Series Fabric Interconnects, UCS 6300 Series Fabric Interconnects. Cisco Bug IDs: CSCvb61398, CSCvb86799.

cpe:/o:cisco:nx-os:4.1%282%29e1%281r%29

CVE-2018-0299

2018-06-21T07:29:00.287-04:00

2019-10-09T19:31:41.333-04:00

6.8

NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1041169 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-n4k-snmp-dos A vulnerability in the Simple Network Management Protocol (SNMP) feature of Cisco NX-OS on the Cisco Nexus 4000 Series Switch could allow an authenticated, remote attacker to cause the device to unexpectedly reload, resulting in a denial of service (DoS) condition. The vulnerability is due to incomplete validation of an SNMP poll request for a specific MIB. An attacker could exploit this vulnerability by sending a specific SNMP poll request to the targeted device. An exploit could allow the attacker to cause the device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCvg10442.

cpe:/o:cisco:fxos:2.0%281.68%29

CVE-2018-0300

2018-06-21T07:29:00.337-04:00

2019-10-09T19:31:41.473-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov SECTRACK 1041169 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-firepwr-pt A vulnerability in the process of uploading new application images to Cisco FXOS on the Cisco Firepower 4100 Series Next-Generation Firewall (NGFW) and Firepower 9300 Security Appliance could allow an authenticated, remote attacker using path traversal techniques to create or overwrite arbitrary files on an affected device. The vulnerability is due to insufficient validation during the application image upload process. An attacker could exploit this vulnerability by creating an application image containing malicious code and installing the image on the affected device using the CLI or web-based user interface (web UI). These actions occur prior to signature verification and could allow the attacker to create and execute arbitrary code with root privileges. Note: A missing or invalid signature in the application image will cause the upload process to fail, but does not prevent the exploit. Cisco Bug IDs: CSCvc21901.

cpe:/o:cisco:nx-os:- cpe:/o:cisco:nx-os:1.0%281.110a%29 cpe:/o:cisco:nx-os:1.0%281e%29 cpe:/o:cisco:nx-os:1.1%281g%29 cpe:/o:cisco:nx-os:2.3 cpe:/o:cisco:nx-os:2.3.1.130 cpe:/o:cisco:nx-os:2.4 cpe:/o:cisco:nx-os:2.4.1.122 cpe:/o:cisco:nx-os:4.0 cpe:/o:cisco:nx-os:4.0%280%29n1%281a%29 cpe:/o:cisco:nx-os:4.0%280%29n1%282%29 cpe:/o:cisco:nx-os:4.0%280%29n1%282a%29 cpe:/o:cisco:nx-os:4.0%281a%29n1%281%29 cpe:/o:cisco:nx-os:4.0%281a%29n1%281a%29 cpe:/o:cisco:nx-os:4.0%281a%29n2%281%29 cpe:/o:cisco:nx-os:4.0%281a%29n2%281a%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%281%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%282%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%283%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%283a%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%283b%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%283c%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%283d%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281b%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281c%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281d%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281e%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281f%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281g%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281h%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281i%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281j%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281k%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281m%29 cpe:/o:cisco:nx-os:4.1%283%29n1%281%29 cpe:/o:cisco:nx-os:4.1%283%29n1%281a%29 cpe:/o:cisco:nx-os:4.1%283%29n2%281%29 cpe:/o:cisco:nx-os:4.1%283%29n2%281a%29 cpe:/o:cisco:nx-os:4.1.%282%29 cpe:/o:cisco:nx-os:4.1.%283%29 cpe:/o:cisco:nx-os:4.1.%284%29 cpe:/o:cisco:nx-os:4.1.%285%29 cpe:/o:cisco:nx-os:4.2 cpe:/o:cisco:nx-os:4.2%281%29 cpe:/o:cisco:nx-os:4.2%281%29n1%281%29 cpe:/o:cisco:nx-os:4.2%281%29n2%281%29 cpe:/o:cisco:nx-os:4.2%281%29n2%281a%29 cpe:/o:cisco:nx-os:4.2%281%29sv1%284%29 cpe:/o:cisco:nx-os:4.2%281%29sv1%284a%29 cpe:/o:cisco:nx-os:4.2%281%29sv1%285.1%29 cpe:/o:cisco:nx-os:4.2%282%29 cpe:/o:cisco:nx-os:4.2%283%29 cpe:/o:cisco:nx-os:4.2%284%29 cpe:/o:cisco:nx-os:4.2%286%29 cpe:/o:cisco:nx-os:4.2%288%29 cpe:/o:cisco:nx-os:4.2.%282a%29 cpe:/o:cisco:nx-os:5.0 cpe:/o:cisco:nx-os:5.0%282%29 cpe:/o:cisco:nx-os:5.0%282%29n1%281%29 cpe:/o:cisco:nx-os:5.0%282%29n2%281%29 cpe:/o:cisco:nx-os:5.0%282%29n2%281a%29 cpe:/o:cisco:nx-os:5.0%282a%29 cpe:/o:cisco:nx-os:5.0%283%29 cpe:/o:cisco:nx-os:5.0%283%29n1%281%29 cpe:/o:cisco:nx-os:5.0%283%29n1%281a%29 cpe:/o:cisco:nx-os:5.0%283%29n1%281b%29 cpe:/o:cisco:nx-os:5.0%283%29n1%281c%29 cpe:/o:cisco:nx-os:5.0%283%29n2%281%29 cpe:/o:cisco:nx-os:5.0%283%29n2%282%29 cpe:/o:cisco:nx-os:5.0%283%29n2%282a%29 cpe:/o:cisco:nx-os:5.0%283%29n2%282b%29 cpe:/o:cisco:nx-os:5.0%283%29u1%281%29 cpe:/o:cisco:nx-os:5.0%283%29u1%281a%29 cpe:/o:cisco:nx-os:5.0%283%29u1%281b%29 cpe:/o:cisco:nx-os:5.0%283%29u1%281d%29 cpe:/o:cisco:nx-os:5.0%283%29u1%282%29 cpe:/o:cisco:nx-os:5.0%283%29u1%282a%29 cpe:/o:cisco:nx-os:5.0%283%29u2%281%29 cpe:/o:cisco:nx-os:5.0%283%29u2%282%29 cpe:/o:cisco:nx-os:5.0%283%29u2%282a%29 cpe:/o:cisco:nx-os:5.0%283%29u2%282b%29 cpe:/o:cisco:nx-os:5.0%283%29u2%282c%29 cpe:/o:cisco:nx-os:5.0%283%29u2%282d%29 cpe:/o:cisco:nx-os:5.0%283%29u3%281%29 cpe:/o:cisco:nx-os:5.0%283%29u3%282%29 cpe:/o:cisco:nx-os:5.0%283%29u3%282a%29 cpe:/o:cisco:nx-os:5.0%283%29u3%282b%29 cpe:/o:cisco:nx-os:5.0%283%29u4%281%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281a%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281b%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281c%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281d%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281e%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281f%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281g%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281h%29 cpe:/o:cisco:nx-os:5.0%285%29 cpe:/o:cisco:nx-os:5.1 cpe:/o:cisco:nx-os:5.1%281%29 cpe:/o:cisco:nx-os:5.1%281a%29 cpe:/o:cisco:nx-os:5.1%282%29 cpe:/o:cisco:nx-os:5.1%283%29 cpe:/o:cisco:nx-os:5.1%283%29n1%281%29 cpe:/o:cisco:nx-os:5.1%283%29n1%281a%29 cpe:/o:cisco:nx-os:5.1%283%29n2%281%29 cpe:/o:cisco:nx-os:5.1%283%29n2%281a%29 cpe:/o:cisco:nx-os:5.1%283%29n2%281b%29 cpe:/o:cisco:nx-os:5.1%283%29n2%281c%29 cpe:/o:cisco:nx-os:5.1%284%29 cpe:/o:cisco:nx-os:5.1%285%29 cpe:/o:cisco:nx-os:5.1%286%29 cpe:/o:cisco:nx-os:5.1.3 cpe:/o:cisco:nx-os:5.2 cpe:/o:cisco:nx-os:5.2%281%29 cpe:/o:cisco:nx-os:5.2%281%29n1%281%29 cpe:/o:cisco:nx-os:5.2%281%29n1%281a%29 cpe:/o:cisco:nx-os:5.2%281%29n1%281b%29 cpe:/o:cisco:nx-os:5.2%281%29n1%282%29 cpe:/o:cisco:nx-os:5.2%281%29n1%282a%29 cpe:/o:cisco:nx-os:5.2%281%29n1%283%29 cpe:/o:cisco:nx-os:5.2%281%29n1%284%29 cpe:/o:cisco:nx-os:5.2%281%29n1%285%29 cpe:/o:cisco:nx-os:5.2%281%29n1%286%29 cpe:/o:cisco:nx-os:5.2%281%29n1%287%29 cpe:/o:cisco:nx-os:5.2%281%29n1%288%29 cpe:/o:cisco:nx-os:5.2%281%29n1%288a%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.1%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.3%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.5a%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.5b%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.6%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.10%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%282.8%29 cpe:/o:cisco:nx-os:5.2%283%29 cpe:/o:cisco:nx-os:5.2%283a%29 cpe:/o:cisco:nx-os:5.2%284%29 cpe:/o:cisco:nx-os:5.2%285%29 cpe:/o:cisco:nx-os:5.2%287%29 cpe:/o:cisco:nx-os:5.2%289%29 cpe:/o:cisco:nx-os:5.2%289%29n1%281%29 cpe:/o:cisco:nx-os:5.3.0 cpe:/o:cisco:nx-os:6.0 cpe:/o:cisco:nx-os:6.0%281%29 cpe:/o:cisco:nx-os:6.0%282%29 cpe:/o:cisco:nx-os:6.0%282%29a6%281%29 cpe:/o:cisco:nx-os:6.0%282%29a6%282%29 cpe:/o:cisco:nx-os:6.0%282%29a6%283%29 cpe:/o:cisco:nx-os:6.0%282%29a6%284%29 cpe:/o:cisco:nx-os:6.0%282%29a6%285%29 cpe:/o:cisco:nx-os:6.0%282%29a6%286%29 cpe:/o:cisco:nx-os:6.0%282%29a6%287%29 cpe:/o:cisco:nx-os:6.0%282%29a6%288%29 cpe:/o:cisco:nx-os:6.0%282%29a7%281%29 cpe:/o:cisco:nx-os:6.0%282%29a7%282%29 cpe:/o:cisco:nx-os:6.0%282%29a7%282a%29 cpe:/o:cisco:nx-os:6.0%282%29a8%282%29 cpe:/o:cisco:nx-os:6.0%282%29n1%281%29 cpe:/o:cisco:nx-os:6.0%282%29n1%282%29 cpe:/o:cisco:nx-os:6.0%282%29n1%282a%29 cpe:/o:cisco:nx-os:6.0%282%29n2%281%29 cpe:/o:cisco:nx-os:6.0%282%29n2%281b%29 cpe:/o:cisco:nx-os:6.0%282%29n2%282%29 cpe:/o:cisco:nx-os:6.0%282%29n2%283%29 cpe:/o:cisco:nx-os:6.0%282%29n2%284%29 cpe:/o:cisco:nx-os:6.0%282%29n2%285%29 cpe:/o:cisco:nx-os:6.0%282%29n2%285a%29 cpe:/o:cisco:nx-os:6.0%282%29n2%286%29 cpe:/o:cisco:nx-os:6.0%282%29n2%287%29 cpe:/o:cisco:nx-os:6.0%282%29u1%281%29 cpe:/o:cisco:nx-os:6.0%282%29u1%281a%29 cpe:/o:cisco:nx-os:6.0%282%29u1%282%29 cpe:/o:cisco:nx-os:6.0%282%29u1%283%29 cpe:/o:cisco:nx-os:6.0%282%29u1%284%29 cpe:/o:cisco:nx-os:6.0%282%29u2%281%29 cpe:/o:cisco:nx-os:6.0%282%29u2%282%29 cpe:/o:cisco:nx-os:6.0%282%29u2%283%29 cpe:/o:cisco:nx-os:6.0%282%29u2%284%29 cpe:/o:cisco:nx-os:6.0%282%29u2%285%29 cpe:/o:cisco:nx-os:6.0%282%29u2%286%29 cpe:/o:cisco:nx-os:6.0%282%29u3%281%29 cpe:/o:cisco:nx-os:6.0%282%29u3%282%29 cpe:/o:cisco:nx-os:6.0%282%29u3%283%29 cpe:/o:cisco:nx-os:6.0%282%29u3%284%29 cpe:/o:cisco:nx-os:6.0%282%29u3%285%29 cpe:/o:cisco:nx-os:6.0%282%29u4%281%29 cpe:/o:cisco:nx-os:6.0%282%29u4%282%29 cpe:/o:cisco:nx-os:6.0%282%29u4%283%29 cpe:/o:cisco:nx-os:6.0%282%29u5%281%29 cpe:/o:cisco:nx-os:6.0%282%29u5%281.41%29 cpe:/o:cisco:nx-os:6.0%282%29u5%282%29 cpe:/o:cisco:nx-os:6.0%282%29u5%283%29 cpe:/o:cisco:nx-os:6.0%282%29u5%284%29 cpe:/o:cisco:nx-os:6.0%282%29u6%281%29 cpe:/o:cisco:nx-os:6.0%282%29u6%282%29 cpe:/o:cisco:nx-os:6.0%282%29u6%283%29 cpe:/o:cisco:nx-os:6.0%282%29u6%284%29 cpe:/o:cisco:nx-os:6.0%282%29u6%285%29 cpe:/o:cisco:nx-os:6.0%282%29u6%286%29 cpe:/o:cisco:nx-os:6.0%282%29u6%287%29 cpe:/o:cisco:nx-os:6.0%282%29u6%288%29 cpe:/o:cisco:nx-os:6.0%283%29 cpe:/o:cisco:nx-os:6.0%284%29 cpe:/o:cisco:nx-os:6.1 cpe:/o:cisco:nx-os:6.1%281%29 cpe:/o:cisco:nx-os:6.1%282%29 cpe:/o:cisco:nx-os:6.1%282%29i2%282%29 cpe:/o:cisco:nx-os:6.1%282%29i2%282a%29 cpe:/o:cisco:nx-os:6.1%282%29i2%282b%29 cpe:/o:cisco:nx-os:6.1%282%29i2%283%29 cpe:/o:cisco:nx-os:6.1%282%29i3%281%29 cpe:/o:cisco:nx-os:6.1%282%29i3%282%29 cpe:/o:cisco:nx-os:6.1%282%29i3%283%29 cpe:/o:cisco:nx-os:6.1%282%29i3%283.78%29 cpe:/o:cisco:nx-os:6.1%282%29i3%284%29 cpe:/o:cisco:nx-os:6.1%283%29 cpe:/o:cisco:nx-os:6.1%284%29 cpe:/o:cisco:nx-os:6.1%284a%29 cpe:/o:cisco:nx-os:6.1%285%29 cpe:/o:cisco:nx-os:6.2 cpe:/o:cisco:nx-os:6.2%281%29 cpe:/o:cisco:nx-os:6.2%281n%29 cpe:/o:cisco:nx-os:6.2%282%29 cpe:/o:cisco:nx-os:6.2%282a%29 cpe:/o:cisco:nx-os:6.2%283%29 cpe:/o:cisco:nx-os:6.2%283n%29 cpe:/o:cisco:nx-os:6.2%285%29 cpe:/o:cisco:nx-os:6.2%285a%29 cpe:/o:cisco:nx-os:6.2%286%29 cpe:/o:cisco:nx-os:6.2%286b%29 cpe:/o:cisco:nx-os:6.2%287%29 cpe:/o:cisco:nx-os:6.2%288%29 cpe:/o:cisco:nx-os:6.2%288a%29 cpe:/o:cisco:nx-os:6.2%288b%29 cpe:/o:cisco:nx-os:6.2%2810%29 cpe:/o:cisco:nx-os:6.2%2811b%29 cpe:/o:cisco:nx-os:6.2%2812%29 cpe:/o:cisco:nx-os:6.2%2814%29s1 cpe:/o:cisco:nx-os:7.0 cpe:/o:cisco:nx-os:7.0%280%29n1%281%29 cpe:/o:cisco:nx-os:7.0%281%29n1%281%29 cpe:/o:cisco:nx-os:7.0%281%29n1%283%29 cpe:/o:cisco:nx-os:7.0%282%29n1%281%29 cpe:/o:cisco:nx-os:7.0%283%29 cpe:/o:cisco:nx-os:7.0%283%29i1%281a%29 cpe:/o:cisco:nx-os:7.0%283%29i1%281b%29 cpe:/o:cisco:nx-os:7.0%283%29i1%282%29 cpe:/o:cisco:nx-os:7.0%283%29i2%280.373%29 cpe:/o:cisco:nx-os:7.0%283%29i7 cpe:/o:cisco:nx-os:7.0%283%29n1%281%29 cpe:/o:cisco:nx-os:7.0%284%29n1%281%29 cpe:/o:cisco:nx-os:7.0%285%29n1%281%29 cpe:/o:cisco:nx-os:7.0%285%29n1%281a%29 cpe:/o:cisco:nx-os:7.0%286%29n1%281%29 cpe:/o:cisco:nx-os:7.0%287%29n1%281%29 cpe:/o:cisco:nx-os:7.0%288%29n1%281%29 cpe:/o:cisco:nx-os:7.1 cpe:/o:cisco:nx-os:7.1%280%29n1%281a%29 cpe:/o:cisco:nx-os:7.1%280%29n1%281b%29 cpe:/o:cisco:nx-os:7.1%281%29n1%281%29 cpe:/o:cisco:nx-os:7.1%282%29n1%281%29 cpe:/o:cisco:nx-os:7.1%283%29n1%281%29 cpe:/o:cisco:nx-os:7.1%283%29n1%282%29 cpe:/o:cisco:nx-os:7.1%283%29n1%282.1%29 cpe:/o:cisco:nx-os:7.1%283%29n1%283.12%29 cpe:/o:cisco:nx-os:7.1%284%29n1%281%29 cpe:/o:cisco:nx-os:7.2 cpe:/o:cisco:nx-os:7.2%280%29n1%280.1%29 cpe:/o:cisco:nx-os:7.2%280%29n1%281%29 cpe:/o:cisco:nx-os:7.2%280%29zz%2899.1%29 cpe:/o:cisco:nx-os:7.2%280%29zz%2899.3%29 cpe:/o:cisco:nx-os:7.2%281%29n1%281%29 cpe:/o:cisco:nx-os:7.3 cpe:/o:cisco:nx-os:7.3%280%29n1%281%29 cpe:/o:cisco:nx-os:7.3%280%29zn%280.9%29 cpe:/o:cisco:nx-os:7.3%280%29zn%280.81%29 cpe:/o:cisco:nx-os:7.3%280%29zn%280.83%29 cpe:/o:cisco:nx-os:7.3%282%29n1%280.296%29 cpe:/o:cisco:nx-os:7.3%282%29n1%280.395%29 cpe:/o:cisco:nx-os:8.0 cpe:/o:cisco:nx-os:8.0%281%29s2 cpe:/o:cisco:nx-os:8.1 cpe:/o:cisco:nx-os:8.1%280.2%29s0 cpe:/o:cisco:nx-os:8.1%280.59%29s0 cpe:/o:cisco:nx-os:8.1%280.112%29s0 cpe:/o:cisco:nx-os:8.2

CVE-2018-0301

2018-06-20T17:29:00.483-04:00

2019-10-09T19:31:41.613-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 104512 SECTRACK 1041169 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-nxos-bo A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to craft a packet to the management interface on an affected system, causing a buffer overflow. The vulnerability is due to incorrect input validation in the authentication module of the NX-API subsystem. An attacker could exploit this vulnerability by sending a crafted HTTP or HTTPS packet to the management interface of an affected system with the NX-API feature enabled. An exploit could allow the attacker to execute arbitrary code as root. Note: NX-API is disabled by default. This vulnerability affects: MDS 9000 Series Multilayer Switches, Nexus 2000 Series Fabric Extenders, Nexus 3000 Series Switches, Nexus 3500 Platform Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Switches in standalone NX-OS mode, Nexus 9500 R-Series Line Cards and Fabric Modules. Cisco Bug IDs: CSCvd45804, CSCve02322, CSCve02412.

cpe:/o:cisco:nx-os:3.1%281k%29a

CVE-2018-0302

2018-06-21T07:29:00.367-04:00

2019-10-09T19:31:41.863-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-fxos-ace A vulnerability in the CLI parser of Cisco FXOS Software and Cisco UCS Fabric Interconnect Software could allow an authenticated, local attacker to cause a buffer overflow on an affected device. The vulnerability is due to incorrect input validation in the CLI parser subsystem. An attacker could exploit this vulnerability by exceeding the expected length of user input. A successful exploit could allow the attacker to execute arbitrary code with root privileges on the affected system. This vulnerability affects Firepower 4100 Series Next-Generation Firewall, Firepower 9300 Security Appliance, UCS 6100 Series Fabric Interconnects, UCS 6200 Series Fabric Interconnects, UCS 6300 Series Fabric Interconnects. Cisco Bug IDs: CSCvb61099, CSCvb86743.

cpe:/o:cisco:nx-os:3.1%283a%29a cpe:/o:cisco:nx-os:7.0%280%29hsk%280.357%29 cpe:/o:cisco:nx-os:7.0%283%29i4%287%29 cpe:/o:cisco:nx-os:7.0%283%29i7%281%29 cpe:/o:cisco:nx-os:8.0%281%29 cpe:/o:cisco:nx-os:8.1%280.2%29s0 cpe:/o:cisco:nx-os:8.8%280.1%29 cpe:/o:cisco:nx-os:8.8%283.5%29s0

CVE-2018-0303

2018-06-21T07:29:00.413-04:00

2019-10-09T19:31:42.020-04:00

8.3

ADJACENT_NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1041169 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-fxnxos-dos A vulnerability in the Cisco Discovery Protocol component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code as root or cause a denial of service (DoS) condition on the affected device. The vulnerability exists because of insufficiently validated Cisco Discovery Protocol packet headers. An attacker could exploit this vulnerability by sending a crafted Cisco Discovery Protocol packet to a Layer 2 adjacent affected device. A successful exploit could allow the attacker to cause a buffer overflow that could allow the attacker to execute arbitrary code as root or cause a DoS condition on the affected device. This vulnerability affects the following if configured to use Cisco Discovery Protocol: Firepower 4100 Series Next-Generation Firewalls, Firepower 9300 Security Appliance, MDS 9000 Series Multilayer Switches, Nexus 1000V Series Switches, Nexus 1100 Series Cloud Services Platforms, Nexus 2000 Series Fabric Extenders, Nexus 3000 Series Switches, Nexus 3500 Platform Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode, Nexus 9000 Series Switches in standalone NX-OS mode, Nexus 9500 R-Series Line Cards and Fabric Modules, UCS 6100 Series Fabric Interconnects, UCS 6200 Series Fabric Interconnects, UCS 6300 Series Fabric Interconnects. Cisco Bug IDs: CSCvc22202, CSCvc22205, CSCvc22208, CSCvc88078, CSCvc88150, CSCvc88159, CSCvc88162, CSCvc88167.

cpe:/o:cisco:firepower_9000_firmware:r211 cpe:/o:cisco:firepower_9000_firmware:r231 cpe:/o:cisco:nexus_5000_firmware:7.0%280%29hsk%280.357%29 cpe:/o:cisco:nexus_5000_firmware:7.3%280%29d1%280.98%29 cpe:/o:cisco:nexus_5000_firmware:8.1%280.2%29s0 cpe:/o:cisco:nexus_7000_firmware:7.3%282%29d1%280.49%29 cpe:/o:cisco:nexus_7000_firmware:8.0%281%29 cpe:/o:cisco:nexus_7000_firmware:8.1%280.112%29s0 cpe:/o:cisco:nexus_9000_firmware:8.1%280%29bd%280.20%29 cpe:/o:cisco:nexus_9000_firmware:8.1%281%29s4 cpe:/o:cisco:unified_computing_system_firmware:3.1%283a%29a cpe:/o:cisco:unified_computing_system_firmware:7.0%280%29hsk%280.357%29

CVE-2018-0304

2018-06-20T17:29:00.530-04:00

2019-10-09T19:31:42.317-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 104513 SECTRACK 1041169 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-fxnxos-ace A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to read sensitive memory content, create a denial of service (DoS) condition, or execute arbitrary code as root. The vulnerability exists because the affected software insufficiently validates Cisco Fabric Services packet headers. An attacker could exploit this vulnerability by sending a crafted Cisco Fabric Services packet to an affected device. A successful exploit could allow the attacker to cause a buffer overflow or buffer overread condition in the Cisco Fabric Services component, which could allow the attacker to read sensitive memory content, create a DoS condition, or execute arbitrary code as root. This vulnerability affects the following if configured to use Cisco Fabric Services: Firepower 4100 Series Next-Generation Firewalls, Firepower 9300 Security Appliance, MDS 9000 Series Multilayer Switches, Nexus 2000 Series Fabric Extenders, Nexus 3000 Series Switches, Nexus 3500 Platform Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Switches in standalone NX-OS mode, Nexus 9500 R-Series Line Cards and Fabric Modules, UCS 6100 Series Fabric Interconnects, UCS 6200 Series Fabric Interconnects, UCS 6300 Series Fabric Interconnects. Cisco Bug IDs: CSCvd69951, CSCve02459, CSCve02461, CSCve02463, CSCve02474, CSCve04859.

cpe:/o:cisco:firepower_9000_firmware:r211 cpe:/o:cisco:firepower_9000_firmware:r231 cpe:/o:cisco:nexus_5000_firmware:7.0%280%29hsk%280.357%29 cpe:/o:cisco:nexus_5000_firmware:8.1%280.2%29s0 cpe:/o:cisco:nexus_5000_firmware:8.8%280.1%29 cpe:/o:cisco:nexus_7000_firmware:8.0%281%29 cpe:/o:cisco:nexus_9000_firmware:8.1%280%29bd%280.20%29 cpe:/o:cisco:nexus_9000_firmware:8.1%281%29s5 cpe:/o:cisco:unified_computing_system_firmware:3.1%283a%29a cpe:/o:cisco:unified_computing_system_firmware:7.0%280%29hsk%280.357%29

CVE-2018-0305

2018-06-21T07:29:00.477-04:00

2019-10-09T19:31:42.490-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1041169 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-fx-os-fabric-dos A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the affected device. The vulnerability exists because the affected software insufficiently validates Cisco Fabric Services packets. An attacker could exploit this vulnerability by sending a crafted Cisco Fabric Services packet to an affected device. A successful exploit could allow the attacker to force a NULL pointer dereference and cause a DoS condition. This vulnerability affects the following if configured to use Cisco Fabric Services: Firepower 4100 Series Next-Generation Firewalls, Firepower 9300 Security Appliance, MDS 9000 Series Multilayer Switches, Nexus 2000 Series Fabric Extenders, Nexus 3000 Series Switches, Nexus 3500 Platform Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Switches in standalone NX-OS mode, Nexus 9500 R-Series Line Cards and Fabric Modules, UCS 6100 Series Fabric Interconnects, UCS 6200 Series Fabric Interconnects, UCS 6300 Series Fabric Interconnects. Cisco Bug IDs: CSCvd69966, CSCve02435, CSCve04859, CSCve41590, CSCve41593, CSCve41601.

cpe:/o:cisco:nx-os:- cpe:/o:cisco:nx-os:1.0%281.110a%29 cpe:/o:cisco:nx-os:1.0%281e%29 cpe:/o:cisco:nx-os:1.1%281g%29 cpe:/o:cisco:nx-os:2.3 cpe:/o:cisco:nx-os:2.3.1.130 cpe:/o:cisco:nx-os:2.4 cpe:/o:cisco:nx-os:2.4.1.122 cpe:/o:cisco:nx-os:4.0 cpe:/o:cisco:nx-os:4.0%280%29n1%281a%29 cpe:/o:cisco:nx-os:4.0%280%29n1%282%29 cpe:/o:cisco:nx-os:4.0%280%29n1%282a%29 cpe:/o:cisco:nx-os:4.0%281a%29n1%281%29 cpe:/o:cisco:nx-os:4.0%281a%29n1%281a%29 cpe:/o:cisco:nx-os:4.0%281a%29n2%281%29 cpe:/o:cisco:nx-os:4.0%281a%29n2%281a%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%281%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%282%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%283%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%283a%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%283b%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%283c%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%283d%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281b%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281c%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281d%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281e%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281f%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281g%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281h%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281i%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281j%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281k%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281m%29 cpe:/o:cisco:nx-os:4.1%283%29n1%281%29 cpe:/o:cisco:nx-os:4.1%283%29n1%281a%29 cpe:/o:cisco:nx-os:4.1%283%29n2%281%29 cpe:/o:cisco:nx-os:4.1%283%29n2%281a%29 cpe:/o:cisco:nx-os:4.1.%282%29 cpe:/o:cisco:nx-os:4.1.%283%29 cpe:/o:cisco:nx-os:4.1.%284%29 cpe:/o:cisco:nx-os:4.1.%285%29 cpe:/o:cisco:nx-os:4.2 cpe:/o:cisco:nx-os:4.2%281%29 cpe:/o:cisco:nx-os:4.2%281%29n1%281%29 cpe:/o:cisco:nx-os:4.2%281%29n2%281%29 cpe:/o:cisco:nx-os:4.2%281%29n2%281a%29 cpe:/o:cisco:nx-os:4.2%281%29sv1%284%29 cpe:/o:cisco:nx-os:4.2%281%29sv1%284a%29 cpe:/o:cisco:nx-os:4.2%281%29sv1%285.1%29 cpe:/o:cisco:nx-os:4.2%282%29 cpe:/o:cisco:nx-os:4.2%283%29 cpe:/o:cisco:nx-os:4.2%284%29 cpe:/o:cisco:nx-os:4.2%286%29 cpe:/o:cisco:nx-os:4.2%288%29 cpe:/o:cisco:nx-os:4.2.%282a%29 cpe:/o:cisco:nx-os:5.0 cpe:/o:cisco:nx-os:5.0%282%29 cpe:/o:cisco:nx-os:5.0%282%29n1%281%29 cpe:/o:cisco:nx-os:5.0%282%29n2%281%29 cpe:/o:cisco:nx-os:5.0%282%29n2%281a%29 cpe:/o:cisco:nx-os:5.0%282a%29 cpe:/o:cisco:nx-os:5.0%283%29 cpe:/o:cisco:nx-os:5.0%283%29n1%281%29 cpe:/o:cisco:nx-os:5.0%283%29n1%281a%29 cpe:/o:cisco:nx-os:5.0%283%29n1%281b%29 cpe:/o:cisco:nx-os:5.0%283%29n1%281c%29 cpe:/o:cisco:nx-os:5.0%283%29n2%281%29 cpe:/o:cisco:nx-os:5.0%283%29n2%282%29 cpe:/o:cisco:nx-os:5.0%283%29n2%282a%29 cpe:/o:cisco:nx-os:5.0%283%29n2%282b%29 cpe:/o:cisco:nx-os:5.0%283%29u1%281%29 cpe:/o:cisco:nx-os:5.0%283%29u1%281a%29 cpe:/o:cisco:nx-os:5.0%283%29u1%281b%29 cpe:/o:cisco:nx-os:5.0%283%29u1%281d%29 cpe:/o:cisco:nx-os:5.0%283%29u1%282%29 cpe:/o:cisco:nx-os:5.0%283%29u1%282a%29 cpe:/o:cisco:nx-os:5.0%283%29u2%281%29 cpe:/o:cisco:nx-os:5.0%283%29u2%282%29 cpe:/o:cisco:nx-os:5.0%283%29u2%282a%29 cpe:/o:cisco:nx-os:5.0%283%29u2%282b%29 cpe:/o:cisco:nx-os:5.0%283%29u2%282c%29 cpe:/o:cisco:nx-os:5.0%283%29u2%282d%29 cpe:/o:cisco:nx-os:5.0%283%29u3%281%29 cpe:/o:cisco:nx-os:5.0%283%29u3%282%29 cpe:/o:cisco:nx-os:5.0%283%29u3%282a%29 cpe:/o:cisco:nx-os:5.0%283%29u3%282b%29 cpe:/o:cisco:nx-os:5.0%283%29u4%281%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281a%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281b%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281c%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281d%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281e%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281f%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281g%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281h%29 cpe:/o:cisco:nx-os:5.0%285%29 cpe:/o:cisco:nx-os:5.1 cpe:/o:cisco:nx-os:5.1%281%29 cpe:/o:cisco:nx-os:5.1%281a%29 cpe:/o:cisco:nx-os:5.1%282%29 cpe:/o:cisco:nx-os:5.1%283%29 cpe:/o:cisco:nx-os:5.1%283%29n1%281%29 cpe:/o:cisco:nx-os:5.1%283%29n1%281a%29 cpe:/o:cisco:nx-os:5.1%283%29n2%281%29 cpe:/o:cisco:nx-os:5.1%283%29n2%281a%29 cpe:/o:cisco:nx-os:5.1%283%29n2%281b%29 cpe:/o:cisco:nx-os:5.1%283%29n2%281c%29 cpe:/o:cisco:nx-os:5.1%284%29 cpe:/o:cisco:nx-os:5.1%285%29 cpe:/o:cisco:nx-os:5.1%286%29 cpe:/o:cisco:nx-os:5.1.3 cpe:/o:cisco:nx-os:5.2 cpe:/o:cisco:nx-os:5.2%281%29 cpe:/o:cisco:nx-os:5.2%281%29n1%281%29 cpe:/o:cisco:nx-os:5.2%281%29n1%281a%29 cpe:/o:cisco:nx-os:5.2%281%29n1%281b%29 cpe:/o:cisco:nx-os:5.2%281%29n1%282%29 cpe:/o:cisco:nx-os:5.2%281%29n1%282a%29 cpe:/o:cisco:nx-os:5.2%281%29n1%283%29 cpe:/o:cisco:nx-os:5.2%281%29n1%284%29 cpe:/o:cisco:nx-os:5.2%281%29n1%285%29 cpe:/o:cisco:nx-os:5.2%281%29n1%286%29 cpe:/o:cisco:nx-os:5.2%281%29n1%287%29 cpe:/o:cisco:nx-os:5.2%281%29n1%288%29 cpe:/o:cisco:nx-os:5.2%281%29n1%288a%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.1%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.3%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.5a%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.5b%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.6%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.10%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%282.8%29 cpe:/o:cisco:nx-os:5.2%283%29 cpe:/o:cisco:nx-os:5.2%283a%29 cpe:/o:cisco:nx-os:5.2%284%29 cpe:/o:cisco:nx-os:5.2%285%29 cpe:/o:cisco:nx-os:5.2%287%29 cpe:/o:cisco:nx-os:5.2%289%29 cpe:/o:cisco:nx-os:5.2%289%29n1%281%29 cpe:/o:cisco:nx-os:5.3.0 cpe:/o:cisco:nx-os:6.0%281%29 cpe:/o:cisco:nx-os:6.0%282%29 cpe:/o:cisco:nx-os:6.0%282%29a6%281%29 cpe:/o:cisco:nx-os:6.0%282%29a6%282%29 cpe:/o:cisco:nx-os:6.0%282%29a6%283%29 cpe:/o:cisco:nx-os:6.0%282%29a6%284%29 cpe:/o:cisco:nx-os:6.0%282%29a6%285%29 cpe:/o:cisco:nx-os:6.0%282%29a6%286%29 cpe:/o:cisco:nx-os:6.0%282%29a6%287%29 cpe:/o:cisco:nx-os:6.0%282%29a6%288%29 cpe:/o:cisco:nx-os:6.0%282%29a7%281%29 cpe:/o:cisco:nx-os:6.0%282%29a7%282%29 cpe:/o:cisco:nx-os:6.0%282%29a7%282a%29 cpe:/o:cisco:nx-os:6.0%282%29a8%282%29 cpe:/o:cisco:nx-os:6.0%282%29a8%283%29 cpe:/o:cisco:nx-os:6.0%282%29n1%281%29 cpe:/o:cisco:nx-os:6.0%282%29n1%282%29 cpe:/o:cisco:nx-os:6.0%282%29n1%282a%29 cpe:/o:cisco:nx-os:6.0%282%29n2%281%29 cpe:/o:cisco:nx-os:6.0%282%29n2%281b%29 cpe:/o:cisco:nx-os:6.0%282%29n2%282%29 cpe:/o:cisco:nx-os:6.0%282%29n2%283%29 cpe:/o:cisco:nx-os:6.0%282%29n2%284%29 cpe:/o:cisco:nx-os:6.0%282%29n2%285%29 cpe:/o:cisco:nx-os:6.0%282%29n2%285a%29 cpe:/o:cisco:nx-os:6.0%282%29n2%286%29 cpe:/o:cisco:nx-os:6.0%282%29n2%287%29 cpe:/o:cisco:nx-os:6.0%282%29u1%281%29 cpe:/o:cisco:nx-os:6.0%282%29u1%281a%29 cpe:/o:cisco:nx-os:6.0%282%29u1%282%29 cpe:/o:cisco:nx-os:6.0%282%29u1%283%29 cpe:/o:cisco:nx-os:6.0%282%29u1%284%29 cpe:/o:cisco:nx-os:6.0%282%29u2%281%29 cpe:/o:cisco:nx-os:6.0%282%29u2%282%29 cpe:/o:cisco:nx-os:6.0%282%29u2%283%29 cpe:/o:cisco:nx-os:6.0%282%29u2%284%29 cpe:/o:cisco:nx-os:6.0%282%29u2%285%29 cpe:/o:cisco:nx-os:6.0%282%29u2%286%29 cpe:/o:cisco:nx-os:6.0%282%29u3%281%29 cpe:/o:cisco:nx-os:6.0%282%29u3%282%29 cpe:/o:cisco:nx-os:6.0%282%29u3%283%29 cpe:/o:cisco:nx-os:6.0%282%29u3%284%29 cpe:/o:cisco:nx-os:6.0%282%29u3%285%29 cpe:/o:cisco:nx-os:6.0%282%29u4%281%29 cpe:/o:cisco:nx-os:6.0%282%29u4%282%29 cpe:/o:cisco:nx-os:6.0%282%29u4%283%29 cpe:/o:cisco:nx-os:6.0%282%29u5%281%29 cpe:/o:cisco:nx-os:6.0%282%29u5%281.41%29 cpe:/o:cisco:nx-os:6.0%282%29u5%282%29 cpe:/o:cisco:nx-os:6.0%282%29u5%283%29 cpe:/o:cisco:nx-os:6.0%282%29u5%284%29 cpe:/o:cisco:nx-os:6.0%282%29u6%281%29 cpe:/o:cisco:nx-os:6.0%282%29u6%282%29 cpe:/o:cisco:nx-os:6.0%282%29u6%283%29 cpe:/o:cisco:nx-os:6.0%282%29u6%284%29 cpe:/o:cisco:nx-os:6.0%282%29u6%285%29 cpe:/o:cisco:nx-os:6.0%282%29u6%286%29 cpe:/o:cisco:nx-os:6.0%282%29u6%287%29 cpe:/o:cisco:nx-os:6.0%282%29u6%288%29 cpe:/o:cisco:nx-os:6.0%283%29 cpe:/o:cisco:nx-os:6.0%284%29 cpe:/o:cisco:nx-os:6.1 cpe:/o:cisco:nx-os:6.1%281%29 cpe:/o:cisco:nx-os:6.1%282%29 cpe:/o:cisco:nx-os:6.1%282%29i2%282%29 cpe:/o:cisco:nx-os:6.1%282%29i2%282a%29 cpe:/o:cisco:nx-os:6.1%282%29i2%282b%29 cpe:/o:cisco:nx-os:6.1%282%29i2%283%29 cpe:/o:cisco:nx-os:6.1%282%29i3%281%29 cpe:/o:cisco:nx-os:6.1%282%29i3%282%29 cpe:/o:cisco:nx-os:6.1%282%29i3%283%29 cpe:/o:cisco:nx-os:6.1%282%29i3%283.78%29 cpe:/o:cisco:nx-os:6.1%282%29i3%284%29 cpe:/o:cisco:nx-os:6.1%283%29 cpe:/o:cisco:nx-os:6.1%284%29 cpe:/o:cisco:nx-os:6.1%284a%29 cpe:/o:cisco:nx-os:6.1%285%29 cpe:/o:cisco:nx-os:6.2%281%29 cpe:/o:cisco:nx-os:6.2%281n%29 cpe:/o:cisco:nx-os:6.2%282%29 cpe:/o:cisco:nx-os:6.2%282a%29 cpe:/o:cisco:nx-os:6.2%283%29 cpe:/o:cisco:nx-os:6.2%283n%29 cpe:/o:cisco:nx-os:6.2%285%29 cpe:/o:cisco:nx-os:6.2%285a%29 cpe:/o:cisco:nx-os:6.2%286%29 cpe:/o:cisco:nx-os:6.2%286b%29 cpe:/o:cisco:nx-os:6.2%287%29 cpe:/o:cisco:nx-os:6.2%288%29 cpe:/o:cisco:nx-os:6.2%288a%29 cpe:/o:cisco:nx-os:6.2%288b%29 cpe:/o:cisco:nx-os:6.2%2810%29 cpe:/o:cisco:nx-os:6.2%2811b%29 cpe:/o:cisco:nx-os:6.2%2812%29 cpe:/o:cisco:nx-os:6.2%2814%29s1 cpe:/o:cisco:nx-os:7.0%280%29n1%281%29 cpe:/o:cisco:nx-os:7.0%281%29n1%281%29 cpe:/o:cisco:nx-os:7.0%281%29n1%283%29 cpe:/o:cisco:nx-os:7.0%282%29n1%281%29 cpe:/o:cisco:nx-os:7.0%283%29 cpe:/o:cisco:nx-os:7.0%283%29i1%281a%29 cpe:/o:cisco:nx-os:7.0%283%29i1%281b%29 cpe:/o:cisco:nx-os:7.0%283%29i1%282%29 cpe:/o:cisco:nx-os:7.0%283%29i2%280.373%29 cpe:/o:cisco:nx-os:7.0%283%29i7 cpe:/o:cisco:nx-os:7.0%283%29n1%281%29 cpe:/o:cisco:nx-os:7.0%284%29n1%281%29 cpe:/o:cisco:nx-os:7.0%285%29n1%281%29 cpe:/o:cisco:nx-os:7.0%285%29n1%281a%29 cpe:/o:cisco:nx-os:7.0%286%29n1%281%29 cpe:/o:cisco:nx-os:7.0%287%29n1%281%29 cpe:/o:cisco:nx-os:7.0%288%29n1%281%29 cpe:/o:cisco:nx-os:7.1%280%29n1%281a%29 cpe:/o:cisco:nx-os:7.1%280%29n1%281b%29 cpe:/o:cisco:nx-os:7.1%281%29n1%281%29 cpe:/o:cisco:nx-os:7.1%282%29n1%281%29 cpe:/o:cisco:nx-os:7.1%283%29n1%281%29 cpe:/o:cisco:nx-os:7.1%283%29n1%282%29 cpe:/o:cisco:nx-os:7.1%283%29n1%282.1%29 cpe:/o:cisco:nx-os:7.1%283%29n1%283.12%29 cpe:/o:cisco:nx-os:7.1%284%29n1%281%29 cpe:/o:cisco:nx-os:7.2%280%29n1%280.1%29 cpe:/o:cisco:nx-os:7.2%280%29n1%281%29 cpe:/o:cisco:nx-os:7.2%280%29zz%2899.1%29 cpe:/o:cisco:nx-os:7.2%280%29zz%2899.3%29 cpe:/o:cisco:nx-os:7.2%281%29n1%281%29 cpe:/o:cisco:nx-os:7.3 cpe:/o:cisco:nx-os:7.3%280%29n1%281%29 cpe:/o:cisco:nx-os:7.3%280%29zn%280.9%29 cpe:/o:cisco:nx-os:7.3%280%29zn%280.81%29 cpe:/o:cisco:nx-os:7.3%280%29zn%280.83%29 cpe:/o:cisco:nx-os:7.3%282%29n1%280.296%29 cpe:/o:cisco:nx-os:7.3%282%29n1%280.395%29 cpe:/o:cisco:nx-os:8.0 cpe:/o:cisco:nx-os:8.0%281%29s2 cpe:/o:cisco:nx-os:8.1 cpe:/o:cisco:nx-os:8.1%280%29bd%280.20%29 cpe:/o:cisco:nx-os:8.1%280.2%29s0 cpe:/o:cisco:nx-os:8.1%280.59%29s0 cpe:/o:cisco:nx-os:8.1%280.112%29s0 cpe:/o:cisco:nx-os:8.1%281%29 cpe:/o:cisco:nx-os:8.1%281%29s5

CVE-2018-0306

2018-06-21T07:29:00.523-04:00

2019-10-09T19:31:42.693-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1041169 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-nx-os-cli-execution A vulnerability in the CLI parser of Cisco NX-OS Software could allow an authenticated, local attacker to perform a command-injection attack on an affected device. The vulnerability is due to insufficient input validation of command arguments. An attacker could exploit this vulnerability by injecting malicious command arguments into a vulnerable CLI command. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the affected device. Note: This vulnerability requires that any feature license is uploaded to the device. The vulnerability does not require that the license be used. This vulnerability affects MDS 9000 Series Multilayer Switches, Nexus 1000V Series Switches, Nexus 1100 Series Cloud Services Platforms, Nexus 2000 Series Fabric Extenders, Nexus 3000 Series Switches, Nexus 3500 Platform Switches, Nexus 3600 Platform Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Switches in standalone NX-OS mode, Nexus 9500 R-Series Line Cards and Fabric Modules. Cisco Bug IDs: CSCve51693, CSCve91634, CSCve91659, CSCve91663.

CVE-2018-0307

2018-06-20T17:29:00.577-04:00

2019-10-09T19:31:43.007-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1041169 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-nx-os-cli-injection A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to perform a command-injection attack on an affected device. The vulnerability is due to insufficient input validation of command arguments. An attacker could exploit this vulnerability by injecting malicious command arguments into a vulnerable CLI command. A successful exploit could allow the attacker, authenticated as a privileged user, to execute arbitrary commands with root privileges. Note: On products that support multiple virtual device contexts (VDC), this vulnerability could allow an attacker to access files from any VDC. This vulnerability affects Nexus 2000 Series Fabric Extenders, Nexus 3000 Series Switches, Nexus 3500 Platform Switches, Nexus 3600 Platform Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Switches in standalone NX-OS mode, Nexus 9500 R-Series Line Cards and Fabric Modules. Cisco Bug IDs: CSCve51704, CSCve91749, CSCve91768.

CVE-2018-0308

2018-06-20T17:29:00.623-04:00

2019-10-09T19:31:43.240-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 104514 SECTRACK 1041169 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-fxnxos-fab-ace A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition. The vulnerability exists because the affected software insufficiently validates header values in Cisco Fabric Services packets. An attacker could exploit this vulnerability by sending a crafted Cisco Fabric Services packet to an affected device. A successful exploit could allow the attacker to cause a buffer overflow that could allow the attacker to execute arbitrary code or cause a DoS condition. This vulnerability affects the following if configured to use Cisco Fabric Services: Firepower 4100 Series Next-Generation Firewalls, Firepower 9300 Security Appliance, MDS 9000 Series Multilayer Switches, Nexus 2000 Series Fabric Extenders, Nexus 3000 Series Switches, Nexus 3500 Platform Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Switches in standalone NX-OS mode, Nexus 9500 R-Series Line Cards and Fabric Modules, UCS 6100 Series Fabric Interconnects, UCS 6200 Series Fabric Interconnects, UCS 6300 Series Fabric Interconnects. Cisco Bug IDs: CSCvd69954, CSCve02463, CSCve02785, CSCve02787, CSCve02804, CSCve04859.

cpe:/o:cisco:nx-os:7.0%283%29i5%282%29 cpe:/o:cisco:nx-os:7.0%283%29i6%281%29

CVE-2018-0309

2018-06-21T07:29:00.570-04:00

2019-10-09T19:31:43.427-04:00

6.8

NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1041169 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-n3k-n9k-clisnmp A vulnerability in the implementation of a specific CLI command and the associated Simple Network Management Protocol (SNMP) MIB for Cisco NX-OS (in standalone NX-OS mode) on Cisco Nexus 3000 and 9000 Series Switches could allow an authenticated, remote attacker to exhaust system memory on an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to the incorrect implementation of the CLI command, resulting in a failure to free all allocated memory upon completion. An attacker could exploit this vulnerability by authenticating to the affected device and repeatedly issuing a specific CLI command or sending a specific SNMP poll request for a specific Object Identifier (OID). A successful exploit could allow the attacker to cause the IP routing process to restart or to cause a device reset, resulting in a DoS condition. Cisco Bug IDs: CSCvf23136.

CVE-2018-0310

2018-06-21T07:29:00.617-04:00

2019-10-09T19:31:43.613-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1041169 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-nx-os-fabric-dos A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to obtain sensitive information from memory or cause a denial of service (DoS) condition on the affected product. The vulnerability exists because the affected software insufficiently validates header values in Cisco Fabric Services packets. An attacker could exploit this vulnerability by sending a crafted Cisco Fabric Services packet to an affected device. A successful exploit could allow the attacker to cause a buffer overread condition, which could allow the attacker to obtain sensitive information from memory or cause a DoS condition on the affected product. This vulnerability affects Firepower 4100 Series Next-Generation Firewalls, Firepower 9300 Security Appliance, MDS 9000 Series Multilayer Switches, Nexus 2000 Series Fabric Extenders, Nexus 3000 Series Switches, Nexus 3500 Platform Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Switches in standalone NX-OS mode, Nexus 9500 R-Series Line Cards and Fabric Modules, UCS 6100 Series Fabric Interconnects, UCS 6200 Series Fabric Interconnects, UCS 6300 Series Fabric Interconnects. Cisco Bug IDs: CSCvd69957, CSCve02435, CSCve04859, CSCve41536, CSCve41538, CSCve41559.

cpe:/o:cisco:nx-os:- cpe:/o:cisco:nx-os:1.0%281.110a%29 cpe:/o:cisco:nx-os:1.0%281e%29 cpe:/o:cisco:nx-os:1.1%281g%29 cpe:/o:cisco:nx-os:2.3 cpe:/o:cisco:nx-os:2.3.1.130 cpe:/o:cisco:nx-os:2.4 cpe:/o:cisco:nx-os:2.4.1.122 cpe:/o:cisco:nx-os:4.0 cpe:/o:cisco:nx-os:4.0%280%29n1%281a%29 cpe:/o:cisco:nx-os:4.0%280%29n1%282%29 cpe:/o:cisco:nx-os:4.0%280%29n1%282a%29 cpe:/o:cisco:nx-os:4.0%281a%29n1%281%29 cpe:/o:cisco:nx-os:4.0%281a%29n1%281a%29 cpe:/o:cisco:nx-os:4.0%281a%29n2%281%29 cpe:/o:cisco:nx-os:4.0%281a%29n2%281a%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%281%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%282%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%283%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%283a%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%283b%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%283c%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%283d%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281b%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281c%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281d%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281e%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281f%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281g%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281h%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281i%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281j%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281k%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281m%29 cpe:/o:cisco:nx-os:4.1%283%29n1%281%29 cpe:/o:cisco:nx-os:4.1%283%29n1%281a%29 cpe:/o:cisco:nx-os:4.1%283%29n2%281%29 cpe:/o:cisco:nx-os:4.1%283%29n2%281a%29 cpe:/o:cisco:nx-os:4.1.%282%29 cpe:/o:cisco:nx-os:4.1.%283%29 cpe:/o:cisco:nx-os:4.1.%284%29 cpe:/o:cisco:nx-os:4.1.%285%29 cpe:/o:cisco:nx-os:4.2 cpe:/o:cisco:nx-os:4.2%281%29 cpe:/o:cisco:nx-os:4.2%281%29n1%281%29 cpe:/o:cisco:nx-os:4.2%281%29n2%281%29 cpe:/o:cisco:nx-os:4.2%281%29n2%281a%29 cpe:/o:cisco:nx-os:4.2%281%29sv1%284%29 cpe:/o:cisco:nx-os:4.2%281%29sv1%284a%29 cpe:/o:cisco:nx-os:4.2%281%29sv1%285.1%29 cpe:/o:cisco:nx-os:4.2%282%29 cpe:/o:cisco:nx-os:4.2%283%29 cpe:/o:cisco:nx-os:4.2%284%29 cpe:/o:cisco:nx-os:4.2%286%29 cpe:/o:cisco:nx-os:4.2%288%29 cpe:/o:cisco:nx-os:4.2.%282a%29 cpe:/o:cisco:nx-os:5.0 cpe:/o:cisco:nx-os:5.0%282%29 cpe:/o:cisco:nx-os:5.0%282%29n1%281%29 cpe:/o:cisco:nx-os:5.0%282%29n2%281%29 cpe:/o:cisco:nx-os:5.0%282%29n2%281a%29 cpe:/o:cisco:nx-os:5.0%282a%29 cpe:/o:cisco:nx-os:5.0%283%29 cpe:/o:cisco:nx-os:5.0%283%29n1%281%29 cpe:/o:cisco:nx-os:5.0%283%29n1%281a%29 cpe:/o:cisco:nx-os:5.0%283%29n1%281b%29 cpe:/o:cisco:nx-os:5.0%283%29n1%281c%29 cpe:/o:cisco:nx-os:5.0%283%29n2%281%29 cpe:/o:cisco:nx-os:5.0%283%29n2%282%29 cpe:/o:cisco:nx-os:5.0%283%29n2%282a%29 cpe:/o:cisco:nx-os:5.0%283%29n2%282b%29 cpe:/o:cisco:nx-os:5.0%283%29u1%281%29 cpe:/o:cisco:nx-os:5.0%283%29u1%281a%29 cpe:/o:cisco:nx-os:5.0%283%29u1%281b%29 cpe:/o:cisco:nx-os:5.0%283%29u1%281d%29 cpe:/o:cisco:nx-os:5.0%283%29u1%282%29 cpe:/o:cisco:nx-os:5.0%283%29u1%282a%29 cpe:/o:cisco:nx-os:5.0%283%29u2%281%29 cpe:/o:cisco:nx-os:5.0%283%29u2%282%29 cpe:/o:cisco:nx-os:5.0%283%29u2%282a%29 cpe:/o:cisco:nx-os:5.0%283%29u2%282b%29 cpe:/o:cisco:nx-os:5.0%283%29u2%282c%29 cpe:/o:cisco:nx-os:5.0%283%29u2%282d%29 cpe:/o:cisco:nx-os:5.0%283%29u3%281%29 cpe:/o:cisco:nx-os:5.0%283%29u3%282%29 cpe:/o:cisco:nx-os:5.0%283%29u3%282a%29 cpe:/o:cisco:nx-os:5.0%283%29u3%282b%29 cpe:/o:cisco:nx-os:5.0%283%29u4%281%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281a%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281b%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281c%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281d%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281e%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281f%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281g%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281h%29 cpe:/o:cisco:nx-os:5.0%285%29 cpe:/o:cisco:nx-os:5.1 cpe:/o:cisco:nx-os:5.1%281%29 cpe:/o:cisco:nx-os:5.1%281a%29 cpe:/o:cisco:nx-os:5.1%282%29 cpe:/o:cisco:nx-os:5.1%283%29 cpe:/o:cisco:nx-os:5.1%283%29n1%281%29 cpe:/o:cisco:nx-os:5.1%283%29n1%281a%29 cpe:/o:cisco:nx-os:5.1%283%29n2%281%29 cpe:/o:cisco:nx-os:5.1%283%29n2%281a%29 cpe:/o:cisco:nx-os:5.1%283%29n2%281b%29 cpe:/o:cisco:nx-os:5.1%283%29n2%281c%29 cpe:/o:cisco:nx-os:5.1%284%29 cpe:/o:cisco:nx-os:5.1%285%29 cpe:/o:cisco:nx-os:5.1%286%29 cpe:/o:cisco:nx-os:5.1.3 cpe:/o:cisco:nx-os:5.2 cpe:/o:cisco:nx-os:5.2%281%29 cpe:/o:cisco:nx-os:5.2%281%29n1%281%29 cpe:/o:cisco:nx-os:5.2%281%29n1%281a%29 cpe:/o:cisco:nx-os:5.2%281%29n1%281b%29 cpe:/o:cisco:nx-os:5.2%281%29n1%282%29 cpe:/o:cisco:nx-os:5.2%281%29n1%282a%29 cpe:/o:cisco:nx-os:5.2%281%29n1%283%29 cpe:/o:cisco:nx-os:5.2%281%29n1%284%29 cpe:/o:cisco:nx-os:5.2%281%29n1%285%29 cpe:/o:cisco:nx-os:5.2%281%29n1%286%29 cpe:/o:cisco:nx-os:5.2%281%29n1%287%29 cpe:/o:cisco:nx-os:5.2%281%29n1%288%29 cpe:/o:cisco:nx-os:5.2%281%29n1%288a%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.1%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.3%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.5a%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.5b%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.6%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.10%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%282.8%29 cpe:/o:cisco:nx-os:5.2%283%29 cpe:/o:cisco:nx-os:5.2%283a%29 cpe:/o:cisco:nx-os:5.2%284%29 cpe:/o:cisco:nx-os:5.2%285%29 cpe:/o:cisco:nx-os:5.2%287%29 cpe:/o:cisco:nx-os:5.2%289%29 cpe:/o:cisco:nx-os:5.2%289%29n1%281%29 cpe:/o:cisco:nx-os:5.3.0 cpe:/o:cisco:nx-os:6.0%281%29 cpe:/o:cisco:nx-os:6.0%282%29 cpe:/o:cisco:nx-os:6.0%282%29a6%281%29 cpe:/o:cisco:nx-os:6.0%282%29a6%282%29 cpe:/o:cisco:nx-os:6.0%282%29a6%283%29 cpe:/o:cisco:nx-os:6.0%282%29a6%284%29 cpe:/o:cisco:nx-os:6.0%282%29a6%285%29 cpe:/o:cisco:nx-os:6.0%282%29a6%286%29 cpe:/o:cisco:nx-os:6.0%282%29a6%287%29 cpe:/o:cisco:nx-os:6.0%282%29a6%288%29 cpe:/o:cisco:nx-os:6.0%282%29a7%281%29 cpe:/o:cisco:nx-os:6.0%282%29a7%282%29 cpe:/o:cisco:nx-os:6.0%282%29a7%282a%29 cpe:/o:cisco:nx-os:6.0%282%29a8%282%29 cpe:/o:cisco:nx-os:6.0%282%29a8%289%29 cpe:/o:cisco:nx-os:6.0%282%29n1%281%29 cpe:/o:cisco:nx-os:6.0%282%29n1%282%29 cpe:/o:cisco:nx-os:6.0%282%29n1%282a%29 cpe:/o:cisco:nx-os:6.0%282%29n2%281%29 cpe:/o:cisco:nx-os:6.0%282%29n2%281b%29 cpe:/o:cisco:nx-os:6.0%282%29n2%282%29 cpe:/o:cisco:nx-os:6.0%282%29n2%283%29 cpe:/o:cisco:nx-os:6.0%282%29n2%284%29 cpe:/o:cisco:nx-os:6.0%282%29n2%285%29 cpe:/o:cisco:nx-os:6.0%282%29n2%285a%29 cpe:/o:cisco:nx-os:6.0%282%29n2%286%29 cpe:/o:cisco:nx-os:6.0%282%29n2%287%29 cpe:/o:cisco:nx-os:6.0%282%29u1%281%29 cpe:/o:cisco:nx-os:6.0%282%29u1%281a%29 cpe:/o:cisco:nx-os:6.0%282%29u1%282%29 cpe:/o:cisco:nx-os:6.0%282%29u1%283%29 cpe:/o:cisco:nx-os:6.0%282%29u1%284%29 cpe:/o:cisco:nx-os:6.0%282%29u2%281%29 cpe:/o:cisco:nx-os:6.0%282%29u2%282%29 cpe:/o:cisco:nx-os:6.0%282%29u2%283%29 cpe:/o:cisco:nx-os:6.0%282%29u2%284%29 cpe:/o:cisco:nx-os:6.0%282%29u2%285%29 cpe:/o:cisco:nx-os:6.0%282%29u2%286%29 cpe:/o:cisco:nx-os:6.0%282%29u3%281%29 cpe:/o:cisco:nx-os:6.0%282%29u3%282%29 cpe:/o:cisco:nx-os:6.0%282%29u3%283%29 cpe:/o:cisco:nx-os:6.0%282%29u3%284%29 cpe:/o:cisco:nx-os:6.0%282%29u3%285%29 cpe:/o:cisco:nx-os:6.0%282%29u4%281%29 cpe:/o:cisco:nx-os:6.0%282%29u4%282%29 cpe:/o:cisco:nx-os:6.0%282%29u4%283%29 cpe:/o:cisco:nx-os:6.0%282%29u5%281%29 cpe:/o:cisco:nx-os:6.0%282%29u5%281.41%29 cpe:/o:cisco:nx-os:6.0%282%29u5%282%29 cpe:/o:cisco:nx-os:6.0%282%29u5%283%29 cpe:/o:cisco:nx-os:6.0%282%29u5%284%29 cpe:/o:cisco:nx-os:6.0%282%29u6%281%29 cpe:/o:cisco:nx-os:6.0%282%29u6%282%29 cpe:/o:cisco:nx-os:6.0%282%29u6%283%29 cpe:/o:cisco:nx-os:6.0%282%29u6%284%29 cpe:/o:cisco:nx-os:6.0%282%29u6%285%29 cpe:/o:cisco:nx-os:6.0%282%29u6%286%29 cpe:/o:cisco:nx-os:6.0%282%29u6%287%29 cpe:/o:cisco:nx-os:6.0%282%29u6%288%29 cpe:/o:cisco:nx-os:6.0%283%29 cpe:/o:cisco:nx-os:6.0%284%29 cpe:/o:cisco:nx-os:6.1 cpe:/o:cisco:nx-os:6.1%281%29 cpe:/o:cisco:nx-os:6.1%282%29 cpe:/o:cisco:nx-os:6.1%282%29i2%282%29 cpe:/o:cisco:nx-os:6.1%282%29i2%282a%29 cpe:/o:cisco:nx-os:6.1%282%29i2%282b%29 cpe:/o:cisco:nx-os:6.1%282%29i2%283%29 cpe:/o:cisco:nx-os:6.1%282%29i3%281%29 cpe:/o:cisco:nx-os:6.1%282%29i3%282%29 cpe:/o:cisco:nx-os:6.1%282%29i3%283%29 cpe:/o:cisco:nx-os:6.1%282%29i3%283.78%29 cpe:/o:cisco:nx-os:6.1%282%29i3%284%29 cpe:/o:cisco:nx-os:6.1%283%29 cpe:/o:cisco:nx-os:6.1%284%29 cpe:/o:cisco:nx-os:6.1%284a%29 cpe:/o:cisco:nx-os:6.1%285%29 cpe:/o:cisco:nx-os:6.2%281%29 cpe:/o:cisco:nx-os:6.2%281n%29 cpe:/o:cisco:nx-os:6.2%282%29 cpe:/o:cisco:nx-os:6.2%282a%29 cpe:/o:cisco:nx-os:6.2%283%29 cpe:/o:cisco:nx-os:6.2%283n%29 cpe:/o:cisco:nx-os:6.2%285%29 cpe:/o:cisco:nx-os:6.2%285a%29 cpe:/o:cisco:nx-os:6.2%286%29 cpe:/o:cisco:nx-os:6.2%286b%29 cpe:/o:cisco:nx-os:6.2%287%29 cpe:/o:cisco:nx-os:6.2%288%29 cpe:/o:cisco:nx-os:6.2%288a%29 cpe:/o:cisco:nx-os:6.2%288b%29 cpe:/o:cisco:nx-os:6.2%2810%29 cpe:/o:cisco:nx-os:6.2%2811b%29 cpe:/o:cisco:nx-os:6.2%2812%29 cpe:/o:cisco:nx-os:6.2%2814%29s1 cpe:/o:cisco:nx-os:7.0%280%29hsk%280.357%29 cpe:/o:cisco:nx-os:7.0%280%29n1%281%29 cpe:/o:cisco:nx-os:7.0%281%29n1%281%29 cpe:/o:cisco:nx-os:7.0%281%29n1%283%29 cpe:/o:cisco:nx-os:7.0%282%29n1%281%29 cpe:/o:cisco:nx-os:7.0%283%29 cpe:/o:cisco:nx-os:7.0%283%29i1%281a%29 cpe:/o:cisco:nx-os:7.0%283%29i1%281b%29 cpe:/o:cisco:nx-os:7.0%283%29i1%282%29 cpe:/o:cisco:nx-os:7.0%283%29i2%280.373%29 cpe:/o:cisco:nx-os:7.0%283%29i4%287%29 cpe:/o:cisco:nx-os:7.0%283%29i6%282%29 cpe:/o:cisco:nx-os:7.0%283%29i7 cpe:/o:cisco:nx-os:7.0%283%29n1%281%29 cpe:/o:cisco:nx-os:7.0%284%29n1%281%29 cpe:/o:cisco:nx-os:7.0%285%29n1%281%29 cpe:/o:cisco:nx-os:7.0%285%29n1%281a%29 cpe:/o:cisco:nx-os:7.0%286%29n1%281%29 cpe:/o:cisco:nx-os:7.0%287%29n1%281%29 cpe:/o:cisco:nx-os:7.0%288%29n1%281%29 cpe:/o:cisco:nx-os:7.1%280%29n1%281a%29 cpe:/o:cisco:nx-os:7.1%280%29n1%281b%29 cpe:/o:cisco:nx-os:7.1%281%29n1%281%29 cpe:/o:cisco:nx-os:7.1%282%29n1%281%29 cpe:/o:cisco:nx-os:7.1%283%29n1%281%29 cpe:/o:cisco:nx-os:7.1%283%29n1%282%29 cpe:/o:cisco:nx-os:7.1%283%29n1%282.1%29 cpe:/o:cisco:nx-os:7.1%283%29n1%283.12%29 cpe:/o:cisco:nx-os:7.1%284%29n1%281%29 cpe:/o:cisco:nx-os:7.2%280%29n1%280.1%29 cpe:/o:cisco:nx-os:7.2%280%29n1%281%29 cpe:/o:cisco:nx-os:7.2%280%29zz%2899.1%29 cpe:/o:cisco:nx-os:7.2%280%29zz%2899.3%29 cpe:/o:cisco:nx-os:7.2%281%29n1%281%29 cpe:/o:cisco:nx-os:7.3 cpe:/o:cisco:nx-os:7.3%280%29n1%281%29 cpe:/o:cisco:nx-os:7.3%280%29zn%280.9%29 cpe:/o:cisco:nx-os:7.3%280%29zn%280.81%29 cpe:/o:cisco:nx-os:7.3%280%29zn%280.83%29 cpe:/o:cisco:nx-os:7.3%282%29n1%280.296%29 cpe:/o:cisco:nx-os:7.3%282%29n1%280.395%29 cpe:/o:cisco:nx-os:8.0%281%29 cpe:/o:cisco:nx-os:8.1%280.2%29s0 cpe:/o:cisco:nx-os:8.8%280.1%29 cpe:/o:cisco:nx-os:8.8%283.5%29s0

CVE-2018-0311

2018-06-21T07:29:00.663-04:00

2019-10-09T19:31:43.927-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1041169 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-nx-os-fabric-services-dos A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability exists because the affected software insufficiently validates Cisco Fabric Services packets when the software processes packet data. An attacker could exploit this vulnerability by sending a maliciously crafted Cisco Fabric Services packet to an affected device. A successful exploit could allow the attacker to cause a buffer overflow condition on the device, which could cause process crashes and result in a DoS condition on the device. This vulnerability affects Firepower 4100 Series Next-Generation Firewalls, Firepower 9300 Security Appliance, MDS 9000 Series Multilayer Switches, Nexus 2000 Series Fabric Extenders, Nexus 3000 Series Switches, Nexus 3500 Platform Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Switches in standalone NX-OS mode, Nexus 9500 R-Series Line Cards and Fabric Modules, UCS 6100 Series Fabric Interconnects, UCS 6200 Series Fabric Interconnects, UCS 6300 Series Fabric Interconnects. Cisco Bug IDs: CSCvd69960, CSCve02463, CSCve04859, CSCve41530, CSCve41537, CSCve41541, CSCve41557.

cpe:/o:cisco:firepower_9000_firmware:r211 cpe:/o:cisco:firepower_9000_firmware:r231 cpe:/o:cisco:nexus_5000_firmware:7.0%280%29hsk%280.357%29 cpe:/o:cisco:nexus_7000_firmware:7.3%282%29d1%280.49%29 cpe:/o:cisco:nexus_7000_firmware:8.0%281%29 cpe:/o:cisco:nexus_7000_firmware:8.1%280.112%29s0 cpe:/o:cisco:nexus_9000_firmware:8.1%280%29bd%280.20%29 cpe:/o:cisco:nexus_9000_firmware:8.1%281%29s4 cpe:/o:cisco:unified_computing_system_firmware:3.1%283a%29a

CVE-2018-0312

2018-06-20T17:29:00.670-04:00

2019-10-09T19:31:44.270-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 104515 SECTRACK 1041169 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-fx-os-cli-execution A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition on an affected device. The vulnerability exists because the affected software insufficiently validates Cisco Fabric Services packet headers when the software processes packet data. An attacker could exploit this vulnerability by sending a maliciously crafted Cisco Fabric Services packet to an affected device. A successful exploit could allow the attacker to cause a buffer overflow condition on the device, which could allow the attacker to execute arbitrary code or cause a DoS condition on the device. This vulnerability affects the following if configured to use Cisco Fabric Services: Firepower 4100 Series Next-Generation Firewalls, Firepower 9300 Security Appliance, MDS 9000 Series Multilayer Switches, Nexus 2000 Series Fabric Extenders, Nexus 3000 Series Switches, Nexus 3500 Platform Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Switches in standalone NX-OS mode, Nexus 9500 R-Series Line Cards and Fabric Modules, UCS 6100 Series Fabric Interconnects, UCS 6200 Series Fabric Interconnects, UCS 6300 Series Fabric Interconnects. Cisco Bug IDs: CSCvd69962, CSCve02808, CSCve02810, CSCve02812, CSCve02819, CSCve02822, CSCve02831, CSCve04859.

cpe:/o:cisco:nx-os:- cpe:/o:cisco:nx-os:7.0%280%29hsk%280.357%29 cpe:/o:cisco:nx-os:8.0%281%29s20 cpe:/o:cisco:nx-os:8.1%280%29bd%280.20%29 cpe:/o:cisco:nx-os:8.1%280.97%29s0 cpe:/o:cisco:nx-os:8.1%281%29s5

CVE-2018-0313

2018-06-21T07:29:00.727-04:00

2019-10-09T19:31:44.473-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov SECTRACK 1041169 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-nx-os-api-execution A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to send a malicious packet to the management interface on an affected system and execute a command-injection exploit. The vulnerability is due to incorrect input validation of user-supplied data to the NX-API subsystem. An attacker could exploit this vulnerability by sending a malicious HTTP or HTTPS packet to the management interface of an affected system that has the NX-API feature enabled. A successful exploit could allow the attacker to execute arbitrary commands with root privileges. Note: NX-API is disabled by default. This vulnerability affects MDS 9000 Series Multilayer Switches, Nexus 2000 Series Fabric Extenders, Nexus 3000 Series Switches, Nexus 3500 Platform Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Switches in standalone NX-OS mode, Nexus 9500 R-Series Line Cards and Fabric Modules. Cisco Bug IDs: CSCvd47415, CSCve03216, CSCve03224, CSCve03234.

cpe:/o:cisco:firepower_9000_firmware:r211 cpe:/o:cisco:firepower_9000_firmware:r231 cpe:/o:cisco:nexus_5000_firmware:7.0%280%29hsk%280.357%29 cpe:/o:cisco:nexus_5000_firmware:8.1%280.2%29s0 cpe:/o:cisco:nexus_5000_firmware:8.8%280.1%29 cpe:/o:cisco:nexus_7000_firmware:7.3%282%29d1%280.49%29 cpe:/o:cisco:nexus_7000_firmware:8.0%281%29 cpe:/o:cisco:nexus_7000_firmware:8.1%280.112%29s0 cpe:/o:cisco:nexus_9000_firmware:8.1%280%29bd%280.20%29 cpe:/o:cisco:unified_computing_system_firmware:3.1%283a%29a cpe:/o:cisco:unified_computing_system_firmware:7.0%280%29hsk%280.357%29

CVE-2018-0314

2018-06-20T17:29:00.717-04:00

2019-10-09T19:31:44.740-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 104516 SECTRACK 1041169 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-fx-os-fabric-execution A vulnerability in the Cisco Fabric Services (CFS) component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. The vulnerability exists because the affected software insufficiently validates Cisco Fabric Services packet headers when the software processes packet data. An attacker could exploit this vulnerability by sending a maliciously crafted Cisco Fabric Services packet to an affected device. A successful exploit could allow the attacker to cause a buffer overflow condition on the device, which could allow the attacker to execute arbitrary code on the device. This vulnerability affects the following if configured to use Cisco Fabric Services: Firepower 4100 Series Next-Generation Firewalls, Firepower 9300 Security Appliance, MDS 9000 Series Multilayer Switches, Nexus 2000 Series Fabric Extenders, Nexus 3000 Series Switches, Nexus 3500 Platform Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Switches in standalone NX-OS mode, Nexus 9500 R-Series Line Cards and Fabric Modules, UCS 6100 Series Fabric Interconnects, UCS 6200 Series Fabric Interconnects, UCS 6300 Series Fabric Interconnects. Cisco Bug IDs: CSCvd69943, CSCve02429, CSCve02433, CSCve02435, CSCve02445, CSCve04859.

cpe:/o:cisco:ios_xe:16.8.1 cpe:/o:cisco:ios_xe:fuji-16.7.1 cpe:/o:cisco:ios_xe:fuji-16.8.1 cpe:/o:cisco:ios_xe:fuji-16.8.1a

CVE-2018-0315

2018-06-07T08:29:00.433-04:00

2019-10-09T19:31:44.927-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 104410 SECTRACK 1041086 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-aaa A vulnerability in the authentication, authorization, and accounting (AAA) security services of Cisco IOS XE Software could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device or cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to incorrect memory operations that the affected software performs when the software parses a username during login authentication. An attacker could exploit this vulnerability by attempting to authenticate to an affected device. A successful exploit could allow the attacker to execute arbitrary code on the affected device or cause the affected device to reload, resulting in a DoS condition. This vulnerability affects Cisco devices that are running Cisco IOS XE Software Release Fuji 16.7.1 or Fuji 16.8.1 and are configured to use AAA for login authentication. Cisco Bug IDs: CSCvi25380.

cpe:/o:cisco:ip_phone_firmware:11.1%282%29

CVE-2018-0316

2018-06-07T08:29:00.480-04:00

2019-10-09T19:31:45.207-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1041073 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-multiplatform-sip A vulnerability in the Session Initiation Protocol (SIP) call-handling functionality of Cisco IP Phone 6800, 7800, and 8800 Series Phones with Multiplatform Firmware could allow an unauthenticated, remote attacker to cause an affected phone to reload unexpectedly, resulting in a temporary denial of service (DoS) condition. The vulnerability exists because the firmware of an affected phone incorrectly handles errors that could occur when an incoming phone call is not answered. An attacker could exploit this vulnerability by sending a set of maliciously crafted SIP packets to an affected phone. A successful exploit could allow the attacker to cause the affected phone to reload unexpectedly, resulting in a temporary DoS condition. This vulnerability affects Cisco IP Phone 6800, 7800, and 8800 Series Phones with Multiplatform Firmware if they are running a Multiplatform Firmware release prior to Release 11.1(2). Cisco Bug IDs: CSCvi24718.

cpe:/a:cisco:prime_collaboration:12.1 cpe:/a:cisco:prime_collaboration_provisioning:12.2

CVE-2018-0317

2018-06-07T08:29:00.527-04:00

2019-10-09T19:31:45.427-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov BID 104432 SECTRACK 1041080 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-bypass A vulnerability in the web interface of Cisco Prime Collaboration Provisioning (PCP) could allow an authenticated, remote attacker to escalate their privileges. The vulnerability is due to insufficient web portal access control checks. An attacker could exploit this vulnerability by modifying an access request. An exploit could allow the attacker to promote their account to any role defined on the system. This vulnerability affects Cisco Prime Collaboration Provisioning (PCP) Releases 12.2 and prior. Cisco Bug IDs: CSCvc90286.

cpe:/a:cisco:prime_collaboration:12.1 cpe:/a:cisco:prime_collaboration_provisioning:11.6

CVE-2018-0318

2018-06-07T08:29:00.573-04:00

2019-10-09T19:31:45.537-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104434 SECTRACK 1041082 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-password-reset A vulnerability in the password reset function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device. The vulnerability is due to insufficient validation of a password reset request. An attacker could exploit this vulnerability by submitting a password reset request and changing the password for any user on an affected system. An exploit could allow the attacker to gain administrative-level privileges on the affected system. This vulnerability affects Cisco Prime Collaboration Provisioning (PCP) Releases 11.6 and prior. Cisco Bug IDs: CSCvd07245.

cpe:/a:cisco:prime_collaboration:12.1 cpe:/a:cisco:prime_collaboration_provisioning:11.6

CVE-2018-0319

2018-06-07T08:29:00.607-04:00

2019-10-09T19:31:45.723-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104431 SECTRACK 1041079 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-password-recovery A vulnerability in the password recovery function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device. The vulnerability is due to insufficient validation of a password recovery request. An attacker could exploit this vulnerability by submitting a password recovery request and changing the password for any user on an affected system. An exploit could allow the attacker to gain administrative-level privileges on the affected system. This vulnerability affects Cisco Prime Collaboration Provisioning (PCP) Releases 11.6 and prior. Cisco Bug IDs: CSCvd07253.

cpe:/a:cisco:prime_collaboration:12.1 cpe:/a:cisco:prime_collaboration_provisioning:12.1

CVE-2018-0320

2018-06-07T08:29:00.653-04:00

2019-10-09T19:31:45.850-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 104416 SECTRACK 1041084 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-sql A vulnerability in the web framework code of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to execute arbitrary SQL queries. The vulnerability is due to a lack of proper validation on user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending crafted URLs that contain malicious SQL statements to the affected application. This vulnerability affects Cisco Prime Collaboration Provisioning (PCP) Releases 12.1 and prior. Cisco Bug IDs: CSCvd61754.

cpe:/a:cisco:prime_collaboration:11.6 cpe:/a:cisco:prime_collaboration_assurance:11.6 cpe:/a:cisco:prime_collaboration_provisioning:11.6

CVE-2018-0321

2018-06-07T08:29:00.683-04:00

2019-10-09T19:31:46.083-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 104409 SECTRACK 1041085 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-rmi A vulnerability in Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to access the Java Remote Method Invocation (RMI) system. The vulnerability is due to an open port in the Network Interface and Configuration Engine (NICE) service. An attacker could exploit this vulnerability by accessing the open RMI system on an affected PCP instance. An exploit could allow the attacker to perform malicious actions that affect PCP and the devices that are connected to it. This vulnerability affects Cisco Prime Collaboration Provisioning (PCP) Releases 11.6 and prior. Cisco Bug IDs: CSCvd61746.

cpe:/a:cisco:prime_collaboration:12.1 cpe:/a:cisco:prime_collaboration_provisioning:12.1

CVE-2018-0322

2018-06-07T08:29:00.730-04:00

2019-10-09T19:31:46.207-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov BID 104443 SECTRACK 1041064 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-access A vulnerability in the web management interface of Cisco Prime Collaboration Provisioning (PCP) could allow an authenticated, remote attacker to modify sensitive data that is associated with arbitrary accounts on an affected device. The vulnerability is due to a failure to enforce access restrictions on the Help Desk and User Provisioning roles that are assigned to authenticated users. This failure could allow an authenticated attacker to modify critical attributes of higher-privileged accounts on the device. A successful exploit could allow the attacker to gain elevated privileges on the device. This vulnerability affects Cisco Prime Collaboration Provisioning (PCP) Releases 12.1 and prior. Cisco Bug IDs: CSCvd61779.

cpe:/a:cisco:network_functions_virtualization_infrastructure:3.6.1 cpe:/a:cisco:network_functions_virtualization_infrastructure:3.7.1

CVE-2018-0323

2018-05-16T23:29:00.717-04:00

2019-10-09T19:31:46.317-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov BID 104206 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-nfvis-path-traversal A vulnerability in the web management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to conduct a path traversal attack on a targeted system. The vulnerability is due to insufficient validation of web request parameters. An attacker who has access to the web management interface of the affected application could exploit this vulnerability by sending a malicious web request to the affected device. A successful exploit could allow the attacker to access sensitive information on the affected system. Cisco Bug IDs: CSCvh99631.

cpe:/a:cisco:network_functions_virtualization_infrastructure:3.6.1 cpe:/a:cisco:network_functions_virtualization_infrastructure:3.6.2 cpe:/a:cisco:network_functions_virtualization_infrastructure:3.7.1

CVE-2018-0324

2018-05-16T23:29:00.763-04:00

2019-10-09T19:31:46.427-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 104208 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-nfvis-cli-command-injection A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, high-privileged, local attacker to perform a command injection attack. The vulnerability is due to insufficient input validation of command parameters in the CLI parser. An attacker could exploit this vulnerability by invoking a vulnerable CLI command with crafted malicious parameters. An exploit could allow the attacker to execute arbitrary commands with a non-root user account on the underlying Linux operating system of the affected device. Cisco Bug IDs: CSCvi09723.

cpe:/o:cisco:ip_phone_8800_firmware:9.4%282%29sr4 cpe:/o:cisco:ip_phone_8800_firmware:10.3%281%29sr4

CVE-2018-0325

2018-05-16T23:29:00.810-04:00

2019-10-09T19:31:46.537-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 104202 SECTRACK 1040927 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-ip-phone-dos A vulnerability in the Session Initiation Protocol (SIP) call-handling functionality of Cisco IP Phone 7800 Series phones and Cisco IP Phone 8800 Series phones could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected phone. The vulnerability is due to incomplete input validation of SIP Session Description Protocol (SDP) parameters by the SDP parser of an affected phone. An attacker could exploit this vulnerability by sending a malformed SIP packet to an affected phone. A successful exploit could allow the attacker to cause all active phone calls on the affected phone to be dropped while the SIP process on the phone unexpectedly restarts, resulting in a DoS condition. Cisco Bug IDs: CSCvf40066.

cpe:/o:cisco:telepresence_tx9000_firmware:10.0%282.98000.99%29

CVE-2018-0326

2018-05-16T23:29:00.857-04:00

2019-10-09T19:31:46.693-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104204 SECTRACK 1040930 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-telepres-xfs A vulnerability in the web UI of Cisco TelePresence Server Software could allow an unauthenticated, remote attacker to conduct a cross-frame scripting (XFS) attack against a user of the web UI of the affected software. The vulnerability is due to insufficient protections for HTML inline frames (iframes) by the web UI of the affected software. An attacker could exploit this vulnerability by persuading a user of the affected UI to navigate to an attacker-controlled web page that contains a malicious HTML iframe. A successful exploit could allow the attacker to conduct click-jacking or other client-side browser attacks on the affected system. Cisco Bug IDs: CSCun79565.

cpe:/a:cisco:identity_services_engine_software:2.1%280.905%29

CVE-2018-0327

2018-05-16T23:29:00.903-04:00

2019-10-09T19:31:46.817-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104194 SECTRACK 1040926 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-ident-se-xss A vulnerability in the web framework of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain parameters that are passed to the affected software via the HTTP GET and HTTP POST methods. An attacker who can convince a user to follow an attacker-supplied link could execute arbitrary script or HTML code in the user's browser in the context of an affected site. Cisco Bug IDs: CSCvg86743.

CVE-2018-0328

2018-05-16T23:29:00.950-04:00

2019-10-09T19:31:46.927-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104200 SECTRACK 1040928 SECTRACK 1040929 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-cucm-cup-xss A vulnerability in the web framework of Cisco Unified Communications Manager and Cisco Unified Presence could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain parameters that are passed to the affected software via the HTTP GET and HTTP POST methods. An attacker who can convince a user to follow an attacker-supplied link could execute arbitrary script or HTML code in the user's browser in the context of an affected site. Cisco Bug IDs: CSCvg89116.

cpe:/a:cisco:wide_area_application_services:6.2%283%29 cpe:/a:cisco:wide_area_application_services:6.4%281%29

CVE-2018-0329

2018-06-07T17:29:00.353-04:00

2019-10-09T19:31:47.053-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104590 SECTRACK 1041078 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-waas-snmp A vulnerability in the default configuration of the Simple Network Management Protocol (SNMP) feature of Cisco Wide Area Application Services (WAAS) Software could allow an unauthenticated, remote attacker to read data from an affected device via SNMP. The vulnerability is due to a hard-coded, read-only community string in the configuration file for the SNMP daemon. An attacker could exploit this vulnerability by using the static community string in SNMP version 2c queries to an affected device. A successful exploit could allow the attacker to read any data that is accessible via SNMP on the affected device. Note: The static credentials are defined in an internal configuration file and are not visible in the current operation configuration ('running-config') or the startup configuration ('startup-config'). Cisco Bug IDs: CSCvi40137.

cpe:/o:cisco:nx-os:- cpe:/o:cisco:nx-os:1.0%281.110a%29 cpe:/o:cisco:nx-os:1.0%281e%29 cpe:/o:cisco:nx-os:1.1%281g%29 cpe:/o:cisco:nx-os:2.3 cpe:/o:cisco:nx-os:2.3.1.130 cpe:/o:cisco:nx-os:2.4 cpe:/o:cisco:nx-os:2.4.1.122 cpe:/o:cisco:nx-os:4.0 cpe:/o:cisco:nx-os:4.0%280%29n1%281a%29 cpe:/o:cisco:nx-os:4.0%280%29n1%282%29 cpe:/o:cisco:nx-os:4.0%280%29n1%282a%29 cpe:/o:cisco:nx-os:4.0%281a%29n1%281%29 cpe:/o:cisco:nx-os:4.0%281a%29n1%281a%29 cpe:/o:cisco:nx-os:4.0%281a%29n2%281%29 cpe:/o:cisco:nx-os:4.0%281a%29n2%281a%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%281%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%282%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%283%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%283a%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%283b%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%283c%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%283d%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281b%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281c%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281d%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281e%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281f%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281g%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281h%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281i%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281j%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281k%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281m%29 cpe:/o:cisco:nx-os:4.1%283%29n1%281%29 cpe:/o:cisco:nx-os:4.1%283%29n1%281a%29 cpe:/o:cisco:nx-os:4.1%283%29n2%281%29 cpe:/o:cisco:nx-os:4.1%283%29n2%281a%29 cpe:/o:cisco:nx-os:4.1.%282%29 cpe:/o:cisco:nx-os:4.1.%283%29 cpe:/o:cisco:nx-os:4.1.%284%29 cpe:/o:cisco:nx-os:4.1.%285%29 cpe:/o:cisco:nx-os:4.2 cpe:/o:cisco:nx-os:4.2%281%29 cpe:/o:cisco:nx-os:4.2%281%29n1%281%29 cpe:/o:cisco:nx-os:4.2%281%29n2%281%29 cpe:/o:cisco:nx-os:4.2%281%29n2%281a%29 cpe:/o:cisco:nx-os:4.2%281%29sv1%284%29 cpe:/o:cisco:nx-os:4.2%281%29sv1%284a%29 cpe:/o:cisco:nx-os:4.2%281%29sv1%285.1%29 cpe:/o:cisco:nx-os:4.2%282%29 cpe:/o:cisco:nx-os:4.2%283%29 cpe:/o:cisco:nx-os:4.2%284%29 cpe:/o:cisco:nx-os:4.2%286%29 cpe:/o:cisco:nx-os:4.2%288%29 cpe:/o:cisco:nx-os:4.2.%282a%29 cpe:/o:cisco:nx-os:5.0 cpe:/o:cisco:nx-os:5.0%282%29 cpe:/o:cisco:nx-os:5.0%282%29n1%281%29 cpe:/o:cisco:nx-os:5.0%282%29n2%281%29 cpe:/o:cisco:nx-os:5.0%282%29n2%281a%29 cpe:/o:cisco:nx-os:5.0%282a%29 cpe:/o:cisco:nx-os:5.0%283%29 cpe:/o:cisco:nx-os:5.0%283%29n1%281%29 cpe:/o:cisco:nx-os:5.0%283%29n1%281a%29 cpe:/o:cisco:nx-os:5.0%283%29n1%281b%29 cpe:/o:cisco:nx-os:5.0%283%29n1%281c%29 cpe:/o:cisco:nx-os:5.0%283%29n2%281%29 cpe:/o:cisco:nx-os:5.0%283%29n2%282%29 cpe:/o:cisco:nx-os:5.0%283%29n2%282a%29 cpe:/o:cisco:nx-os:5.0%283%29n2%282b%29 cpe:/o:cisco:nx-os:5.0%283%29u1%281%29 cpe:/o:cisco:nx-os:5.0%283%29u1%281a%29 cpe:/o:cisco:nx-os:5.0%283%29u1%281b%29 cpe:/o:cisco:nx-os:5.0%283%29u1%281d%29 cpe:/o:cisco:nx-os:5.0%283%29u1%282%29 cpe:/o:cisco:nx-os:5.0%283%29u1%282a%29 cpe:/o:cisco:nx-os:5.0%283%29u2%281%29 cpe:/o:cisco:nx-os:5.0%283%29u2%282%29 cpe:/o:cisco:nx-os:5.0%283%29u2%282a%29 cpe:/o:cisco:nx-os:5.0%283%29u2%282b%29 cpe:/o:cisco:nx-os:5.0%283%29u2%282c%29 cpe:/o:cisco:nx-os:5.0%283%29u2%282d%29 cpe:/o:cisco:nx-os:5.0%283%29u3%281%29 cpe:/o:cisco:nx-os:5.0%283%29u3%282%29 cpe:/o:cisco:nx-os:5.0%283%29u3%282a%29 cpe:/o:cisco:nx-os:5.0%283%29u3%282b%29 cpe:/o:cisco:nx-os:5.0%283%29u4%281%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281a%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281b%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281c%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281d%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281e%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281f%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281g%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281h%29 cpe:/o:cisco:nx-os:5.0%285%29 cpe:/o:cisco:nx-os:5.1 cpe:/o:cisco:nx-os:5.1%281%29 cpe:/o:cisco:nx-os:5.1%281a%29 cpe:/o:cisco:nx-os:5.1%282%29 cpe:/o:cisco:nx-os:5.1%283%29 cpe:/o:cisco:nx-os:5.1%283%29n1%281%29 cpe:/o:cisco:nx-os:5.1%283%29n1%281a%29 cpe:/o:cisco:nx-os:5.1%283%29n2%281%29 cpe:/o:cisco:nx-os:5.1%283%29n2%281a%29 cpe:/o:cisco:nx-os:5.1%283%29n2%281b%29 cpe:/o:cisco:nx-os:5.1%283%29n2%281c%29 cpe:/o:cisco:nx-os:5.1%284%29 cpe:/o:cisco:nx-os:5.1%285%29 cpe:/o:cisco:nx-os:5.1%286%29 cpe:/o:cisco:nx-os:5.1.3 cpe:/o:cisco:nx-os:5.2 cpe:/o:cisco:nx-os:5.2%281%29 cpe:/o:cisco:nx-os:5.2%281%29n1%281%29 cpe:/o:cisco:nx-os:5.2%281%29n1%281a%29 cpe:/o:cisco:nx-os:5.2%281%29n1%281b%29 cpe:/o:cisco:nx-os:5.2%281%29n1%282%29 cpe:/o:cisco:nx-os:5.2%281%29n1%282a%29 cpe:/o:cisco:nx-os:5.2%281%29n1%283%29 cpe:/o:cisco:nx-os:5.2%281%29n1%284%29 cpe:/o:cisco:nx-os:5.2%281%29n1%285%29 cpe:/o:cisco:nx-os:5.2%281%29n1%286%29 cpe:/o:cisco:nx-os:5.2%281%29n1%287%29 cpe:/o:cisco:nx-os:5.2%281%29n1%288%29 cpe:/o:cisco:nx-os:5.2%281%29n1%288a%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.1%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.3%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.5a%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.5b%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.6%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.10%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%282.8%29 cpe:/o:cisco:nx-os:5.2%283%29 cpe:/o:cisco:nx-os:5.2%283a%29 cpe:/o:cisco:nx-os:5.2%284%29 cpe:/o:cisco:nx-os:5.2%285%29 cpe:/o:cisco:nx-os:5.2%287%29 cpe:/o:cisco:nx-os:5.2%289%29 cpe:/o:cisco:nx-os:5.2%289%29n1%281%29 cpe:/o:cisco:nx-os:5.3.0 cpe:/o:cisco:nx-os:6.0 cpe:/o:cisco:nx-os:6.0%281%29 cpe:/o:cisco:nx-os:6.0%282%29 cpe:/o:cisco:nx-os:6.0%282%29a6%281%29 cpe:/o:cisco:nx-os:6.0%282%29a6%282%29 cpe:/o:cisco:nx-os:6.0%282%29a6%283%29 cpe:/o:cisco:nx-os:6.0%282%29a6%284%29 cpe:/o:cisco:nx-os:6.0%282%29a6%285%29 cpe:/o:cisco:nx-os:6.0%282%29a6%286%29 cpe:/o:cisco:nx-os:6.0%282%29a6%287%29 cpe:/o:cisco:nx-os:6.0%282%29a6%288%29 cpe:/o:cisco:nx-os:6.0%282%29a7%281%29 cpe:/o:cisco:nx-os:6.0%282%29a7%282%29 cpe:/o:cisco:nx-os:6.0%282%29a7%282a%29 cpe:/o:cisco:nx-os:6.0%282%29a8%282%29 cpe:/o:cisco:nx-os:6.0%282%29n1%281%29 cpe:/o:cisco:nx-os:6.0%282%29n1%282%29 cpe:/o:cisco:nx-os:6.0%282%29n1%282a%29 cpe:/o:cisco:nx-os:6.0%282%29n2%281%29 cpe:/o:cisco:nx-os:6.0%282%29n2%281b%29 cpe:/o:cisco:nx-os:6.0%282%29n2%282%29 cpe:/o:cisco:nx-os:6.0%282%29n2%283%29 cpe:/o:cisco:nx-os:6.0%282%29n2%284%29 cpe:/o:cisco:nx-os:6.0%282%29n2%285%29 cpe:/o:cisco:nx-os:6.0%282%29n2%285a%29 cpe:/o:cisco:nx-os:6.0%282%29n2%286%29 cpe:/o:cisco:nx-os:6.0%282%29n2%287%29 cpe:/o:cisco:nx-os:6.0%282%29u1%281%29 cpe:/o:cisco:nx-os:6.0%282%29u1%281a%29 cpe:/o:cisco:nx-os:6.0%282%29u1%282%29 cpe:/o:cisco:nx-os:6.0%282%29u1%283%29 cpe:/o:cisco:nx-os:6.0%282%29u1%284%29 cpe:/o:cisco:nx-os:6.0%282%29u2%281%29 cpe:/o:cisco:nx-os:6.0%282%29u2%282%29 cpe:/o:cisco:nx-os:6.0%282%29u2%283%29 cpe:/o:cisco:nx-os:6.0%282%29u2%284%29 cpe:/o:cisco:nx-os:6.0%282%29u2%285%29 cpe:/o:cisco:nx-os:6.0%282%29u2%286%29 cpe:/o:cisco:nx-os:6.0%282%29u3%281%29 cpe:/o:cisco:nx-os:6.0%282%29u3%282%29 cpe:/o:cisco:nx-os:6.0%282%29u3%283%29 cpe:/o:cisco:nx-os:6.0%282%29u3%284%29 cpe:/o:cisco:nx-os:6.0%282%29u3%285%29 cpe:/o:cisco:nx-os:6.0%282%29u4%281%29 cpe:/o:cisco:nx-os:6.0%282%29u4%282%29 cpe:/o:cisco:nx-os:6.0%282%29u4%283%29 cpe:/o:cisco:nx-os:6.0%282%29u5%281%29 cpe:/o:cisco:nx-os:6.0%282%29u5%281.41%29 cpe:/o:cisco:nx-os:6.0%282%29u5%282%29 cpe:/o:cisco:nx-os:6.0%282%29u5%283%29 cpe:/o:cisco:nx-os:6.0%282%29u5%284%29 cpe:/o:cisco:nx-os:6.0%282%29u6%281%29 cpe:/o:cisco:nx-os:6.0%282%29u6%282%29 cpe:/o:cisco:nx-os:6.0%282%29u6%283%29 cpe:/o:cisco:nx-os:6.0%282%29u6%284%29 cpe:/o:cisco:nx-os:6.0%282%29u6%285%29 cpe:/o:cisco:nx-os:6.0%282%29u6%286%29 cpe:/o:cisco:nx-os:6.0%282%29u6%287%29 cpe:/o:cisco:nx-os:6.0%282%29u6%288%29 cpe:/o:cisco:nx-os:6.0%283%29 cpe:/o:cisco:nx-os:6.0%284%29 cpe:/o:cisco:nx-os:6.1 cpe:/o:cisco:nx-os:6.1%281%29 cpe:/o:cisco:nx-os:6.1%282%29 cpe:/o:cisco:nx-os:6.1%282%29i2%282%29 cpe:/o:cisco:nx-os:6.1%282%29i2%282a%29 cpe:/o:cisco:nx-os:6.1%282%29i2%282b%29 cpe:/o:cisco:nx-os:6.1%282%29i2%283%29 cpe:/o:cisco:nx-os:6.1%282%29i3%281%29 cpe:/o:cisco:nx-os:6.1%282%29i3%282%29 cpe:/o:cisco:nx-os:6.1%282%29i3%283%29 cpe:/o:cisco:nx-os:6.1%282%29i3%283.78%29 cpe:/o:cisco:nx-os:6.1%282%29i3%284%29 cpe:/o:cisco:nx-os:6.1%283%29 cpe:/o:cisco:nx-os:6.1%284%29 cpe:/o:cisco:nx-os:6.1%284a%29 cpe:/o:cisco:nx-os:6.1%285%29 cpe:/o:cisco:nx-os:6.2 cpe:/o:cisco:nx-os:6.2%281%29 cpe:/o:cisco:nx-os:6.2%281n%29 cpe:/o:cisco:nx-os:6.2%282%29 cpe:/o:cisco:nx-os:6.2%282a%29 cpe:/o:cisco:nx-os:6.2%283%29 cpe:/o:cisco:nx-os:6.2%283n%29 cpe:/o:cisco:nx-os:6.2%285%29 cpe:/o:cisco:nx-os:6.2%285a%29 cpe:/o:cisco:nx-os:6.2%286%29 cpe:/o:cisco:nx-os:6.2%286b%29 cpe:/o:cisco:nx-os:6.2%287%29 cpe:/o:cisco:nx-os:6.2%288%29 cpe:/o:cisco:nx-os:6.2%288a%29 cpe:/o:cisco:nx-os:6.2%288b%29 cpe:/o:cisco:nx-os:6.2%2810%29 cpe:/o:cisco:nx-os:6.2%2811b%29 cpe:/o:cisco:nx-os:6.2%2812%29 cpe:/o:cisco:nx-os:6.2%2814%29s1 cpe:/o:cisco:nx-os:7.0 cpe:/o:cisco:nx-os:7.0%280%29n1%281%29 cpe:/o:cisco:nx-os:7.0%281%29n1%281%29 cpe:/o:cisco:nx-os:7.0%281%29n1%283%29 cpe:/o:cisco:nx-os:7.0%282%29n1%281%29 cpe:/o:cisco:nx-os:7.0%283%29 cpe:/o:cisco:nx-os:7.0%283%29i1%281a%29 cpe:/o:cisco:nx-os:7.0%283%29i1%281b%29 cpe:/o:cisco:nx-os:7.0%283%29i1%282%29 cpe:/o:cisco:nx-os:7.0%283%29i2%280.373%29 cpe:/o:cisco:nx-os:7.0%283%29i7 cpe:/o:cisco:nx-os:7.0%283%29n1%281%29 cpe:/o:cisco:nx-os:7.0%284%29n1%281%29 cpe:/o:cisco:nx-os:7.0%285%29n1%281%29 cpe:/o:cisco:nx-os:7.0%285%29n1%281a%29 cpe:/o:cisco:nx-os:7.0%286%29n1%281%29 cpe:/o:cisco:nx-os:7.0%287%29n1%281%29 cpe:/o:cisco:nx-os:7.0%288%29n1%281%29 cpe:/o:cisco:nx-os:7.1 cpe:/o:cisco:nx-os:7.1%280%29n1%281a%29 cpe:/o:cisco:nx-os:7.1%280%29n1%281b%29 cpe:/o:cisco:nx-os:7.1%281%29n1%281%29 cpe:/o:cisco:nx-os:7.1%282%29n1%281%29 cpe:/o:cisco:nx-os:7.1%283%29n1%281%29 cpe:/o:cisco:nx-os:7.1%283%29n1%282%29 cpe:/o:cisco:nx-os:7.1%283%29n1%282.1%29 cpe:/o:cisco:nx-os:7.1%283%29n1%283.12%29 cpe:/o:cisco:nx-os:7.1%284%29n1%281%29 cpe:/o:cisco:nx-os:7.2 cpe:/o:cisco:nx-os:7.2%280%29n1%280.1%29 cpe:/o:cisco:nx-os:7.2%280%29n1%281%29 cpe:/o:cisco:nx-os:7.2%280%29zz%2899.1%29 cpe:/o:cisco:nx-os:7.2%280%29zz%2899.3%29 cpe:/o:cisco:nx-os:7.2%281%29n1%281%29 cpe:/o:cisco:nx-os:7.3 cpe:/o:cisco:nx-os:7.3%280%29n1%281%29 cpe:/o:cisco:nx-os:7.3%280%29zn%280.9%29 cpe:/o:cisco:nx-os:7.3%280%29zn%280.81%29 cpe:/o:cisco:nx-os:7.3%280%29zn%280.83%29 cpe:/o:cisco:nx-os:7.3%282%29n1%280.296%29 cpe:/o:cisco:nx-os:7.3%282%29n1%280.395%29 cpe:/o:cisco:nx-os:8.0 cpe:/o:cisco:nx-os:8.1 cpe:/o:cisco:nx-os:8.1%280.2%29s0 cpe:/o:cisco:nx-os:8.1%280.59%29s0 cpe:/o:cisco:nx-os:8.1%280.112%29s0 cpe:/o:cisco:nx-os:8.1%281%29 cpe:/o:cisco:nx-os:8.1%281%29s5 cpe:/o:cisco:nx-os:8.1%281b%29 cpe:/o:cisco:nx-os:8.2

CVE-2018-0330

2018-06-20T17:29:00.767-04:00

2019-10-09T19:31:47.160-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov SECTRACK 1041169 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-nxos-nxapi A vulnerability in the NX-API management application programming interface (API) in devices running, or based on, Cisco NX-OS Software could allow an authenticated, remote attacker to execute commands with elevated privileges. The vulnerability is due to a failure to properly validate certain parameters included within an NX-API request. An attacker that can successfully authenticate to the NX-API could submit a request designed to bypass NX-OS role assignment. A successful exploit could allow the attacker to execute commands with elevated privileges. This vulnerability affects the following if configured to use the NX-API feature: MDS 9000 Series Multilayer Switches, Nexus 2000 Series Switches, Nexus 3000 Series Switches, Nexus 3500 Platform Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Switches in standalone NX-OS mode. Cisco Bug IDs: CSCvc73177, CSCve40903, CSCve40911.

cpe:/o:cisco:nx-os:- cpe:/o:cisco:nx-os:1.0%281.110a%29 cpe:/o:cisco:nx-os:1.0%281e%29 cpe:/o:cisco:nx-os:1.1%281g%29 cpe:/o:cisco:nx-os:2.3 cpe:/o:cisco:nx-os:2.3.1.130 cpe:/o:cisco:nx-os:2.4 cpe:/o:cisco:nx-os:2.4.1.122 cpe:/o:cisco:nx-os:4.0 cpe:/o:cisco:nx-os:4.0%280%29n1%281a%29 cpe:/o:cisco:nx-os:4.0%280%29n1%282%29 cpe:/o:cisco:nx-os:4.0%280%29n1%282a%29 cpe:/o:cisco:nx-os:4.0%281a%29n1%281%29 cpe:/o:cisco:nx-os:4.0%281a%29n1%281a%29 cpe:/o:cisco:nx-os:4.0%281a%29n2%281%29 cpe:/o:cisco:nx-os:4.0%281a%29n2%281a%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%281%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%282%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%283%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%283a%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%283b%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%283c%29 cpe:/o:cisco:nx-os:4.0%284%29sv1%283d%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281b%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281c%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281d%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281e%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281f%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281g%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281h%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281i%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281j%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281k%29 cpe:/o:cisco:nx-os:4.1%282%29e1%281m%29 cpe:/o:cisco:nx-os:4.1%283%29n1%281%29 cpe:/o:cisco:nx-os:4.1%283%29n1%281a%29 cpe:/o:cisco:nx-os:4.1%283%29n2%281%29 cpe:/o:cisco:nx-os:4.1%283%29n2%281a%29 cpe:/o:cisco:nx-os:4.1.%282%29 cpe:/o:cisco:nx-os:4.1.%283%29 cpe:/o:cisco:nx-os:4.1.%284%29 cpe:/o:cisco:nx-os:4.1.%285%29 cpe:/o:cisco:nx-os:4.2 cpe:/o:cisco:nx-os:4.2%281%29 cpe:/o:cisco:nx-os:4.2%281%29n1%281%29 cpe:/o:cisco:nx-os:4.2%281%29n2%281%29 cpe:/o:cisco:nx-os:4.2%281%29n2%281a%29 cpe:/o:cisco:nx-os:4.2%281%29sv1%284%29 cpe:/o:cisco:nx-os:4.2%281%29sv1%284a%29 cpe:/o:cisco:nx-os:4.2%281%29sv1%285.1%29 cpe:/o:cisco:nx-os:4.2%282%29 cpe:/o:cisco:nx-os:4.2%283%29 cpe:/o:cisco:nx-os:4.2%284%29 cpe:/o:cisco:nx-os:4.2%286%29 cpe:/o:cisco:nx-os:4.2%288%29 cpe:/o:cisco:nx-os:4.2.%282a%29 cpe:/o:cisco:nx-os:5.0 cpe:/o:cisco:nx-os:5.0%282%29 cpe:/o:cisco:nx-os:5.0%282%29n1%281%29 cpe:/o:cisco:nx-os:5.0%282%29n2%281%29 cpe:/o:cisco:nx-os:5.0%282%29n2%281a%29 cpe:/o:cisco:nx-os:5.0%282a%29 cpe:/o:cisco:nx-os:5.0%283%29 cpe:/o:cisco:nx-os:5.0%283%29n1%281%29 cpe:/o:cisco:nx-os:5.0%283%29n1%281a%29 cpe:/o:cisco:nx-os:5.0%283%29n1%281b%29 cpe:/o:cisco:nx-os:5.0%283%29n1%281c%29 cpe:/o:cisco:nx-os:5.0%283%29n2%281%29 cpe:/o:cisco:nx-os:5.0%283%29n2%282%29 cpe:/o:cisco:nx-os:5.0%283%29n2%282a%29 cpe:/o:cisco:nx-os:5.0%283%29n2%282b%29 cpe:/o:cisco:nx-os:5.0%283%29u1%281%29 cpe:/o:cisco:nx-os:5.0%283%29u1%281a%29 cpe:/o:cisco:nx-os:5.0%283%29u1%281b%29 cpe:/o:cisco:nx-os:5.0%283%29u1%281d%29 cpe:/o:cisco:nx-os:5.0%283%29u1%282%29 cpe:/o:cisco:nx-os:5.0%283%29u1%282a%29 cpe:/o:cisco:nx-os:5.0%283%29u2%281%29 cpe:/o:cisco:nx-os:5.0%283%29u2%282%29 cpe:/o:cisco:nx-os:5.0%283%29u2%282a%29 cpe:/o:cisco:nx-os:5.0%283%29u2%282b%29 cpe:/o:cisco:nx-os:5.0%283%29u2%282c%29 cpe:/o:cisco:nx-os:5.0%283%29u2%282d%29 cpe:/o:cisco:nx-os:5.0%283%29u3%281%29 cpe:/o:cisco:nx-os:5.0%283%29u3%282%29 cpe:/o:cisco:nx-os:5.0%283%29u3%282a%29 cpe:/o:cisco:nx-os:5.0%283%29u3%282b%29 cpe:/o:cisco:nx-os:5.0%283%29u4%281%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281a%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281b%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281c%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281d%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281e%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281f%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281g%29 cpe:/o:cisco:nx-os:5.0%283%29u5%281h%29 cpe:/o:cisco:nx-os:5.0%285%29 cpe:/o:cisco:nx-os:5.1 cpe:/o:cisco:nx-os:5.1%281%29 cpe:/o:cisco:nx-os:5.1%281a%29 cpe:/o:cisco:nx-os:5.1%282%29 cpe:/o:cisco:nx-os:5.1%283%29 cpe:/o:cisco:nx-os:5.1%283%29n1%281%29 cpe:/o:cisco:nx-os:5.1%283%29n1%281a%29 cpe:/o:cisco:nx-os:5.1%283%29n2%281%29 cpe:/o:cisco:nx-os:5.1%283%29n2%281a%29 cpe:/o:cisco:nx-os:5.1%283%29n2%281b%29 cpe:/o:cisco:nx-os:5.1%283%29n2%281c%29 cpe:/o:cisco:nx-os:5.1%284%29 cpe:/o:cisco:nx-os:5.1%285%29 cpe:/o:cisco:nx-os:5.1%286%29 cpe:/o:cisco:nx-os:5.1.3 cpe:/o:cisco:nx-os:5.2 cpe:/o:cisco:nx-os:5.2%281%29 cpe:/o:cisco:nx-os:5.2%281%29n1%281%29 cpe:/o:cisco:nx-os:5.2%281%29n1%281a%29 cpe:/o:cisco:nx-os:5.2%281%29n1%281b%29 cpe:/o:cisco:nx-os:5.2%281%29n1%282%29 cpe:/o:cisco:nx-os:5.2%281%29n1%282a%29 cpe:/o:cisco:nx-os:5.2%281%29n1%283%29 cpe:/o:cisco:nx-os:5.2%281%29n1%284%29 cpe:/o:cisco:nx-os:5.2%281%29n1%285%29 cpe:/o:cisco:nx-os:5.2%281%29n1%286%29 cpe:/o:cisco:nx-os:5.2%281%29n1%287%29 cpe:/o:cisco:nx-os:5.2%281%29n1%288%29 cpe:/o:cisco:nx-os:5.2%281%29n1%288a%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.1%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.3%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.5a%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.5b%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.6%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%281.10%29 cpe:/o:cisco:nx-os:5.2%281%29sv3%282.8%29 cpe:/o:cisco:nx-os:5.2%283%29 cpe:/o:cisco:nx-os:5.2%283a%29 cpe:/o:cisco:nx-os:5.2%284%29 cpe:/o:cisco:nx-os:5.2%285%29 cpe:/o:cisco:nx-os:5.2%287%29 cpe:/o:cisco:nx-os:5.2%289%29 cpe:/o:cisco:nx-os:5.2%289%29n1%281%29 cpe:/o:cisco:nx-os:5.3.0 cpe:/o:cisco:nx-os:6.0 cpe:/o:cisco:nx-os:6.0%281%29 cpe:/o:cisco:nx-os:6.0%282%29 cpe:/o:cisco:nx-os:6.0%282%29a6%281%29 cpe:/o:cisco:nx-os:6.0%282%29a6%282%29 cpe:/o:cisco:nx-os:6.0%282%29a6%283%29 cpe:/o:cisco:nx-os:6.0%282%29a6%284%29 cpe:/o:cisco:nx-os:6.0%282%29a6%285%29 cpe:/o:cisco:nx-os:6.0%282%29a6%286%29 cpe:/o:cisco:nx-os:6.0%282%29a6%287%29 cpe:/o:cisco:nx-os:6.0%282%29a6%288%29 cpe:/o:cisco:nx-os:6.0%282%29a7%281%29 cpe:/o:cisco:nx-os:6.0%282%29a7%282%29 cpe:/o:cisco:nx-os:6.0%282%29a7%282a%29 cpe:/o:cisco:nx-os:6.0%282%29a8%282%29 cpe:/o:cisco:nx-os:6.0%282%29n1%281%29 cpe:/o:cisco:nx-os:6.0%282%29n1%282%29 cpe:/o:cisco:nx-os:6.0%282%29n1%282a%29 cpe:/o:cisco:nx-os:6.0%282%29n2%281%29 cpe:/o:cisco:nx-os:6.0%282%29n2%281b%29 cpe:/o:cisco:nx-os:6.0%282%29n2%282%29 cpe:/o:cisco:nx-os:6.0%282%29n2%283%29 cpe:/o:cisco:nx-os:6.0%282%29n2%284%29 cpe:/o:cisco:nx-os:6.0%282%29n2%285%29 cpe:/o:cisco:nx-os:6.0%282%29n2%285a%29 cpe:/o:cisco:nx-os:6.0%282%29n2%286%29 cpe:/o:cisco:nx-os:6.0%282%29n2%287%29 cpe:/o:cisco:nx-os:6.0%282%29u1%281%29 cpe:/o:cisco:nx-os:6.0%282%29u1%281a%29 cpe:/o:cisco:nx-os:6.0%282%29u1%282%29 cpe:/o:cisco:nx-os:6.0%282%29u1%283%29 cpe:/o:cisco:nx-os:6.0%282%29u1%284%29 cpe:/o:cisco:nx-os:6.0%282%29u2%281%29 cpe:/o:cisco:nx-os:6.0%282%29u2%282%29 cpe:/o:cisco:nx-os:6.0%282%29u2%283%29 cpe:/o:cisco:nx-os:6.0%282%29u2%284%29 cpe:/o:cisco:nx-os:6.0%282%29u2%285%29 cpe:/o:cisco:nx-os:6.0%282%29u2%286%29 cpe:/o:cisco:nx-os:6.0%282%29u3%281%29 cpe:/o:cisco:nx-os:6.0%282%29u3%282%29 cpe:/o:cisco:nx-os:6.0%282%29u3%283%29 cpe:/o:cisco:nx-os:6.0%282%29u3%284%29 cpe:/o:cisco:nx-os:6.0%282%29u3%285%29 cpe:/o:cisco:nx-os:6.0%282%29u4%281%29 cpe:/o:cisco:nx-os:6.0%282%29u4%282%29 cpe:/o:cisco:nx-os:6.0%282%29u4%283%29 cpe:/o:cisco:nx-os:6.0%282%29u5%281%29 cpe:/o:cisco:nx-os:6.0%282%29u5%281.41%29 cpe:/o:cisco:nx-os:6.0%282%29u5%282%29 cpe:/o:cisco:nx-os:6.0%282%29u5%283%29 cpe:/o:cisco:nx-os:6.0%282%29u5%284%29 cpe:/o:cisco:nx-os:6.0%282%29u6%281%29 cpe:/o:cisco:nx-os:6.0%282%29u6%282%29 cpe:/o:cisco:nx-os:6.0%282%29u6%283%29 cpe:/o:cisco:nx-os:6.0%282%29u6%284%29 cpe:/o:cisco:nx-os:6.0%282%29u6%285%29 cpe:/o:cisco:nx-os:6.0%282%29u6%286%29 cpe:/o:cisco:nx-os:6.0%282%29u6%287%29 cpe:/o:cisco:nx-os:6.0%282%29u6%288%29 cpe:/o:cisco:nx-os:6.0%283%29 cpe:/o:cisco:nx-os:6.0%284%29 cpe:/o:cisco:nx-os:6.1 cpe:/o:cisco:nx-os:6.1%281%29 cpe:/o:cisco:nx-os:6.1%282%29 cpe:/o:cisco:nx-os:6.1%282%29i2%282%29 cpe:/o:cisco:nx-os:6.1%282%29i2%282a%29 cpe:/o:cisco:nx-os:6.1%282%29i2%282b%29 cpe:/o:cisco:nx-os:6.1%282%29i2%283%29 cpe:/o:cisco:nx-os:6.1%282%29i3%281%29 cpe:/o:cisco:nx-os:6.1%282%29i3%282%29 cpe:/o:cisco:nx-os:6.1%282%29i3%283%29 cpe:/o:cisco:nx-os:6.1%282%29i3%283.78%29 cpe:/o:cisco:nx-os:6.1%282%29i3%284%29 cpe:/o:cisco:nx-os:6.1%283%29 cpe:/o:cisco:nx-os:6.1%284%29 cpe:/o:cisco:nx-os:6.1%284a%29 cpe:/o:cisco:nx-os:6.1%285%29 cpe:/o:cisco:nx-os:6.2%281%29 cpe:/o:cisco:nx-os:6.2%281n%29 cpe:/o:cisco:nx-os:6.2%282%29 cpe:/o:cisco:nx-os:6.2%282a%29 cpe:/o:cisco:nx-os:6.2%283%29 cpe:/o:cisco:nx-os:6.2%283n%29 cpe:/o:cisco:nx-os:6.2%285%29 cpe:/o:cisco:nx-os:6.2%285a%29 cpe:/o:cisco:nx-os:6.2%286%29 cpe:/o:cisco:nx-os:6.2%286b%29 cpe:/o:cisco:nx-os:6.2%287%29 cpe:/o:cisco:nx-os:6.2%288%29 cpe:/o:cisco:nx-os:6.2%288a%29 cpe:/o:cisco:nx-os:6.2%288b%29 cpe:/o:cisco:nx-os:6.2%2810%29 cpe:/o:cisco:nx-os:6.2%2811b%29 cpe:/o:cisco:nx-os:6.2%2812%29 cpe:/o:cisco:nx-os:6.2%2814%29s1 cpe:/o:cisco:nx-os:7.0 cpe:/o:cisco:nx-os:7.0%280%29n1%281%29 cpe:/o:cisco:nx-os:7.0%281%29n1%281%29 cpe:/o:cisco:nx-os:7.0%281%29n1%283%29 cpe:/o:cisco:nx-os:7.0%282%29n1%281%29 cpe:/o:cisco:nx-os:7.0%283%29 cpe:/o:cisco:nx-os:7.0%283%29i1%281a%29 cpe:/o:cisco:nx-os:7.0%283%29i1%281b%29 cpe:/o:cisco:nx-os:7.0%283%29i1%282%29 cpe:/o:cisco:nx-os:7.0%283%29i2%280.373%29 cpe:/o:cisco:nx-os:7.0%283%29i7 cpe:/o:cisco:nx-os:7.0%283%29n1%281%29 cpe:/o:cisco:nx-os:7.0%284%29n1%281%29 cpe:/o:cisco:nx-os:7.0%285%29n1%281%29 cpe:/o:cisco:nx-os:7.0%285%29n1%281a%29 cpe:/o:cisco:nx-os:7.0%286%29n1%281%29 cpe:/o:cisco:nx-os:7.0%287%29n1%281%29 cpe:/o:cisco:nx-os:7.0%288%29n1%281%29 cpe:/o:cisco:nx-os:7.1%280%29n1%281a%29 cpe:/o:cisco:nx-os:7.1%280%29n1%281b%29 cpe:/o:cisco:nx-os:7.1%281%29n1%281%29 cpe:/o:cisco:nx-os:7.1%282%29n1%281%29 cpe:/o:cisco:nx-os:7.1%283%29n1%281%29 cpe:/o:cisco:nx-os:7.1%283%29n1%282%29 cpe:/o:cisco:nx-os:7.1%283%29n1%282.1%29 cpe:/o:cisco:nx-os:7.1%283%29n1%283.12%29 cpe:/o:cisco:nx-os:7.1%284%29n1%281%29 cpe:/o:cisco:nx-os:7.2 cpe:/o:cisco:nx-os:7.2%280%29n1%280.1%29 cpe:/o:cisco:nx-os:7.2%280%29n1%281%29 cpe:/o:cisco:nx-os:7.2%280%29zz%2899.1%29 cpe:/o:cisco:nx-os:7.2%280%29zz%2899.3%29 cpe:/o:cisco:nx-os:7.2%281%29n1%281%29 cpe:/o:cisco:nx-os:7.3 cpe:/o:cisco:nx-os:7.3%280%29n1%281%29 cpe:/o:cisco:nx-os:7.3%280%29zn%280.9%29 cpe:/o:cisco:nx-os:7.3%280%29zn%280.81%29 cpe:/o:cisco:nx-os:7.3%280%29zn%280.83%29 cpe:/o:cisco:nx-os:7.3%282%29n1%280.296%29 cpe:/o:cisco:nx-os:7.3%282%29n1%280.395%29 cpe:/o:cisco:nx-os:8.0 cpe:/o:cisco:nx-os:8.0%281%29s2 cpe:/o:cisco:nx-os:8.1 cpe:/o:cisco:nx-os:8.1%280.2%29s0 cpe:/o:cisco:nx-os:8.1%280.59%29s0 cpe:/o:cisco:nx-os:8.1%280.112%29s0 cpe:/o:cisco:nx-os:8.1%281%29 cpe:/o:cisco:nx-os:8.1%281%29s5 cpe:/o:cisco:nx-os:8.1%281b%29 cpe:/o:cisco:nx-os:8.2

CVE-2018-0331

2018-06-21T07:29:00.773-04:00

2019-10-09T19:31:47.410-04:00

6.1

ADJACENT_NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1041169 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-nxos-cdp A vulnerability in the Cisco Discovery Protocol (formerly known as CDP) subsystem of devices running, or based on, Cisco NX-OS Software contain a vulnerability that could allow an unauthenticated, adjacent attacker to create a denial of service (DoS) condition. The vulnerability is due to a failure to properly validate certain fields within a Cisco Discovery Protocol message prior to processing it. An attacker with the ability to submit a Cisco Discovery Protocol message designed to trigger the issue could cause a DoS condition on an affected device while the device restarts. This vulnerability affects Firepower 4100 Series Next-Generation Firewall, Firepower 9300 Security Appliance, MDS 9000 Series Multilayer Director Switches, Nexus 1000V Series Switches, Nexus 1100 Series Cloud Services Platforms, Nexus 2000 Series Switches, Nexus 3000 Series Switches, Nexus 3500 Platform Switches, Nexus 3600 Platform Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Switches in NX-OS mode, Nexus 9500 R-Series Line Cards and Fabric Modules, UCS 6100 Series Fabric Interconnects, UCS 6200 Series Fabric Interconnects, UCS 6300 Series Fabric Interconnects. Cisco Bug IDs: CSCvc89242, CSCve40943, CSCve40953, CSCve40965, CSCve40970, CSCve40978, CSCve40992, CSCve41000, CSCve41007.

cpe:/o:cisco:ip_phone_firmware:9.4%282%29sr3.1 cpe:/o:cisco:ip_phone_firmware:9.4%282%29sr4 cpe:/o:cisco:unified_ip_phone_firmware:9.9%289.99002.1%29

CVE-2018-0332

2018-06-07T17:29:00.400-04:00

2019-10-09T19:31:47.740-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 104445 SECTRACK 1041074 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-ip-phone-dos A vulnerability in the Session Initiation Protocol (SIP) ingress packet processing of Cisco Unified IP Phone software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to a lack of flow-control mechanisms in the software. An attacker could exploit this vulnerability by sending high volumes of SIP INVITE traffic to the targeted device. Successful exploitation could allow the attacker to cause a disruption of services on the targeted IP phone. Cisco Bug IDs: CSCve10064, CSCve14617, CSCve14638, CSCve14683, CSCve20812, CSCve20926, CSCve20945.

cpe:/a:cisco:firepower_management_center:6.2.2

CVE-2018-0333

2018-06-07T17:29:00.463-04:00

2019-10-09T19:31:47.927-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104422 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-FireSIGHT-vpn-bypass A vulnerability in the VPN configuration management of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass VPN security due to unintended side effects of dynamic configuration changes that could allow an attacker to bypass configured policies. The vulnerability is due to incorrect management of the configured interface names and VPN parameters when dynamic CLI configuration changes are performed. An attacker could exploit this vulnerability by sending packets through an interface on the targeted device. A successful exploit could allow the attacker to bypass configured VPN policies. Cisco Bug IDs: CSCvh49388.

cpe:/a:cisco:anyconnect_secure_mobility_client:4.6%28100%29

CVE-2018-0334

2018-06-07T17:29:00.493-04:00

2019-10-09T19:31:48.037-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104430 SECTRACK 1041075 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-AnyConnect-cert-bypass A vulnerability in the certificate management subsystem of Cisco AnyConnect Network Access Manager and of Cisco AnyConnect Secure Mobility Client for iOS, Mac OS X, Android, Windows, and Linux could allow an unauthenticated, remote attacker to bypass the TLS certificate check when downloading certain configuration files. The vulnerability is due to improper use of Simple Certificate Enrollment Protocol and improper server certificate validation. An attacker could exploit this vulnerability by preparing malicious profile and localization files for Cisco AnyConnect to use. A successful exploit could allow the attacker to remotely change the configuration profile, a certificate, or the localization data used by AnyConnect Secure Mobility Client. Cisco Bug IDs: CSCvh23141.

cpe:/a:cisco:prime_collaboration:12.2

CVE-2018-0335

2018-06-07T17:29:00.540-04:00

2019-10-09T19:31:48.147-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104473 SECTRACK 1041069 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-cpcp-id A vulnerability in the web portal authentication process of Cisco Prime Collaboration Provisioning could allow an unauthenticated, local attacker to view sensitive data. The vulnerability is due to improper logging of authentication data. An attacker could exploit this vulnerability by monitoring a specific World-Readable file for this authentication data (Cleartext Passwords). An exploit could allow the attacker to gain authentication information for other users. Cisco Bug IDs: CSCvd86602.

cpe:/a:cisco:prime_collaboration:12.1

CVE-2018-0336

2018-06-07T17:29:00.587-04:00

2019-10-09T19:31:48.240-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov BID 104429 SECTRACK 1041083 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-escalation A vulnerability in the batch provisioning feature of Cisco Prime Collaboration Provisioning could allow an authenticated, remote attacker to escalate privileges to the Administrator level. The vulnerability is due to insufficient authorization enforcement on batch processing. An attacker could exploit this vulnerability by uploading a batch file and having the batch file processed by the system. A successful exploit could allow the attacker to escalate privileges to the Administrator level. Cisco Bug IDs: CSCvd86578.

cpe:/o:cisco:nx-os:7.0%288%29n1%281%29 cpe:/o:cisco:nx-os:7.1%284%29n1%281%29 cpe:/o:cisco:nx-os:7.3%281%29dx%280.119%29 cpe:/o:cisco:nx-os:7.3%281%29n1%280.6%29 cpe:/o:cisco:nx-os:7.3%282%29n1%280.350%29 cpe:/o:cisco:nx-os:7.3%283%29d1%280.2%29 cpe:/o:cisco:nx-os:8.0%280.54%29s0 cpe:/o:cisco:nx-os:8.1%280%29bd%280.20%29 cpe:/o:cisco:nx-os:8.1%280.9%29 cpe:/o:cisco:nx-os:8.2%280.4%29s0 cpe:/o:cisco:nx-os:8.3%280%29spg%280.30%29 cpe:/o:cisco:nx-os:8.8%283.5%29s0

CVE-2018-0337

2018-06-21T07:29:00.837-04:00

2019-10-09T19:31:48.350-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-nxos-rbaccess A vulnerability in the role-based access-checking mechanisms of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on an affected device. The vulnerability exists because the affected software lacks proper input and validation checks for certain file systems. An attacker could exploit this vulnerability by issuing crafted commands in the CLI of an affected device. A successful exploit could allow the attacker to cause other users to execute unwanted, arbitrary commands on the affected device. Cisco Bug IDs: CSCvd06339, CSCvd15698, CSCvd36108, CSCvf52921, CSCvf52930, CSCvf52953, CSCvf52976.

cpe:/a:cisco:unified_computing_system:5.5%28203%29 cpe:/a:cisco:unified_computing_system:7.0%280%29bz%280.46%29 cpe:/a:cisco:unified_computing_system:9.0%28100.20%29b cpe:/a:cisco:unified_computing_system:9.1%281.13%29 cpe:/a:cisco:unified_computing_system:9.9%280.902%29

CVE-2018-0338

2018-06-07T17:29:00.637-04:00

2019-10-09T19:31:48.507-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 104456 SECTRACK 1041071 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-ucs-access A vulnerability in the role-based access-checking mechanisms of Cisco Unified Computing System (UCS) Software could allow an authenticated, local attacker to execute arbitrary commands on an affected system. The vulnerability exists because the affected software lacks proper input and validation checks for certain file systems. An attacker could exploit this vulnerability by issuing crafted commands in the CLI of an affected system. A successful exploit could allow the attacker to cause other users to execute unwanted arbitrary commands on the affected system. Cisco Bug IDs: CSCvf52994.

cpe:/a:cisco:identity_services_engine_software:2.3%280.298%29 cpe:/a:cisco:identity_services_engine_software:2.4%280.126%29

CVE-2018-0339

2018-06-07T17:29:00.667-04:00

2019-10-09T19:31:48.630-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104424 SECTRACK 1041066 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-ise-xss A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient input validation of some parameters passed to the web-based management interface. An attacker could exploit this vulnerability by convincing a user of the interface to click a specific link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvf72309.

CVE-2018-0340

2018-06-07T17:29:00.713-04:00

2019-10-09T19:31:48.787-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104448 SECTRACK 1041070 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-ucm-xss A vulnerability in the web framework of the Cisco Unified Communications Manager (Unified CM) software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of the affected system. The vulnerability is due to insufficient input validation of certain parameters passed to the web server. An attacker could exploit this vulnerability by convincing the user to access a malicious link or by intercepting the user request and injecting certain malicious code. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected site or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvj00512.

cpe:/o:cisco:ip_phone_multiplatform_firmware:11.1%282%29

CVE-2018-0341

2018-07-16T13:29:00.237-04:00

2019-10-09T19:31:48.910-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov BID 104731 SECTRACK 1041285 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180711-phone-webui-inject A vulnerability in the web-based UI of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware before 11.2(1) could allow an authenticated, remote attacker to perform a command injection and execute commands with the privileges of the web server. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by including arbitrary shell commands in a specific user input field. Cisco Bug IDs: CSCvi51426.

cpe:/a:cisco:vbond_orchestrator:- cpe:/a:cisco:vedge-plus:- cpe:/a:cisco:vedge-pro:- cpe:/a:cisco:vmanage_network_management:- cpe:/a:cisco:vsmart_controller:-

CVE-2018-0342

2018-07-18T19:29:00.243-04:00

2019-10-09T19:31:49.053-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 104877 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-sd-wan-bo A vulnerability in the configuration and monitoring service of the Cisco SD-WAN Solution could allow an authenticated, local attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. The vulnerability is due to incomplete bounds checks for data that is provided by the configuration and monitoring service of the affected solution. An attacker could exploit this vulnerability by sending malicious data to the vDaemon listening service on an affected device. A successful exploit could allow the attacker to cause a buffer overflow condition on the affected device, which could allow the attacker to execute arbitrary code with root privileges on the device or cause the vDaemon listening service to reload and result in a DoS condition on the device. This vulnerability affects the following Cisco products if they are running a release of the Cisco SD-WAN Solution prior to Release 18.3.0: vBond Orchestrator Software, vEdge 100 Series Routers, vEdge 1000 Series Routers, vEdge 2000 Series Routers, vEdge 5000 Series Routers, vEdge Cloud Router Platform, vManage Network Management Software, vSmart Controller Software. Cisco Bug IDs: CSCvi70003.

cpe:/a:cisco:vbond_orchestrator:- cpe:/a:cisco:vedge-plus:- cpe:/a:cisco:vedge-pro:- cpe:/a:cisco:vmanage_network_management:- cpe:/a:cisco:vsmart_controller:-

CVE-2018-0343

2018-07-18T19:29:00.290-04:00

2019-10-09T19:31:49.317-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov BID 104861 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-sd-wan-code-ex A vulnerability in the configuration and management service of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to execute arbitrary code with vmanage user privileges or cause a denial of service (DoS) condition on an affected system. The vulnerability is due to insufficient access restrictions to the HTTP management interface of the affected solution. An attacker could exploit this vulnerability by sending a malicious HTTP request to the affected management service through an authenticated device. A successful exploit could allow the attacker to execute arbitrary code with vmanage user privileges or stop HTTP services on an affected system. This vulnerability affects the following Cisco products if they are running a release of the Cisco SD-WAN Solution prior to Release 18.3.0: vBond Orchestrator Software, vEdge 100 Series Routers, vEdge 1000 Series Routers, vEdge 2000 Series Routers, vEdge 5000 Series Routers, vEdge Cloud Router Platform, vManage Network Management Software, vSmart Controller Software. Cisco Bug IDs: CSCvi69976.

cpe:/a:cisco:vbond_orchestrator:- cpe:/a:cisco:vedge-plus:- cpe:/a:cisco:vedge-pro:- cpe:/a:cisco:vmanage_network_management:- cpe:/a:cisco:vsmart_controller:-

CVE-2018-0344

2018-07-18T19:29:00.337-04:00

2019-10-09T19:31:49.553-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov BID 104868 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-sd-wan-cmd-inject A vulnerability in the vManage dashboard for the configuration and management service of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject and execute arbitrary commands with vmanage user privileges on an affected system. The vulnerability is due to insufficient input validation of data parameters for certain fields in the affected solution. An attacker could exploit this vulnerability by configuring a malicious username on the login page of the affected solution. A successful exploit could allow the attacker to inject and execute arbitrary commands with vmanage user privileges on an affected system. This vulnerability affects the following Cisco products if they are running a release of the Cisco SD-WAN Solution prior to Release 18.3.0: vBond Orchestrator Software, vEdge 100 Series Routers, vEdge 1000 Series Routers, vEdge 2000 Series Routers, vEdge 5000 Series Routers, vEdge Cloud Router Platform, vManage Network Management Software, vSmart Controller Software. Cisco Bug IDs: CSCvi69974.

cpe:/a:cisco:vbond_orchestrator:- cpe:/a:cisco:vedge-plus:- cpe:/a:cisco:vedge-pro:- cpe:/a:cisco:vmanage_network_management:- cpe:/a:cisco:vsmart_controller:-

CVE-2018-0345

2018-07-18T19:29:00.383-04:00

2019-10-09T19:31:49.787-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov BID 104859 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-sdwan-cx A vulnerability in the configuration and management database of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to execute arbitrary commands with the privileges of the vmanage user in the configuration management system of the affected software. The vulnerability is due to insufficient validation of command arguments that are passed to the configuration and management database of the affected software. An attacker could exploit this vulnerability by creating custom functions that contain malicious code and are executed as the vmanage user of the configuration management system. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the vmanage user in the configuration management system of the affected software. This vulnerability affects the following Cisco products if they are running a release of the Cisco SD-WAN Solution prior to Release 18.3.0: vBond Orchestrator Software, vManage Network Management Software, vSmart Controller Software. Cisco Bug IDs: CSCvi69937.

cpe:/a:cisco:vbond_orchestrator:- cpe:/a:cisco:vedge-plus:- cpe:/a:cisco:vedge-pro:- cpe:/a:cisco:vmanage_network_management:- cpe:/a:cisco:vsmart_controller:-

CVE-2018-0346

2018-07-18T19:29:00.447-04:00

2019-10-09T19:31:50.007-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 104855 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-sdwan-dos A vulnerability in the Zero Touch Provisioning service of the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to incorrect bounds checks for certain values in packets that are sent to the Zero Touch Provisioning service of the affected software. An attacker could exploit this vulnerability by sending malicious packets to the affected software for processing. When the software processes the packets, a buffer overflow condition could occur and cause an affected device to reload. A successful exploit could allow the attacker to cause a temporary DoS condition while the device reloads. This vulnerability can be exploited only by traffic that is destined for an affected device. It cannot be exploited by traffic that is transiting a device. This vulnerability affects the following Cisco products if they are running a release of the Cisco SD-WAN Solution prior to Release 18.3.0: vBond Orchestrator Software, vManage Network Management Software, vSmart Controller Software. Cisco Bug IDs: CSCvi69914.

cpe:/a:cisco:vbond_orchestrator:- cpe:/a:cisco:vedge-plus:- cpe:/a:cisco:vedge-pro:- cpe:/a:cisco:vmanage_network_management:- cpe:/a:cisco:vsmart_controller:-

CVE-2018-0347

2018-07-18T19:29:00.493-04:00

2019-10-09T19:31:50.257-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 104862 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-sdwan-ci A vulnerability in the Zero Touch Provisioning (ZTP) subsystem of the Cisco SD-WAN Solution could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting malicious input to the affected parameter. The attacker must be authenticated to access the affected parameter. A successful exploit could allow an attacker to execute commands with root privileges. This vulnerability affects the following Cisco products if they are running a release of the Cisco SD-WAN Solution prior to Release 18.3.0: vEdge 100 Series Routers, vEdge 1000 Series Routers, vEdge 2000 Series Routers, vEdge 5000 Series Routers. Cisco Bug IDs: CSCvi69906.

cpe:/a:cisco:vbond_orchestrator:- cpe:/a:cisco:vedge-plus:- cpe:/a:cisco:vedge-pro:- cpe:/a:cisco:vmanage_network_management:- cpe:/a:cisco:vsmart_controller:-

CVE-2018-0348

2018-07-18T19:29:00.527-04:00

2019-10-09T19:31:50.507-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov BID 104875 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-sdwan-cmdnjct A vulnerability in the CLI of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting malicious input to the load command within the VPN subsystem. The attacker must be authenticated to access the affected CLI parameter. A successful exploit could allow an attacker to execute commands with root privileges. This vulnerability affects the following Cisco products if they are running a release of the Cisco SD-WAN Solution prior to Release 18.3.0: vBond Orchestrator Software, vEdge 100 Series Routers, vEdge 1000 Series Routers, vEdge 2000 Series Routers, vEdge 5000 Series Routers, vEdge Cloud Router Platform, vManage Network Management Software, vSmart Controller Software. Cisco Bug IDs: CSCvi69866.

cpe:/a:cisco:vbond_orchestrator:- cpe:/a:cisco:vedge-plus:- cpe:/a:cisco:vedge-pro:- cpe:/a:cisco:vmanage_network_management:- cpe:/a:cisco:vsmart_controller:-

CVE-2018-0349

2018-07-18T19:29:00.587-04:00

2019-10-09T19:31:50.803-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 104854 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-sdwan-fo A vulnerability in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to overwrite arbitrary files on the underlying operating system of an affected device. The vulnerability is due to improper input validation of the request admin-tech command in the CLI of the affected software. An attacker could exploit this vulnerability by modifying the request admin-tech command in the CLI of an affected device. A successful exploit could allow the attacker to overwrite arbitrary files on the underlying operating system of an affected device and escalate their privileges to the root user. This vulnerability affects the following Cisco products if they are running a release of the Cisco SD-WAN Solution prior to Release 18.3.0: vBond Orchestrator Software, vEdge 100 Series Routers, vEdge 1000 Series Routers, vEdge 2000 Series Routers, vEdge 5000 Series Routers, vEdge Cloud Router Platform, vManage Network Management Software, vSmart Controller Software. Cisco Bug IDs: CSCvi69852, CSCvi69856.

cpe:/a:cisco:vbond_orchestrator:- cpe:/a:cisco:vedge-plus:- cpe:/a:cisco:vedge-pro:- cpe:/a:cisco:vmanage_network_management:- cpe:/a:cisco:vsmart_controller:-

CVE-2018-0350

2018-07-18T19:29:00.633-04:00

2019-10-09T19:31:51.007-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov BID 104874 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-sdwan-cmdinj A vulnerability in the VPN subsystem configuration in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the affected parameter in a web page. The attacker must be authenticated to access the affected parameter. A successful exploit could allow the attacker to execute commands with root privileges. This vulnerability affects the following Cisco products if they are running a release of the Cisco SD-WAN Solution prior to Release 18.3.0: vBond Orchestrator Software, vEdge 100 Series Routers, vEdge 1000 Series Routers, vEdge 2000 Series Routers, vEdge 5000 Series Routers, vEdge Cloud Router Platform, vManage Network Management Software, vSmart Controller Software. Cisco Bug IDs: CSCvi69808, CSCvi69810, CSCvi69814, CSCvi69822, CSCvi69827, CSCvi69828, CSCvi69836.

cpe:/a:cisco:vbond_orchestrator:- cpe:/a:cisco:vedge-plus:- cpe:/a:cisco:vedge-pro:- cpe:/a:cisco:vmanage_network_management:- cpe:/a:cisco:vsmart_controller:-

CVE-2018-0351

2018-07-18T19:29:00.680-04:00

2019-10-09T19:31:51.223-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 104860 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-sdwan-coinj A vulnerability in the command-line tcpdump utility in the Cisco SD-WAN Solution could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the tcpdump utility. The attacker must be authenticated to access the tcpdump utility. A successful exploit could allow the attacker to execute commands with root privileges. This vulnerability affects the following Cisco products if they are running a release of the Cisco SD-WAN Solution prior to Release 18.3.0: vBond Orchestrator Software, vEdge 100 Series Routers, vEdge 1000 Series Routers, vEdge 2000 Series Routers, vEdge 5000 Series Routers, vEdge Cloud Router Platform, vManage Network Management Software, vSmart Controller Software. Cisco Bug IDs: CSCvi69751.

cpe:/a:cisco:wide_area_application_services:6.2%283%29

CVE-2018-0352

2018-06-07T17:29:00.760-04:00

2019-10-09T19:31:51.427-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 104464 SECTRACK 1041077 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-waas-priv-escalation A vulnerability in the Disk Check Tool (disk-check.sh) for Cisco Wide Area Application Services (WAAS) Software could allow an authenticated, local attacker to elevate their privilege level to root. The attacker must have valid user credentials with super user privileges (level 15) to log in to the device. The vulnerability is due to insufficient validation of script files executed in the context of the Disk Check Tool. An attacker could exploit this vulnerability by replacing one script file with a malicious script file while the affected tool is running. A successful exploit could allow the attacker to gain root-level privileges and take full control of the device. Cisco Bug IDs: CSCvi72673.

cpe:/a:cisco:web_security_appliance:10.5.1 cpe:/a:cisco:web_security_appliance:10.5.1-296 cpe:/a:cisco:web_security_appliance:10.5.2 cpe:/a:cisco:web_security_appliance:11.0.0 cpe:/a:cisco:web_security_appliance:11.5.0-fcs-442

CVE-2018-0353

2018-06-07T08:29:00.777-04:00

2019-10-09T19:31:51.537-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104417 SECTRACK 1041081 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-wsa A vulnerability in traffic-monitoring functions in Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to circumvent Layer 4 Traffic Monitor (L4TM) functionality and bypass security protections. The vulnerability is due to a change in the underlying operating system software that is responsible for monitoring affected traffic. An attacker could exploit this vulnerability by sending crafted IP packets to an affected device. A successful exploit could allow the attacker to pass traffic through the device, which the WSA was configured to deny. This vulnerability affects both IPv4 and IPv6 traffic. This vulnerability affects Cisco AsyncOS versions for WSA on both virtual and hardware appliances running any release of the 10.5.1, 10.5.2, or 11.0.0 WSA Software. The WSA is vulnerable if it is configured for L4TM. Cisco Bug IDs: CSCvg78875.

cpe:/a:cisco:unity_connection:12.5

CVE-2018-0354

2018-06-07T17:29:00.790-04:00

2019-10-09T19:31:51.660-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104426 SECTRACK 1041067 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-cuc-xss A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain parameters that are passed to the affected software via the HTTP GET and HTTP POST methods. An attacker who can convince a user to follow an attacker-supplied link could execute arbitrary script or HTML code in the user's browser in the context of an affected site. Cisco Bug IDs: CSCvf76417.

CVE-2018-0355

2018-06-07T17:29:00.837-04:00

2019-10-09T19:31:51.770-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104425 SECTRACK 1041068 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-cucm-xfs A vulnerability in the web UI of Cisco Unified Communications Manager (Unified CM) could allow an unauthenticated, remote attacker to conduct a cross-frame scripting (XFS) attack against the user of the web UI of an affected system. The vulnerability is due to insufficient protections for HTML inline frames (iframes) by the web UI of the affected software. An attacker could exploit this vulnerability by persuading a user of the affected UI to navigate to an attacker-controlled web page that contains a malicious HTML iframe. A successful exploit could allow the attacker to conduct click-jacking or other client-side browser attacks on the affected system. Cisco Bug IDs: CSCvg19761.

cpe:/a:cisco:webex_meetings:t32

CVE-2018-0356

2018-06-07T17:29:00.887-04:00

2019-10-09T19:31:51.880-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104421 SECTRACK 1041062 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-webex-xss A vulnerability in the web framework of Cisco WebEx could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain parameters that are passed to the affected software via the HTTP GET and HTTP POST methods. An attacker who can convince a user to follow an attacker-supplied link could execute arbitrary script or HTML code in the user's browser in the context of an affected site. Cisco Bug IDs: CSCvi63757.

cpe:/a:cisco:webex_meetings:1.3.5

CVE-2018-0357

2018-06-07T17:29:00.917-04:00

2019-10-09T19:31:51.990-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104420 SECTRACK 1041063 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-webex-xss1 A vulnerability in the web framework of Cisco WebEx could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain parameters that are passed to the affected software via the HTTP GET and HTTP POST methods. An attacker who can convince a user to follow an attacker-supplied link could execute arbitrary script or HTML code in the user's browser in the context of an affected site. Cisco Bug IDs: CSCvi71274.

cpe:/a:cisco:telepresence_video_communication_server:-::~~expressway~~~

CVE-2018-0358

2018-06-21T07:29:00.883-04:00

2019-10-09T19:31:52.100-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 104521 SECTRACK 1041172 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-vcse-dos A vulnerability in the file descriptor handling of Cisco TelePresence Video Communication Server (VCS) Expressway could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to exhaustion of file descriptors while processing a high volume of traffic. An attacker could exploit this vulnerability by establishing a high number of concurrent TCP connections to the vulnerable system. An exploit could allow the attacker to cause a restart in a specific process, resulting in a temporary interruption of service. Cisco Bug IDs: CSCvh77056, CSCvh77058, CSCvh95264.

cpe:/a:cisco:meeting_server:2.3.0

CVE-2018-0359

2018-06-21T07:29:00.930-04:00

2019-10-09T19:31:52.207-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104583 SECTRACK 1041174 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-cms-sf A vulnerability in the session identification management functionality of the web-based management interface for Cisco Meeting Server could allow an unauthenticated, local attacker to hijack a valid user session identifier, aka Session Fixation. The vulnerability exists because the affected application does not assign a new session identifier to a user session when a user authenticates to the application. An attacker could exploit this vulnerability by using a hijacked session identifier to connect to the application through the web-based management interface. A successful exploit could allow the attacker to hijack an authenticated user's browser session. Cisco Bug IDs: CSCvi23787.

cpe:/a:clamav:clamav:- cpe:/a:clamav:clamav:0.01 cpe:/a:clamav:clamav:0.02 cpe:/a:clamav:clamav:0.03 cpe:/a:clamav:clamav:0.05 cpe:/a:clamav:clamav:0.8:rc3 cpe:/a:clamav:clamav:0.9:rc1 cpe:/a:clamav:clamav:0.10 cpe:/a:clamav:clamav:0.12 cpe:/a:clamav:clamav:0.13 cpe:/a:clamav:clamav:0.14 cpe:/a:clamav:clamav:0.14:pre cpe:/a:clamav:clamav:0.15 cpe:/a:clamav:clamav:0.20 cpe:/a:clamav:clamav:0.21 cpe:/a:clamav:clamav:0.22 cpe:/a:clamav:clamav:0.23 cpe:/a:clamav:clamav:0.24 cpe:/a:clamav:clamav:0.51 cpe:/a:clamav:clamav:0.52 cpe:/a:clamav:clamav:0.53 cpe:/a:clamav:clamav:0.54 cpe:/a:clamav:clamav:0.60 cpe:/a:clamav:clamav:0.60p cpe:/a:clamav:clamav:0.65 cpe:/a:clamav:clamav:0.66 cpe:/a:clamav:clamav:0.67 cpe:/a:clamav:clamav:0.67-1 cpe:/a:clamav:clamav:0.68 cpe:/a:clamav:clamav:0.68.1 cpe:/a:clamav:clamav:0.70 cpe:/a:clamav:clamav:0.70:rc cpe:/a:clamav:clamav:0.70.0 cpe:/a:clamav:clamav:0.71 cpe:/a:clamav:clamav:0.71.0 cpe:/a:clamav:clamav:0.72 cpe:/a:clamav:clamav:0.72.0 cpe:/a:clamav:clamav:0.73 cpe:/a:clamav:clamav:0.73.0 cpe:/a:clamav:clamav:0.74 cpe:/a:clamav:clamav:0.74.0 cpe:/a:clamav:clamav:0.75 cpe:/a:clamav:clamav:0.75.0 cpe:/a:clamav:clamav:0.75.1 cpe:/a:clamav:clamav:0.80 cpe:/a:clamav:clamav:0.80:rc cpe:/a:clamav:clamav:0.80:rc1 cpe:/a:clamav:clamav:0.80:rc2 cpe:/a:clamav:clamav:0.80:rc3 cpe:/a:clamav:clamav:0.80:rc4 cpe:/a:clamav:clamav:0.80.0 cpe:/a:clamav:clamav:0.80_rc cpe:/a:clamav:clamav:0.81 cpe:/a:clamav:clamav:0.81:rc1 cpe:/a:clamav:clamav:0.81.0 cpe:/a:clamav:clamav:0.82 cpe:/a:clamav:clamav:0.82.0 cpe:/a:clamav:clamav:0.83 cpe:/a:clamav:clamav:0.83.0 cpe:/a:clamav:clamav:0.84 cpe:/a:clamav:clamav:0.84:rc1 cpe:/a:clamav:clamav:0.84:rc2 cpe:/a:clamav:clamav:0.84.0 cpe:/a:clamav:clamav:0.85 cpe:/a:clamav:clamav:0.85.0 cpe:/a:clamav:clamav:0.85.1 cpe:/a:clamav:clamav:0.86 cpe:/a:clamav:clamav:0.86:rc1 cpe:/a:clamav:clamav:0.86.0 cpe:/a:clamav:clamav:0.86.1 cpe:/a:clamav:clamav:0.86.2 cpe:/a:clamav:clamav:0.87 cpe:/a:clamav:clamav:0.87.0 cpe:/a:clamav:clamav:0.87.1 cpe:/a:clamav:clamav:0.88 cpe:/a:clamav:clamav:0.88.0 cpe:/a:clamav:clamav:0.88.1 cpe:/a:clamav:clamav:0.88.2 cpe:/a:clamav:clamav:0.88.3 cpe:/a:clamav:clamav:0.88.4 cpe:/a:clamav:clamav:0.88.5 cpe:/a:clamav:clamav:0.88.6 cpe:/a:clamav:clamav:0.88.7 cpe:/a:clamav:clamav:0.88.7_p0 cpe:/a:clamav:clamav:0.88.7_p1 cpe:/a:clamav:clamav:0.90 cpe:/a:clamav:clamav:0.90:rc1 cpe:/a:clamav:clamav:0.90:rc1.1 cpe:/a:clamav:clamav:0.90:rc2 cpe:/a:clamav:clamav:0.90:rc3 cpe:/a:clamav:clamav:0.90.0 cpe:/a:clamav:clamav:0.90.1 cpe:/a:clamav:clamav:0.90.1_p0 cpe:/a:clamav:clamav:0.90.2 cpe:/a:clamav:clamav:0.90.2_p0 cpe:/a:clamav:clamav:0.90.3 cpe:/a:clamav:clamav:0.90.3_p0 cpe:/a:clamav:clamav:0.90.3_p1 cpe:/a:clamav:clamav:0.91 cpe:/a:clamav:clamav:0.91:rc1 cpe:/a:clamav:clamav:0.91:rc2 cpe:/a:clamav:clamav:0.91.0 cpe:/a:clamav:clamav:0.91.1 cpe:/a:clamav:clamav:0.91.2 cpe:/a:clamav:clamav:0.91.2_p0 cpe:/a:clamav:clamav:0.92 cpe:/a:clamav:clamav:0.92.0 cpe:/a:clamav:clamav:0.92.1 cpe:/a:clamav:clamav:0.92_p0 cpe:/a:clamav:clamav:0.93 cpe:/a:clamav:clamav:0.93.0 cpe:/a:clamav:clamav:0.93.1 cpe:/a:clamav:clamav:0.93.2 cpe:/a:clamav:clamav:0.93.3 cpe:/a:clamav:clamav:0.94 cpe:/a:clamav:clamav:0.94.0 cpe:/a:clamav:clamav:0.94.1 cpe:/a:clamav:clamav:0.94.2 cpe:/a:clamav:clamav:0.95 cpe:/a:clamav:clamav:0.95:rc1 cpe:/a:clamav:clamav:0.95:rc2 cpe:/a:clamav:clamav:0.95:src1 cpe:/a:clamav:clamav:0.95:src2 cpe:/a:clamav:clamav:0.95.0 cpe:/a:clamav:clamav:0.95.1 cpe:/a:clamav:clamav:0.95.2 cpe:/a:clamav:clamav:0.95.3 cpe:/a:clamav:clamav:0.96 cpe:/a:clamav:clamav:0.96:rc1 cpe:/a:clamav:clamav:0.96:rc2 cpe:/a:clamav:clamav:0.96.0 cpe:/a:clamav:clamav:0.96.1 cpe:/a:clamav:clamav:0.96.2 cpe:/a:clamav:clamav:0.96.3 cpe:/a:clamav:clamav:0.96.4 cpe:/a:clamav:clamav:0.96.5 cpe:/a:clamav:clamav:0.97 cpe:/a:clamav:clamav:0.97:rc cpe:/a:clamav:clamav:0.97.0 cpe:/a:clamav:clamav:0.97.1 cpe:/a:clamav:clamav:0.97.2 cpe:/a:clamav:clamav:0.97.3 cpe:/a:clamav:clamav:0.97.4 cpe:/a:clamav:clamav:0.97.5 cpe:/a:clamav:clamav:0.97.6 cpe:/a:clamav:clamav:0.97.7 cpe:/a:clamav:clamav:0.97.8 cpe:/a:clamav:clamav:0.98.0 cpe:/a:clamav:clamav:0.98.1 cpe:/a:clamav:clamav:0.98.3 cpe:/a:clamav:clamav:0.98.4 cpe:/a:clamav:clamav:0.98.5 cpe:/a:clamav:clamav:0.98.6 cpe:/a:clamav:clamav:0.98.7 cpe:/a:clamav:clamav:0.99.0 cpe:/a:clamav:clamav:0.99.1 cpe:/a:clamav:clamav:0.99.2 cpe:/a:clamav:clamav:0.99.3 cpe:/a:clamav:clamav:0.99.4 cpe:/a:clamav:clamav:0.100.0 cpe:/o:canonical:ubuntu_linux:12.04::~~esm~~~ cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~ cpe:/o:debian:debian_linux:8.0

CVE-2018-0360

2018-07-16T13:29:00.283-04:00

2019-04-26T12:41:25.137-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-04-26T11:21:32.883-04:00

SECTRACK 1041367 CONFIRM https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html MLIST [debian-lts-announce] 20180820 [SECURITY] [DLA 1461-1] clamav security update MISC https://secuniaresearch.flexerasoftware.com/secunia_research/2018-12/ GENTOO GLSA-201904-12 UBUNTU USN-3722-1 UBUNTU USN-3722-2 ClamAV before 0.100.1 has an HWP integer overflow with a resultant infinite loop via a crafted Hangul Word Processor file. This is in parsehwp3_paragraph() in libclamav/hwp.c.

CVE-2018-0361

2018-07-16T13:29:00.330-04:00

2019-04-26T12:41:29.670-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-04-26T11:19:16.333-04:00

SECTRACK 1041367 CONFIRM https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html MLIST [debian-lts-announce] 20180820 [SECURITY] [DLA 1461-1] clamav security update GENTOO GLSA-201904-12 ClamAV before 0.100.1 lacks a PDF object length check, resulting in an unreasonably long time to parse a relatively small file.

cpe:/o:cisco:5100_enterprise_network_compute_system_firmware:3.2%283%29 cpe:/o:cisco:5400_enterprise_network_compute_system_firmware:3.2%283%29 cpe:/o:cisco:ucs-e1120d-k9_firmware:3.2%283%29 cpe:/o:cisco:ucs-e1120d-m3_firmware:3.2%283%29 cpe:/o:cisco:ucs-e140d-k9_firmware:3.2%283%29 cpe:/o:cisco:ucs-e140d-m1_firmware:3.2%283%29 cpe:/o:cisco:ucs-e140dp-k9_firmware:3.2%283%29 cpe:/o:cisco:ucs-e140dp-m1_firmware:3.2%283%29 cpe:/o:cisco:ucs-e140s-k9_firmware:3.2%283%29 cpe:/o:cisco:ucs-e140s-m1_firmware:3.2%283%29 cpe:/o:cisco:ucs-e140s-m2_firmware:3.2%283%29 cpe:/o:cisco:ucs-e160d-k9_firmware:3.2%283%29 cpe:/o:cisco:ucs-e160d-m1_firmware:3.2%283%29 cpe:/o:cisco:ucs-e160d-m2_firmware:3.2%283%29 cpe:/o:cisco:ucs-e160dp-k9_firmware:3.2%283%29 cpe:/o:cisco:ucs-e160dp-m1_firmware:3.2%283%29 cpe:/o:cisco:ucs-e160s-k9_firmware:3.2%283%29 cpe:/o:cisco:ucs-e160s-m3_firmware:3.2%283%29 cpe:/o:cisco:ucs-e180d-k9_firmware:3.2%283%29 cpe:/o:cisco:ucs-e180d-m2_firmware:3.2%283%29 cpe:/o:cisco:ucs-e180d-m3_firmware:3.2%283%29

CVE-2018-0362

2018-06-21T07:29:00.977-04:00

2019-10-09T19:31:52.397-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1041173 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-encs-ucs-bios-auth-bypass A vulnerability in BIOS authentication management of Cisco 5000 Series Enterprise Network Compute System and Cisco Unified Computing (UCS) E-Series Servers could allow an unauthenticated, local attacker to bypass the BIOS authentication and execute actions as an unprivileged user. The vulnerability is due to improper security restrictions that are imposed by the affected system. An attacker could exploit this vulnerability by submitting an empty password value to an affected device's BIOS authentication prompt. An exploit could allow the attacker to have access to a restricted set of user-level BIOS commands. Cisco Bug IDs: CSCvh83260.

cpe:/a:cisco:unified_communications_manager_im_and_presence_service:11.5%281%29

CVE-2018-0363

2018-06-21T07:29:01.023-04:00

2019-10-09T19:31:52.817-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 104523 SECTRACK 1041170 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-ucmim-ps-csrf A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service (formerly CUPS) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user. Cisco Bug IDs: CSCvi55878.

cpe:/a:cisco:unified_communications_domain_manager

CVE-2018-0364

2018-06-21T07:29:01.087-04:00

2019-10-09T19:31:52.943-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1041171 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-ucdm-csrf A vulnerability in the web-based management interface of Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user. Cisco Bug IDs: CSCvi44320.

cpe:/a:cisco:firepower_management_center:6.0.1 cpe:/a:cisco:firepower_management_center:6.1.0 cpe:/a:cisco:firepower_management_center:6.2.0 cpe:/a:cisco:firepower_management_center:6.2.1 cpe:/a:cisco:firepower_management_center:6.2.2 cpe:/a:cisco:firepower_management_center:6.2.3 cpe:/a:cisco:firepower_management_center_virtual_appliance:6.0.1 cpe:/a:cisco:firepower_management_center_virtual_appliance:6.1.0 cpe:/a:cisco:firepower_management_center_virtual_appliance:6.2.0 cpe:/a:cisco:firepower_management_center_virtual_appliance:6.2.1 cpe:/a:cisco:firepower_management_center_virtual_appliance:6.2.2 cpe:/a:cisco:firepower_management_center_virtual_appliance:6.2.3 cpe:/a:cisco:ngips_virtual_appliance:6.0.1 cpe:/a:cisco:ngips_virtual_appliance:6.1.0 cpe:/a:cisco:ngips_virtual_appliance:6.2.0 cpe:/a:cisco:ngips_virtual_appliance:6.2.1 cpe:/a:cisco:ngips_virtual_appliance:6.2.2 cpe:/a:cisco:ngips_virtual_appliance:6.2.3 cpe:/h:cisco:firepower_management_center_2500_firmware:6.0.1 cpe:/h:cisco:firepower_management_center_2500_firmware:6.1.0 cpe:/h:cisco:firepower_management_center_2500_firmware:6.2.0 cpe:/h:cisco:firepower_management_center_2500_firmware:6.2.1 cpe:/h:cisco:firepower_management_center_2500_firmware:6.2.2 cpe:/h:cisco:firepower_management_center_2500_firmware:6.2.3 cpe:/o:cisco:amp_7150_firmware:6.0.1 cpe:/o:cisco:amp_7150_firmware:6.1.0 cpe:/o:cisco:amp_7150_firmware:6.2.0 cpe:/o:cisco:amp_7150_firmware:6.2.1 cpe:/o:cisco:amp_7150_firmware:6.2.2 cpe:/o:cisco:amp_7150_firmware:6.2.3 cpe:/o:cisco:amp_8150_firmware:6.0.1 cpe:/o:cisco:amp_8150_firmware:6.1.0 cpe:/o:cisco:amp_8150_firmware:6.2.0 cpe:/o:cisco:amp_8150_firmware:6.2.1 cpe:/o:cisco:amp_8150_firmware:6.2.2 cpe:/o:cisco:amp_8150_firmware:6.2.3 cpe:/o:cisco:firepower_appliance_7010_firmware:6.0.1 cpe:/o:cisco:firepower_appliance_7010_firmware:6.1.0 cpe:/o:cisco:firepower_appliance_7010_firmware:6.2.0 cpe:/o:cisco:firepower_appliance_7010_firmware:6.2.1 cpe:/o:cisco:firepower_appliance_7010_firmware:6.2.2 cpe:/o:cisco:firepower_appliance_7010_firmware:6.2.3 cpe:/o:cisco:firepower_appliance_7020_firmware:6.0.1 cpe:/o:cisco:firepower_appliance_7020_firmware:6.1.0 cpe:/o:cisco:firepower_appliance_7020_firmware:6.2.0 cpe:/o:cisco:firepower_appliance_7020_firmware:6.2.1 cpe:/o:cisco:firepower_appliance_7020_firmware:6.2.2 cpe:/o:cisco:firepower_appliance_7020_firmware:6.2.3 cpe:/o:cisco:firepower_appliance_7030_firmware:6.0.1 cpe:/o:cisco:firepower_appliance_7030_firmware:6.1.0 cpe:/o:cisco:firepower_appliance_7030_firmware:6.2.0 cpe:/o:cisco:firepower_appliance_7030_firmware:6.2.1 cpe:/o:cisco:firepower_appliance_7030_firmware:6.2.2 cpe:/o:cisco:firepower_appliance_7030_firmware:6.2.3 cpe:/o:cisco:firepower_appliance_7050_firmware:6.0.1 cpe:/o:cisco:firepower_appliance_7050_firmware:6.1.0 cpe:/o:cisco:firepower_appliance_7050_firmware:6.2.0 cpe:/o:cisco:firepower_appliance_7050_firmware:6.2.1 cpe:/o:cisco:firepower_appliance_7050_firmware:6.2.2 cpe:/o:cisco:firepower_appliance_7050_firmware:6.2.3 cpe:/o:cisco:firepower_appliance_7110_firmware:6.0.1 cpe:/o:cisco:firepower_appliance_7110_firmware:6.1.0 cpe:/o:cisco:firepower_appliance_7110_firmware:6.2.0 cpe:/o:cisco:firepower_appliance_7110_firmware:6.2.1 cpe:/o:cisco:firepower_appliance_7110_firmware:6.2.2 cpe:/o:cisco:firepower_appliance_7110_firmware:6.2.3 cpe:/o:cisco:firepower_appliance_7115_firmware:6.0.1 cpe:/o:cisco:firepower_appliance_7115_firmware:6.1.0 cpe:/o:cisco:firepower_appliance_7115_firmware:6.2.0 cpe:/o:cisco:firepower_appliance_7115_firmware:6.2.1 cpe:/o:cisco:firepower_appliance_7115_firmware:6.2.2 cpe:/o:cisco:firepower_appliance_7115_firmware:6.2.3 cpe:/o:cisco:firepower_appliance_7120_firmware:6.0.1 cpe:/o:cisco:firepower_appliance_7120_firmware:6.1.0 cpe:/o:cisco:firepower_appliance_7120_firmware:6.2.0 cpe:/o:cisco:firepower_appliance_7120_firmware:6.2.1 cpe:/o:cisco:firepower_appliance_7120_firmware:6.2.2 cpe:/o:cisco:firepower_appliance_7120_firmware:6.2.3 cpe:/o:cisco:firepower_appliance_7125_firmware:6.0.1 cpe:/o:cisco:firepower_appliance_7125_firmware:6.1.0 cpe:/o:cisco:firepower_appliance_7125_firmware:6.2.0 cpe:/o:cisco:firepower_appliance_7125_firmware:6.2.1 cpe:/o:cisco:firepower_appliance_7125_firmware:6.2.2 cpe:/o:cisco:firepower_appliance_7125_firmware:6.2.3 cpe:/o:cisco:firepower_appliance_8120_firmware:6.0.1 cpe:/o:cisco:firepower_appliance_8120_firmware:6.1.0 cpe:/o:cisco:firepower_appliance_8120_firmware:6.2.0 cpe:/o:cisco:firepower_appliance_8120_firmware:6.2.1 cpe:/o:cisco:firepower_appliance_8120_firmware:6.2.2 cpe:/o:cisco:firepower_appliance_8120_firmware:6.2.3 cpe:/o:cisco:firepower_appliance_8130_firmware:6.0.1 cpe:/o:cisco:firepower_appliance_8130_firmware:6.1.0 cpe:/o:cisco:firepower_appliance_8130_firmware:6.2.0 cpe:/o:cisco:firepower_appliance_8130_firmware:6.2.1 cpe:/o:cisco:firepower_appliance_8130_firmware:6.2.2 cpe:/o:cisco:firepower_appliance_8130_firmware:6.2.3 cpe:/o:cisco:firepower_appliance_8140_firmware:6.0.1 cpe:/o:cisco:firepower_appliance_8140_firmware:6.1.0 cpe:/o:cisco:firepower_appliance_8140_firmware:6.2.0 cpe:/o:cisco:firepower_appliance_8140_firmware:6.2.1 cpe:/o:cisco:firepower_appliance_8140_firmware:6.2.2 cpe:/o:cisco:firepower_appliance_8140_firmware:6.2.3 cpe:/o:cisco:firepower_appliance_8250_firmware:6.0.1 cpe:/o:cisco:firepower_appliance_8250_firmware:6.1.0 cpe:/o:cisco:firepower_appliance_8250_firmware:6.2.0 cpe:/o:cisco:firepower_appliance_8250_firmware:6.2.1 cpe:/o:cisco:firepower_appliance_8250_firmware:6.2.2 cpe:/o:cisco:firepower_appliance_8250_firmware:6.2.3 cpe:/o:cisco:firepower_appliance_8260_firmware:6.0.1 cpe:/o:cisco:firepower_appliance_8260_firmware:6.1.0 cpe:/o:cisco:firepower_appliance_8260_firmware:6.2.0 cpe:/o:cisco:firepower_appliance_8260_firmware:6.2.1 cpe:/o:cisco:firepower_appliance_8260_firmware:6.2.2 cpe:/o:cisco:firepower_appliance_8260_firmware:6.2.3 cpe:/o:cisco:firepower_appliance_8270_firmware:6.0.1 cpe:/o:cisco:firepower_appliance_8270_firmware:6.1.0 cpe:/o:cisco:firepower_appliance_8270_firmware:6.2.0 cpe:/o:cisco:firepower_appliance_8270_firmware:6.2.1 cpe:/o:cisco:firepower_appliance_8270_firmware:6.2.2 cpe:/o:cisco:firepower_appliance_8270_firmware:6.2.3 cpe:/o:cisco:firepower_appliance_8290_firmware:6.0.1 cpe:/o:cisco:firepower_appliance_8290_firmware:6.1.0 cpe:/o:cisco:firepower_appliance_8290_firmware:6.2.0 cpe:/o:cisco:firepower_appliance_8290_firmware:6.2.1 cpe:/o:cisco:firepower_appliance_8290_firmware:6.2.2 cpe:/o:cisco:firepower_appliance_8290_firmware:6.2.3 cpe:/o:cisco:firepower_appliance_8350_firmware:6.0.1 cpe:/o:cisco:firepower_appliance_8350_firmware:6.1.0 cpe:/o:cisco:firepower_appliance_8350_firmware:6.2.0 cpe:/o:cisco:firepower_appliance_8350_firmware:6.2.1 cpe:/o:cisco:firepower_appliance_8350_firmware:6.2.2 cpe:/o:cisco:firepower_appliance_8350_firmware:6.2.3 cpe:/o:cisco:firepower_appliance_8360_firmware:6.0.1 cpe:/o:cisco:firepower_appliance_8360_firmware:6.1.0 cpe:/o:cisco:firepower_appliance_8360_firmware:6.2.0 cpe:/o:cisco:firepower_appliance_8360_firmware:6.2.1 cpe:/o:cisco:firepower_appliance_8360_firmware:6.2.2 cpe:/o:cisco:firepower_appliance_8360_firmware:6.2.3 cpe:/o:cisco:firepower_appliance_8370_firmware:6.0.1 cpe:/o:cisco:firepower_appliance_8370_firmware:6.1.0 cpe:/o:cisco:firepower_appliance_8370_firmware:6.2.0 cpe:/o:cisco:firepower_appliance_8370_firmware:6.2.1 cpe:/o:cisco:firepower_appliance_8370_firmware:6.2.2 cpe:/o:cisco:firepower_appliance_8370_firmware:6.2.3 cpe:/o:cisco:firepower_appliance_8390_firmware:6.0.1 cpe:/o:cisco:firepower_appliance_8390_firmware:6.1.0 cpe:/o:cisco:firepower_appliance_8390_firmware:6.2.0 cpe:/o:cisco:firepower_appliance_8390_firmware:6.2.1 cpe:/o:cisco:firepower_appliance_8390_firmware:6.2.2 cpe:/o:cisco:firepower_appliance_8390_firmware:6.2.3 cpe:/o:cisco:firepower_management_center_1000_firmware:6.0.1 cpe:/o:cisco:firepower_management_center_1000_firmware:6.1.0 cpe:/o:cisco:firepower_management_center_1000_firmware:6.2.0 cpe:/o:cisco:firepower_management_center_1000_firmware:6.2.1 cpe:/o:cisco:firepower_management_center_1000_firmware:6.2.2 cpe:/o:cisco:firepower_management_center_1000_firmware:6.2.3 cpe:/o:cisco:firepower_management_center_2000_firmware:6.0.1 cpe:/o:cisco:firepower_management_center_2000_firmware:6.1.0 cpe:/o:cisco:firepower_management_center_2000_firmware:6.2.0 cpe:/o:cisco:firepower_management_center_2000_firmware:6.2.1 cpe:/o:cisco:firepower_management_center_2000_firmware:6.2.2 cpe:/o:cisco:firepower_management_center_2000_firmware:6.2.3 cpe:/o:cisco:firepower_management_center_4000_firmware:6.0.1 cpe:/o:cisco:firepower_management_center_4000_firmware:6.1.0 cpe:/o:cisco:firepower_management_center_4000_firmware:6.2.0 cpe:/o:cisco:firepower_management_center_4000_firmware:6.2.1 cpe:/o:cisco:firepower_management_center_4000_firmware:6.2.2 cpe:/o:cisco:firepower_management_center_4000_firmware:6.2.3 cpe:/o:cisco:firepower_management_center_4500_firmware:6.0.1 cpe:/o:cisco:firepower_management_center_4500_firmware:6.1.0 cpe:/o:cisco:firepower_management_center_4500_firmware:6.2.0 cpe:/o:cisco:firepower_management_center_4500_firmware:6.2.1 cpe:/o:cisco:firepower_management_center_4500_firmware:6.2.2 cpe:/o:cisco:firepower_management_center_4500_firmware:6.2.3 cpe:/o:cisco:firesight_management_center_1500_firmware:6.0.1 cpe:/o:cisco:firesight_management_center_1500_firmware:6.1.0 cpe:/o:cisco:firesight_management_center_1500_firmware:6.2.0 cpe:/o:cisco:firesight_management_center_1500_firmware:6.2.1 cpe:/o:cisco:firesight_management_center_1500_firmware:6.2.2 cpe:/o:cisco:firesight_management_center_1500_firmware:6.2.3 cpe:/o:cisco:firesight_management_center_3500_firmware:6.0.1 cpe:/o:cisco:firesight_management_center_3500_firmware:6.1.0 cpe:/o:cisco:firesight_management_center_3500_firmware:6.2.0 cpe:/o:cisco:firesight_management_center_3500_firmware:6.2.1 cpe:/o:cisco:firesight_management_center_3500_firmware:6.2.2 cpe:/o:cisco:firesight_management_center_3500_firmware:6.2.3 cpe:/o:cisco:firesight_management_center_750_firmware:6.0.1 cpe:/o:cisco:firesight_management_center_750_firmware:6.1.0 cpe:/o:cisco:firesight_management_center_750_firmware:6.2.0 cpe:/o:cisco:firesight_management_center_750_firmware:6.2.1 cpe:/o:cisco:firesight_management_center_750_firmware:6.2.2 cpe:/o:cisco:firesight_management_center_750_firmware:6.2.3

CVE-2018-0365

2018-06-21T07:29:01.133-04:00

2019-10-09T19:31:53.067-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 104519 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-firepower-csrf A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions on the targeted device via a web browser and with the privileges of the user. Cisco Bug IDs: CSCvb19750.

cpe:/a:cisco:web_security_appliance:10.1.2-003 cpe:/a:cisco:web_security_appliance:10.5.1-276

CVE-2018-0366

2018-07-16T13:29:00.377-04:00

2019-10-09T19:31:53.757-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104724 SECTRACK 1041282 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180711-wsa-xss A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvf03514.

cpe:/a:cisco:registered_envelope_service:4.7 cpe:/a:cisco:registered_envelope_service:5.0 cpe:/a:cisco:registered_envelope_service:5.3 cpe:/a:cisco:registered_envelope_service:5.3.1 cpe:/a:cisco:registered_envelope_service:5.3.4

CVE-2018-0367

2018-08-15T16:29:00.300-04:00

2019-10-09T19:31:53.880-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 105109 CISCO 20180815 Cisco Registered Envelope Service Stored Cross-Site Scripting Vulnerability A vulnerability in the web-based management interface of the Cisco Registered Envelope Service could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected service. The vulnerability is due to insufficient validation of user-supplied input that is processed by the web-based management interface of the affected service. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information. Cisco Bug IDs: CVE-2018-0367.

cpe:/a:cisco:application_policy_infrastructure_controller_enterprise_module:1.1_base

CVE-2018-0368

2018-07-16T13:29:00.423-04:00

2019-10-09T19:31:54.020-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104729 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180711-dnac-id A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an authenticated, local attacker to access sensitive information on an affected system. The vulnerability is due to insufficient security restrictions imposed by the affected software. An attacker could exploit this vulnerability by accessing unprotected log files. A successful exploit could allow the attacker to access sensitive log files, which may include system credentials, on the affected device. Cisco Bug IDs: CSCvi22400.

cpe:/o:cisco:staros:21.3 cpe:/o:cisco:staros:21.4 cpe:/o:cisco:staros:21.5 cpe:/o:cisco:staros:21.6 cpe:/o:cisco:staros:21.6.0

CVE-2018-0369

2018-07-16T13:29:00.487-04:00

2019-10-09T19:31:54.130-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 104723 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180711-staros-dos A vulnerability in the reassembly logic for fragmented IPv4 packets of Cisco StarOS running on virtual platforms could allow an unauthenticated, remote attacker to trigger a reload of the npusim process, resulting in a denial of service (DoS) condition. There are four instances of the npusim process running per Service Function (SF) instance, each handling a subset of all traffic flowing across the device. It is possible to trigger a reload of all four instances of the npusim process around the same time. The vulnerability is due to improper handling of fragmented IPv4 packets containing options. An attacker could exploit this vulnerability by sending a malicious IPv4 packet across an affected device. An exploit could allow the attacker to trigger a restart of the npusim process, which will result in all traffic queued toward this instance of the npusim process to be dropped while the process is restarting. The npusim process typically restarts within less than a second. This vulnerability affects: Cisco Virtualized Packet Core-Single Instance (VPC-SI), Cisco Virtualized Packet Core-Distributed Instance (VPC-DI), Cisco Ultra Packet Core (UPC). Cisco Bug IDs: CSCvh29613.

cpe:/a:cisco:firepower_management_center:6.1.0.7 cpe:/a:cisco:firepower_management_center:6.2.0.5 cpe:/a:cisco:firepower_management_center:6.2.2.2

CVE-2018-0370

2018-07-16T13:29:00.533-04:00

2019-10-09T19:31:54.270-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 104728 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180711-firepower-dos A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause one of the detection engine processes to run out of memory and thus slow down traffic processing. The vulnerability is due to improper handling of traffic when the Secure Sockets Layer (SSL) inspection policy is enabled. An attacker could exploit this vulnerability by sending malicious traffic through an affected device. An exploit could allow the attacker to increase the resource consumption of a single instance of the Snort detection engine on an affected device. This will lead to performance degradation and eventually the restart of the affected Snort process. Cisco Bug IDs: CSCvi09219, CSCvi29845.

cpe:/a:cisco:meeting_server:2.2.5

CVE-2018-0371

2018-06-21T07:29:01.180-04:00

2019-10-09T19:31:54.397-04:00

6.8

NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov BID 104582 SECTRACK 1041175 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-meeting-server-dos A vulnerability in the Web Admin Interface of Cisco Meeting Server could allow an authenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to insufficient validation of incoming HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the Web Admin Interface of an affected Cisco Meeting Server. A successful exploit could allow the attacker to restart the system, terminating all ongoing calls and resulting in a DoS condition on the affected product. This vulnerability affects the following releases of Cisco Meeting Server: Acano X-Series, Cisco Meeting Server 1000, Cisco Meeting Server 2000. Cisco Bug IDs: CSCvi48624.

cpe:/o:cisco:nx-os:13.0%281k%29

CVE-2018-0372

2018-07-18T19:29:00.727-04:00

2019-10-09T19:31:54.507-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1041348 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-20180718-nexus-9000-dos A vulnerability in the DHCPv6 feature of the Cisco Nexus 9000 Series Fabric Switches in Application-Centric Infrastructure (ACI) Mode could allow an unauthenticated, remote attacker to cause the device to run low on system memory, which could result in a Denial of Service (DoS) condition on an affected system. The vulnerability is due to improper memory management when DHCPv6 packets are received on an interface of the targeted device. An attacker could exploit this vulnerability by sending a high number of malicious DHCPv6 packets to be processed by an affected device. A successful exploit could allow the attacker to cause the system to run low on memory, which could cause an eventual reboot of an affected device. The vulnerability only applies to IPv6 protocol packets and not for IPv4 protocol packets. This vulnerability affects Cisco Nexus 9000 Series Fabric Switches in ACI Mode running software version 13.0(1k). The vulnerability can only be exploited when unicast routing is enabled on the Bridge Domain (BD). DHCP and DHCP relay do not have to be configured for the vulnerability to be exploited. Cisco Bug IDs: CSCvg38918.

cpe:/a:cisco:anyconnect_secure_mobility_client:4.5%2858%29 cpe:/a:cisco:anyconnect_secure_mobility_client:4.5%281044%29 cpe:/a:cisco:anyconnect_secure_mobility_client:4.5%282033%29 cpe:/a:cisco:anyconnect_secure_mobility_client:4.5%282036%29 cpe:/a:cisco:anyconnect_secure_mobility_client:4.5%283040%29 cpe:/a:cisco:anyconnect_secure_mobility_client:4.5%284029%29 cpe:/a:cisco:anyconnect_secure_mobility_client:4.5%285030%29 cpe:/a:cisco:anyconnect_secure_mobility_client:4.6%28362%29 cpe:/a:cisco:anyconnect_secure_mobility_client:4.6%281098%29

CVE-2018-0373

2018-06-21T07:29:01.227-04:00

2019-10-09T19:31:54.663-04:00

4.9

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 104548 SECTRACK 1041176 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-anyconnect-dos A vulnerability in vpnva-6.sys for 32-bit Windows and vpnva64-6.sys for 64-bit Windows of Cisco AnyConnect Secure Mobility Client for Windows Desktop could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected system. The vulnerability is due to improper validation of user-supplied data. An attacker could exploit this vulnerability by sending a malicious request to the application. A successful exploit could allow the attacker to cause a DoS condition on the affected system. Cisco Bug IDs: CSCvj47654.

cpe:/a:cisco:mobility_services_engine:14.0.0

CVE-2018-0374

2018-07-18T19:29:00.777-04:00

2019-10-09T19:31:54.787-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 104851 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-policy-unauth-access A vulnerability in the Policy Builder database of Cisco Policy Suite before 18.2.0 could allow an unauthenticated, remote attacker to connect directly to the Policy Builder database. The vulnerability is due to a lack of authentication. An attacker could exploit this vulnerability by connecting directly to the Policy Builder database. A successful exploit could allow the attacker to access and change any data in the Policy Builder database. Cisco Bug IDs: CSCvh06134.

cpe:/a:cisco:mobility_services_engine:14.0.0 cpe:/a:cisco:policy_suite:10.0.0 cpe:/a:cisco:policy_suite:10.1.0 cpe:/a:cisco:policy_suite:11.0.0 cpe:/a:cisco:policy_suite:11.1.0 cpe:/a:cisco:policy_suite:18.1.0

CVE-2018-0375

2018-07-18T19:29:00.807-04:00

2019-10-09T19:31:54.913-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 104852 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-policy-cm-default-psswrd A vulnerability in the Cluster Manager of Cisco Policy Suite before 18.2.0 could allow an unauthenticated, remote attacker to log in to an affected system using the root account, which has default, static user credentials. The vulnerability is due to the presence of undocumented, static user credentials for the root account. An attacker could exploit this vulnerability by using the account to log in to an affected system. An exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user. Cisco Bug IDs: CSCvh02680.

cpe:/a:cisco:mobility_services_engine:18.0.0 cpe:/a:cisco:policy_suite:10.0.0 cpe:/a:cisco:policy_suite:10.1.0 cpe:/a:cisco:policy_suite:11.0.0 cpe:/a:cisco:policy_suite:11.1.0 cpe:/a:cisco:policy_suite:18.1.0

CVE-2018-0376

2018-07-18T19:29:00.867-04:00

2019-10-09T19:31:55.053-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 104849 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-pspb-unauth-access A vulnerability in the Policy Builder interface of Cisco Policy Suite before 18.2.0 could allow an unauthenticated, remote attacker to access the Policy Builder interface. The vulnerability is due to a lack of authentication. An attacker could exploit this vulnerability by accessing the Policy Builder interface. A successful exploit could allow the attacker to make changes to existing repositories and create new repositories. Cisco Bug IDs: CSCvi35109.

cpe:/a:cisco:mobility_services_engine:14.0.0 cpe:/a:cisco:policy_suite:10.0.0 cpe:/a:cisco:policy_suite:10.1.0 cpe:/a:cisco:policy_suite:11.0.0 cpe:/a:cisco:policy_suite:11.1.0

CVE-2018-0377

2018-07-18T19:29:00.900-04:00

2019-10-09T19:31:55.163-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 104850 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-ps-osgi-unauth-access A vulnerability in the Open Systems Gateway initiative (OSGi) interface of Cisco Policy Suite before 18.1.0 could allow an unauthenticated, remote attacker to directly connect to the OSGi interface. The vulnerability is due to a lack of authentication. An attacker could exploit this vulnerability by directly connecting to the OSGi interface. An exploit could allow the attacker to access or change any files that are accessible by the OSGi process. Cisco Bug IDs: CSCvh18017.

cpe:/o:cisco:nx-os:7.3%282%29n1%280.8%29

CVE-2018-0378

2018-10-17T17:49:52.787-04:00

2019-10-09T19:31:55.303-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 105669 SECTRACK 1041920 CISCO 20181017 Cisco NX-OS Software for Nexus 5500, 5600, and 6000 Series Switches Precision Time Protocol Denial of Service Vulnerability A vulnerability in the Precision Time Protocol (PTP) feature of Cisco Nexus 5500, 5600, and 6000 Series Switches running Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of protection against PTP frame flood attacks. An attacker could exploit this vulnerability by sending large streams of malicious IPv4 or IPv6 PTP traffic to the affected device. A successful exploit could allow the attacker to cause a DoS condition, impacting the traffic passing through the device.

cpe:/a:cisco:webex_business_suite:31.23 cpe:/a:cisco:webex_business_suite:32.15 cpe:/a:cisco:webex_business_suite:33.0.6 cpe:/a:cisco:webex_business_suite:33.1.1 cpe:/a:cisco:webex_business_suite:33.2 cpe:/a:cisco:webex_meeting_server:3.0:mr1 cpe:/a:cisco:webex_meetings_online:- cpe:/a:cisco:webex_meetings_online:1.3.35

CVE-2018-0379

2018-07-18T19:29:00.963-04:00

2019-10-09T19:31:55.537-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 104853 SECTRACK 1041347 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-webex-rce Multiple vulnerabilities exist in the Cisco Webex Network Recording Player for Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit these vulnerabilities by providing a user with a malicious .arf or .wrf file via email or URL and convincing the user to launch the file in the Webex recording players. Exploitation of these vulnerabilities could allow arbitrary code execution on the system of a targeted user. These vulnerabilities affect ARF and WRF recording players available from Cisco Webex Meetings Suite sites, Cisco Webex Meetings Online sites, and Cisco Webex Meetings Server. Cisco Bug IDs: CSCvi02621, CSCvi02965, CSCvi63329, CSCvi63333, CSCvi63335, CSCvi63374, CSCvi63376, CSCvi63377, CSCvi63391, CSCvi63392, CSCvi63396, CSCvi63495, CSCvi63497, CSCvi63498, CSCvi82684, CSCvi82700, CSCvi82705, CSCvi82725, CSCvi82737, CSCvi82742, CSCvi82760, CSCvi82771, CSCvj51284, CSCvj51294.

cpe:/a:cisco:webex_meetings_online:t30 cpe:/a:cisco:webex_meetings_online:t31 cpe:/a:cisco:webex_meetings_online:t31.20 cpe:/a:cisco:webex_meetings_online:t31.23 cpe:/a:cisco:webex_meetings_online:t31.23.2

CVE-2018-0380

2018-07-18T19:29:01.010-04:00

2019-10-09T19:31:55.707-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 104880 SECTRACK 1041351 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-webex-dos Multiple vulnerabilities exist in the Cisco Webex Network Recording Player for Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit these vulnerabilities by providing a user with a malicious .arf or .wrf file via email or URL and convincing the user to launch the file in the Webex recording players. Exploitation of these vulnerabilities could cause an affected player to crash, resulting in a denial of service (DoS) condition. The Cisco Webex players are applications that are used to play back Webex meetings that have been recorded by an online meeting attendee. The Webex Network Recording Player for .arf files can be automatically installed when the user accesses a recording that is hosted on a Webex server. The Webex Player for .wrf files can be downloaded manually. These vulnerabilities affect ARF and WRF recording players available from Cisco Webex Meetings Suite sites, Cisco Webex Meetings Online sites, and Cisco Webex Meetings Server. Cisco Bug IDs: CSCvh70253, CSCvh70268, CSCvh72272, CSCvh72281, CSCvh72285, CSCvi60477, CSCvi60485, CSCvi60490, CSCvi60520, CSCvi60529, CSCvi60533.

cpe:/o:cisco:aironet_series_access_points:8.2%28166.0%29 cpe:/o:cisco:aironet_series_access_points:8.2%28167.3%29 cpe:/o:cisco:aironet_series_access_points:8.3%28133.0%29 cpe:/o:cisco:aironet_series_access_points:8.3%28141.10%29 cpe:/o:cisco:aironet_series_access_points:8.5%28120.0%29 cpe:/o:cisco:aironet_series_access_points:8.7%281.96%29 cpe:/o:cisco:aironet_series_access_points:8.7%281.99%29 cpe:/o:cisco:aironet_series_access_points:8.7%281.107%29

CVE-2018-0381

2018-10-17T18:29:00.253-04:00

2019-10-09T19:31:55.897-04:00

5.5

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov BID 105685 SECTRACK 1041929 CISCO 20181017 Cisco Aironet 1560, 1800, 2800, and 3800 Series Access Points Denial of Service Vulnerability A vulnerability in the Cisco Aironet Series Access Points (APs) software could allow an authenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to a deadlock condition that may occur when an affected AP attempts to dequeue aggregated traffic that is destined to an attacker-controlled wireless client. An attacker who can successfully transition between multiple Service Set Identifiers (SSIDs) hosted on the same AP while replicating the required traffic patterns could trigger the deadlock condition. A watchdog timer that detects the condition will trigger a reload of the device, resulting in a DoS condition while the device restarts.

cpe:/a:cisco:wireless_lan_controller_software:8.1%28111.0%29 cpe:/a:cisco:wireless_lan_controller_software:8.5%28120.0%29

CVE-2018-0382

2019-04-17T18:29:00.280-04:00

2019-10-09T19:31:56.100-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 108005 CISCO 20190417 Cisco Wireless LAN Controller Software Session Hijacking Vulnerability A vulnerability in the session identification management functionality of the web-based interface of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. The vulnerability exists because the affected software does not properly clear previously assigned session identifiers for a user session when a user authenticates to the web-based interface. An attacker could exploit this vulnerability by using an existing session identifier to connect to the software through the web-based interface. Successful exploitation could allow the attacker to hijack an authenticated user's browser session on the system. Versions 8.1 and 8.5 are affected.

cpe:/a:cisco:firepower_management_center:6.2.2.1 cpe:/a:cisco:firepower_management_center:6.2.3 cpe:/a:cisco:firepower_management_center:6.3.0

CVE-2018-0383

2018-07-16T13:29:00.597-04:00

2019-10-09T19:31:56.287-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104726 SECTRACK 1041283 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180711-firesight-file-bypass A vulnerability in the detection engine of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass a file policy that is configured to block the transfer of files to an affected system via FTP. The vulnerability exists because the affected software incorrectly handles FTP control connections. An attacker could exploit this vulnerability by sending a maliciously crafted FTP connection to transfer a file to an affected device. A successful exploit could allow the attacker to bypass a file policy that is configured to apply the Block upload with reset action to FTP traffic. Cisco Bug IDs: CSCvh70130.

cpe:/a:cisco:firepower_management_center:6.0.0 cpe:/a:cisco:firepower_management_center:6.1.0 cpe:/a:cisco:firepower_management_center:6.2.0 cpe:/a:cisco:firepower_management_center:6.2.1 cpe:/a:cisco:firepower_management_center:6.2.2

CVE-2018-0384

2018-07-16T13:29:00.643-04:00

2019-10-09T19:31:56.443-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104725 SECTRACK 1041284 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180711-firesight-url-bypass A vulnerability in the detection engine of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass a URL-based access control policy that is configured to block traffic for an affected system. The vulnerability exists because the affected software incorrectly handles TCP packets that are received out of order when a TCP SYN retransmission is issued. An attacker could exploit this vulnerability by sending a maliciously crafted connection through an affected device. A successful exploit could allow the attacker to bypass a URL-based access control policy that is configured to block traffic for the affected system. Cisco Bug IDs: CSCvh84511.

CVE-2018-0385

2018-07-16T13:29:00.690-04:00

2019-10-09T19:31:56.583-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 104727 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180711-firepwr-ssl-dos A vulnerability in the detection engine parsing of Security Socket Layer (SSL) protocol packets for Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition due to the Snort process unexpectedly restarting. The vulnerability is due to improper input handling of the SSL traffic. An attacker could exploit this vulnerability by sending a crafted SSL traffic to the detection engine on the targeted device. An exploit could allow the attacker to cause a DoS condition if the Snort process restarts and traffic inspection is bypassed or traffic is dropped. Cisco Bug IDs: CSCvi36434.

cpe:/a:cisco:hosted_collaboration_solution:11.5%281%29 cpe:/a:cisco:unified_communications_domain_manager:-

CVE-2018-0386

2018-08-15T16:29:00.407-04:00

2019-10-09T19:31:56.710-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 105113 SECTRACK 1041537 CISCO 20180815 Cisco Unified Communications Domain Manager Reflected Cross-Site Scripting Vulnerability A vulnerability in Cisco Unified Communications Domain Manager Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on an affected system. The vulnerability is due to improper validation of input that is passed to the affected software. An attacker could exploit this vulnerability by persuading a user of the affected software to access a malicious URL. A successful exploit could allow the attacker to access sensitive, browser-based information on the affected system or perform arbitrary actions in the affected software in the security context of the user. Cisco Bug IDs: CSCvh49694.

cpe:/a:cisco:webex_teams:-

CVE-2018-0387

2018-07-18T19:29:01.040-04:00

2019-10-09T19:31:56.850-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 104873 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-webex-teams-rce A vulnerability in Cisco Webex Teams (for Windows and macOS) could allow an unauthenticated, remote attacker to execute arbitrary code on the user's device, possibly with elevated privileges. The vulnerability occurs because Cisco Webex Teams does not properly sanitize input. An attacker could exploit the vulnerability by sending a user a malicious link and persuading the user to follow the link. A successful exploit could allow the attacker to execute arbitrary code on the user's system. Cisco Bug IDs: CSCvh66250.

cpe:/o:cisco:wireless_lan_controller:8.3%28133.0%29 cpe:/o:cisco:wireless_lan_controller:8.3%28135.0%29 cpe:/o:cisco:wireless_lan_controller:8.5%28120.0%29

CVE-2018-0388

2018-10-17T15:29:00.227-04:00

2019-10-09T19:31:56.990-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 105665 SECTRACK 1041927 CISCO 20181017 Cisco Wireless LAN Controller Software Cross-Site Scripting Vulnerability A vulnerability in the web-based interface of Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web-based interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information.

cpe:/o:cisco:spa514g_firmware:7.6.2sr2

CVE-2018-0389

2019-03-13T17:29:00.260-04:00

2019-10-09T19:31:57.163-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 107402 CISCO 20190313 Cisco Small Business SPA514G IP Phones SIP Denial of Service Vulnerability A vulnerability in the implementation of Session Initiation Protocol (SIP) processing in Cisco Small Business SPA514G IP Phones could allow an unauthenticated, remote attacker to cause an affected device to become unresponsive, resulting in a denial of service (DoS) condition. The vulnerability is due to improper processing of SIP request messages by an affected device. An attacker could exploit this vulnerability by sending crafted SIP messages to an affected device. A successful exploit could allow the attacker to cause the affected device to become unresponsive, resulting in a DoS condition that persists until the device is restarted manually. Cisco has not released software updates that address this vulnerability. This vulnerability affects Cisco Small Business SPA514G IP Phones that are running firmware release 7.6.2SR2 or earlier.

cpe:/a:cisco:webex_meetings:2.0

CVE-2018-0390

2018-07-18T19:29:01.103-04:00

2019-10-09T19:31:57.397-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104865 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-webex-DOM-xss A vulnerability in the web framework of Cisco Webex could allow an unauthenticated, remote attacker to conduct a Document Object Model-based (DOM-based) cross-site scripting (XSS) attack against the user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain parameters that are passed to the affected software by using the HTTP POST method. An attacker who can submit malicious scripts to the affected user interface element could execute arbitrary script or HTML code in the user's browser in the context of the affected site. Cisco Bug IDs: CSCvj33287.

cpe:/a:cisco:prime_collaboration:12.1 cpe:/a:cisco:prime_collaboration_provisioning:12.2

CVE-2018-0391

2018-08-01T16:29:00.263-04:00

2019-10-09T19:31:57.507-04:00

6.8

NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov BID 104942 SECTRACK 1041409 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180801-pcp-dos A vulnerability in the password change function of Cisco Prime Collaboration Provisioning could allow an authenticated, remote attacker to cause the system to become inoperable. The vulnerability is due to insufficient validation of a password change request. An attacker could exploit this vulnerability by changing a specific administrator account password. A successful exploit could allow the attacker to cause the affected device to become inoperable, resulting in a denial of service (DoS) condition. This vulnerability affects Cisco Prime Collaboration Provisioning (PCP) Releases 12.2 and prior. Cisco Bug IDs: CSCvd86586.

cpe:/o:cisco:mobility_services_engine_3310_firmware:14.0.0 cpe:/o:cisco:mobility_services_engine_3355_firmware:14.0.0 cpe:/o:cisco:mobility_services_engine_3365_firmware:14.0.0

CVE-2018-0392

2018-07-18T19:29:01.150-04:00

2019-10-09T19:31:57.630-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104866 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-policy-suite-data A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by another user. The vulnerability is due to insufficient access control permissions (i.e., World-Readable). An attacker could exploit this vulnerability by logging in to the CLI. An exploit could allow the attacker to access potentially sensitive files that are owned by a different user. Cisco Bug IDs: CSCvh18087.

cpe:/o:cisco:mobility_services_engine_3310_firmware:18.0.0 cpe:/o:cisco:mobility_services_engine_3355_firmware:18.0.0 cpe:/o:cisco:mobility_services_engine_3365_firmware:18.0.0

CVE-2018-0393

2018-07-18T19:29:01.180-04:00

2019-10-09T19:31:57.787-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104867 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-policy-suite-change A Read-Only User Effect Change vulnerability in the Policy Builder interface of Cisco Policy Suite could allow an authenticated, remote attacker to make policy changes in the Policy Builder interface. The vulnerability is due to insufficient authorization controls. An attacker could exploit this vulnerability by accessing the Policy Builder interface and modifying an HTTP request. A successful exploit could allow the attacker to make changes to existing policies. Cisco Bug IDs: CSCvi35007.

cpe:/a:cisco:cloud_services_platform_2100:2.2%284%29

CVE-2018-0394

2018-07-18T19:29:01.243-04:00

2019-10-09T19:31:57.927-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov BID 104881 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-csp2100-injection A vulnerability in the web upload function of Cisco Cloud Services Platform 2100 could allow an authenticated, remote attacker to obtain restricted shell access on an affected system. The vulnerability is due to insufficient input validation of parameters passed to a specific function within the user interface. An attacker could exploit this vulnerability by injecting code into a function parameter. Cisco Bug IDs: CSCvi12935.

cpe:/o:cisco:fxos:3.2%283d%29c cpe:/o:cisco:fxos:6.0%284%29 cpe:/o:cisco:fxos:6.1%283%29s2 cpe:/o:cisco:fxos:12.3%281e%29 cpe:/o:cisco:fxos:r231 cpe:/o:cisco:nx-os:3.2%283d%29c cpe:/o:cisco:nx-os:6.0%284%29 cpe:/o:cisco:nx-os:6.1%283%29s2 cpe:/o:cisco:nx-os:12.3%281e%29 cpe:/o:cisco:nx-os:r231

CVE-2018-0395

2018-10-17T15:29:00.303-04:00

2019-10-09T19:31:58.037-04:00

2.9

ADJACENT_NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 105674 SECTRACK 1041919 CISCO 20181017 Cisco FXOS and NX-OS Software Link Layer Discovery Protocol Denial of Service Vulnerability A vulnerability in the Link Layer Discovery Protocol (LLDP) implementation for Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition when the device unexpectedly reloads. The vulnerability is due to improper input validation of certain type, length, value (TLV) fields of the LLDP frame header. An attacker could exploit this vulnerability by sending a crafted LLDP packet to an interface on the targeted device. A successful exploit could allow the attacker to cause the switch to reload unexpectedly.

cpe:/a:cisco:unified_communications_manager_im_and_presence_service:11.5 cpe:/a:cisco:unified_communications_manager_im_and_presence_service:12.0

CVE-2018-0396

2018-07-18T19:29:01.290-04:00

2019-10-09T19:31:58.303-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104872 SECTRACK 1041349 SECTRACK 1041350 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-ucmim-ps-xss A vulnerability in the web framework of the Cisco Unified Communications Manager IM and Presence Service software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain parameters passed to the web server. An attacker could exploit this vulnerability by convincing the user to access a malicious link or by intercepting the user request and injecting certain malicious code. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected site or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCve25985.

cpe:/a:cisco:advanced_malware_protection_for_endpoints:-

CVE-2018-0397

2018-08-01T16:29:00.310-04:00

2019-10-09T19:31:58.427-04:00

7.1

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 104946 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180801-fampmac A vulnerability in Cisco AMP for Endpoints Mac Connector Software installed on Apple macOS 10.12 could allow an unauthenticated, remote attacker to cause a kernel panic on an affected system, resulting in a denial of service (DoS) condition. The vulnerability exists if the affected software is running in Block network conviction mode. Exploitation could occur if the system that is running the affected software starts a server process and an address in the IP blacklist cache of the affected software attempts to connect to the affected system. A successful exploit could allow the attacker to cause a kernel panic on the system that is running the affected software, resulting in a DoS condition. Cisco Bug IDs: CSCvk08192.

cpe:/a:cisco:finesse:11.5%281%29

CVE-2018-0398

2018-07-18T19:29:01.320-04:00

2019-10-09T19:31:58.553-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 104886 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-finesse Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a server-side request forgery (SSRF) attack. Cisco Bug IDs: CSCvg71018.

cpe:/a:cisco:finesse:11.5%281%29

CVE-2018-0399

2018-07-18T19:29:01.367-04:00

2019-10-09T19:31:58.677-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104886 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-finesse Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to retrieve a cleartext password from an affected system. Cisco Bug IDs: CSCvg71044.

cpe:/a:cisco:unified_contact_center_express:11.5%281%29 cpe:/a:cisco:unified_ip_interactive_voice_response:11.5%281%29

CVE-2018-0400

2018-07-18T19:29:01.400-04:00

2019-10-09T19:31:58.803-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1041352 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-uccx Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. Cisco Bug IDs: CSCvg70904.

cpe:/a:cisco:unified_contact_center_express:11.5%281%29 cpe:/a:cisco:unified_ip_interactive_voice_response:11.5%281%29

CVE-2018-0401

2018-07-18T19:29:01.447-04:00

2019-10-09T19:31:58.913-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

cpe:/a:cisco:unified_contact_center_express:11.5%281%29 cpe:/a:cisco:unified_ip_interactive_voice_response:11.5%281%29

CVE-2018-0402

2018-07-18T19:29:01.493-04:00

2019-10-09T19:31:59.037-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1041352 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-uccx Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack. Cisco Bug IDs: CSCvg70921.

cpe:/a:cisco:unified_contact_center_express:11.5%281%29 cpe:/a:cisco:unified_ip_interactive_voice_response:11.5%281%29

CVE-2018-0403

2018-07-18T19:29:01.540-04:00

2019-10-09T19:31:59.147-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1041352 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-uccx Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to retrieve a cleartext password. Cisco Bug IDs: CSCvg71040.

cpe:/h:cisco:rv180w_wireless-n_multifunction_vpn_router:- cpe:/h:cisco:rv220w_wireless_network_security_firewall:-

CVE-2018-0404

2018-10-05T12:29:00.300-04:00

2019-10-09T19:31:59.257-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvk27179 A vulnerability in the web framework code for Cisco RV180W Wireless-N Multifunction VPN Router and Small Business RV Series RV220W Wireless Network Security Firewall could allow an unauthenticated, remote attacker to execute arbitrary SQL queries. The attacker could retrieve sensitive information which should be restricted. A vulnerability in the web framework code for Cisco RV180W Wireless-N Multifunction VPN Router and Small Business RV Series RV220W Wireless Network Security Firewall could allow an unauthenticated, remote attacker to execute arbitrary SQL queries. The attacker could retrieve sensitive information which should be restricted. The product has entered the end-of-life phase and there will be no more firmware fixes.

cpe:/o:cisco:rv180w_firmware:- cpe:/o:cisco:rv220w_firmware:-

CVE-2018-0405

2018-10-05T13:29:00.277-04:00

2019-10-09T19:31:59.460-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvk28019 A vulnerability in the web framework code for Cisco RV180W Wireless-N Multifunction VPN Router and Small Business RV Series RV220W Wireless Network Security Firewall could allow an unauthenticated, remote attacker to conduct a directory path traversal attack on a targeted device. The issue is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location.

cpe:/a:cisco:web_security_appliance:10.1.2-003 cpe:/a:cisco:web_security_appliance:10.5.1-269 cpe:/a:cisco:web_security_appliance:11.5.0-fcs-581

CVE-2018-0406

2018-08-01T16:29:00.357-04:00

2019-10-09T19:31:59.630-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104945 SECTRACK 1041406 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180801-wsa-xss A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to conduct a reflected or Document Object Model based (DOM-based) cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCve84006.

CVE-2018-0407

2018-08-01T16:29:00.387-04:00

2019-10-09T19:31:59.757-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104947 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180801-sb-pxss A vulnerability in the web-based management interface of Cisco Small Business 300 Series (Sx300) Managed Switches could allow an authenticated, remote attacker to conduct a persistent cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvi87326.

CVE-2018-0408

2018-08-01T16:29:00.433-04:00

2019-10-09T19:32:00.210-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104948 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180801-sb-rxss A vulnerability in the web-based management interface of Cisco Small Business 300 Series (Sx300) Managed Switches could allow an authenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvi87330.

cpe:/a:cisco:telepresence_video_communication_server:x7.0.1 cpe:/a:cisco:telepresence_video_communication_server:x7.2.4 cpe:/a:cisco:telepresence_video_communication_server:x8.1 cpe:/a:cisco:telepresence_video_communication_server:x8.2.2 cpe:/a:cisco:telepresence_video_communication_server:x8.5 cpe:/a:cisco:telepresence_video_communication_server:x8.6 cpe:/a:cisco:telepresence_video_communication_server:x8.7 cpe:/a:cisco:telepresence_video_communication_server:x8.8 cpe:/a:cisco:telepresence_video_communication_server:x8.9 cpe:/a:cisco:telepresence_video_communication_server:x8.10 cpe:/a:cisco:telepresence_video_communication_server:x8.10.4 cpe:/a:cisco:unified_communications_manager_im_and_presence_service:11.5 cpe:/a:cisco:unified_communications_manager_im_and_presence_service:11.5%281%29

CVE-2018-0409

2018-08-15T16:29:00.533-04:00

2019-10-09T19:32:00.757-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 105102 BID 105104 SECTRACK 1041533 SECTRACK 1041534 CISCO 20180815 Cisco Unified Communications Manager IM & Presence Service Denial of Service Vulnerability A vulnerability in the XCP Router service of the Cisco Unified Communications Manager IM & Presence Service (CUCM IM&P) and the Cisco TelePresence Video Communication Server (VCS) and Expressway could allow an unauthenticated, remote attacker to cause a temporary service outage for all IM&P users, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a malicious IPv4 or IPv6 packet to an affected device on TCP port 7400. An exploit could allow the attacker to overread a buffer, resulting in a crash and restart of the XCP Router service. Cisco Bug IDs: CSCvg97663, CSCvi55947.

cpe:/a:cisco:web_security_appliance:9.1.1-074 cpe:/a:cisco:web_security_appliance:9.1.2-010 cpe:/a:cisco:web_security_appliance:9.1.2-022 cpe:/a:cisco:web_security_appliance:9.1.2-039 cpe:/a:cisco:web_security_appliance:10.1.0-204 cpe:/a:cisco:web_security_appliance:10.1.1-235 cpe:/a:cisco:web_security_appliance:10.5.1-270 cpe:/a:cisco:web_security_appliance:10.5.1-296 cpe:/a:cisco:web_security_appliance:10.5.2-042 cpe:/a:cisco:web_security_appliance:11.0.0-641

CVE-2018-0410

2018-08-15T16:29:00.657-04:00

2019-10-09T19:32:00.897-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 105098 SECTRACK 1041535 CISCO 20180815 Cisco Web Security Appliance Web Proxy Memory Exhaustion Denial of Service Vulnerability A vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliances could allow an unauthenticated, remote attacker to exhaust system memory and cause a denial of service (DoS) condition on an affected system. The vulnerability exists because the affected software improperly manages memory resources for TCP connections to a targeted device. An attacker could exploit this vulnerability by establishing a high number of TCP connections to the data interface of an affected device via IPv4 or IPv6. A successful exploit could allow the attacker to exhaust system memory, which could cause the system to stop processing new connections and result in a DoS condition. System recovery may require manual intervention. Cisco Bug IDs: CSCvf36610.

CVE-2018-0411

2018-08-01T16:29:00.480-04:00

2019-10-09T19:32:01.100-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 104949 SECTRACK 1041407 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180801-ucm-xss A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvk15343.

cpe:/o:cisco:wap121_firmware:1.0.6.6 cpe:/o:cisco:wap125_firmware:1.0.6.6 cpe:/o:cisco:wap131_firmware:1.0.6.6 cpe:/o:cisco:wap150_firmware:1.0.6.6 cpe:/o:cisco:wap321_firmware:1.0.6.6 cpe:/o:cisco:wap351_firmware:1.0.6.6 cpe:/o:cisco:wap361_firmware:1.0.6.6 cpe:/o:cisco:wap371_firmware:1.0.6.6

CVE-2018-0412

2018-08-15T16:29:00.767-04:00

2019-10-09T19:32:01.257-04:00

2.9

ADJACENT_NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CISCO 20180815 Cisco Small Business 100 Series and 300 Series Wireless Access Points Encryption Algorithm Downgrade Vulnerability A vulnerability in the implementation of Extensible Authentication Protocol over LAN (EAPOL) functionality in Cisco Small Business 100 Series Wireless Access Points and Cisco Small Business 300 Series Wireless Access Points could allow an unauthenticated, adjacent attacker to force the downgrade of the encryption algorithm that is used between an authenticator (access point) and a supplicant (Wi-Fi client). The vulnerability is due to the improper processing of certain EAPOL messages that are received during the Wi-Fi handshake process. An attacker could exploit this vulnerability by establishing a man-in-the-middle position between a supplicant and an authenticator and manipulating an EAPOL message exchange to force usage of a WPA-TKIP cipher instead of the more secure AES-CCMP cipher. A successful exploit could allow the attacker to conduct subsequent cryptographic attacks, which could lead to the disclosure of confidential information. Cisco Bug IDs: CSCvj29229.

cpe:/a:cisco:identity_services_engine_software:2.0%280.901%29 cpe:/a:cisco:identity_services_engine_software:2.1%280.188%29 cpe:/a:cisco:identity_services_engine_software:2.2%280.231%29 cpe:/a:cisco:identity_services_engine_software:2.4%280.183%29

CVE-2018-0413

2018-08-01T16:29:00.513-04:00

2019-10-09T19:32:01.490-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 104950 SECTRACK 1041408 CONFIRM https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180801-ise-csrf A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user. Cisco Bug IDs: CSCvi85159.

cpe:/a:cisco:secure_access_control_server_solution_engine:3.3 cpe:/a:cisco:secure_access_control_server_solution_engine:3.3.1 cpe:/a:cisco:secure_access_control_server_solution_engine:3.3.2 cpe:/a:cisco:secure_access_control_server_solution_engine:4.0 cpe:/a:cisco:secure_access_control_server_solution_engine:5.4.0.46.6 cpe:/a:cisco:secure_access_control_server_solution_engine:5.5.0.36 cpe:/a:cisco:secure_access_control_server_solution_engine:5.5.0.46.4 cpe:/a:cisco:secure_access_control_server_solution_engine:5.8:- cpe:/a:cisco:secure_access_control_server_solution_engine:5.8:p1 cpe:/a:cisco:secure_access_control_server_solution_engine:5.8:p2 cpe:/a:cisco:secure_access_control_server_solution_engine:5.8:p3 cpe:/a:cisco:secure_access_control_server_solution_engine:5.8:p4 cpe:/a:cisco:secure_access_control_server_solution_engine:5.8:p5 cpe:/a:cisco:secure_access_control_server_solution_engine:5.8:p6 cpe:/a:cisco:secure_access_control_server_solution_engine:5.8:p7 cpe:/a:cisco:secure_access_control_server_solution_engine:5.8:p8 cpe:/a:cisco:secure_access_control_server_solution_engine:5.8:p9

CVE-2018-0414

2018-10-05T10:29:00.497-04:00

2019-10-09T19:32:01.617-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov BID 105289 SECTRACK 1041688 CISCO 20180905 Cisco Secure Access Control Server XML External Entity Injection Vulnerability A vulnerability in the web-based UI of Cisco Secure Access Control Server could allow an authenticated, remote attacker to gain read access to certain information in an affected system. The vulnerability is due to improper handling of XML External Entities (XXEs) when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file.

CVE-2018-0415

2018-08-15T16:29:00.893-04:00

2019-10-09T19:32:01.803-04:00

5.5

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov BID 105116 CISCO 20180815 Cisco Small Business 100 Series and 300 Series Wireless Access Points Denial of Service Vulnerability A vulnerability in the implementation of Extensible Authentication Protocol over LAN (EAPOL) functionality in Cisco Small Business 100 Series Wireless Access Points and Cisco Small Business 300 Series Wireless Access Points could allow an authenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to the improper processing of certain EAPOL frames. An attacker could exploit this vulnerability by sending a stream of crafted EAPOL frames to an affected device. A successful exploit could allow the attacker to force the access point (AP) to disassociate all the associated stations (STAs) and to disallow future, new association requests. Cisco Bug IDs: CSCvj97472.

cpe:/o:cisco:wireless_lan_controller_software:8.5%28130.0%29 cpe:/o:cisco:wireless_lan_controller_software:8.9%281.52%29

CVE-2018-0416

2018-10-17T15:29:00.380-04:00

2019-10-09T19:32:02.020-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 105675 SECTRACK 1041928 CISCO 20181017 Cisco Wireless LAN Controller Software Information Disclosure Vulnerability A vulnerability in the web-based interface of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to view system information that under normal circumstances should be prohibited. The vulnerability is due to incomplete input and validation checking mechanisms in the web-based interface URL request. An attacker could exploit this vulnerability by requesting specific URLs via the web-based interface. A successful exploit could allow the attacker to view sensitive system information.

cpe:/o:cisco:wireless_lan_controller:3.2 cpe:/o:cisco:wireless_lan_controller:3.2.116.21 cpe:/o:cisco:wireless_lan_controller:4.0 cpe:/o:cisco:wireless_lan_controller:4.0.155.0 cpe:/o:cisco:wireless_lan_controller:4.1 cpe:/o:cisco:wireless_lan_controller:8.7%281.115%29

CVE-2018-0417

2018-10-17T18:29:00.363-04:00

2019-10-09T19:32:02.177-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 105667 SECTRACK 1041924 CISCO 20181017 Cisco Wireless LAN Controller Software GUI Privilege Escalation Vulnerability A vulnerability in TACACS authentication with Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, local attacker to perform certain operations within the GUI that are not normally available to that user on the CLI. The vulnerability is due to incorrect parsing of a specific TACACS attribute received in the TACACS response from the remote TACACS server. An attacker could exploit this vulnerability by authenticating via TACACS to the GUI on the affected device. A successful exploit could allow an attacker to create local user accounts with administrative privileges on an affected WLC and execute other commands that are not allowed from the CLI and should be prohibited.

cpe:/o:cisco:ios_xr:6.3.3_base

CVE-2018-0418

2018-08-15T16:29:01.017-04:00

2019-10-09T19:32:02.367-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 105185 SECTRACK 1041538 CISCO 20180815 Cisco ASR 9000 Series Aggregation Services Routers Precision Time Protocol Denial of Service Vulnerability A vulnerability in the Local Packet Transport Services (LPTS) feature set of Cisco ASR 9000 Series Aggregation Services Router Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of input and validation checking on certain Precision Time Protocol (PTP) ingress traffic to an affected device. An attacker could exploit this vulnerability by injecting malformed traffic into an affected device. A successful exploit could allow the attacker to cause services on the device to become unresponsive, resulting in a DoS condition. Cisco Bug IDs: CSCvj22858.

cpe:/a:cisco:email_security_appliance:-

CVE-2018-0419

2018-08-15T16:29:01.143-04:00

2019-10-09T19:32:02.490-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 105112 SECTRACK 1041531 CISCO 20180815 Cisco Email Security Appliance EXE File Scanning Bypass Vulnerability A vulnerability in certain attachment detection mechanisms of Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to bypass the filtering functionality of an affected system. The vulnerability is due to the improper detection of content within executable (EXE) files. An attacker could exploit this vulnerability by sending a customized EXE file that is not recognized and blocked by the ESA. A successful exploit could allow an attacker to send email messages that contain malicious executable files to unsuspecting users. Cisco Bug IDs: CSCvh03786.

cpe:/o:cisco:wireless_lan_controller:8.2%28151.0%29

CVE-2018-0420

2018-10-17T18:29:00.457-04:00

2019-10-09T19:32:02.630-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov BID 105671 SECTRACK 1041926 CISCO 20181017 Cisco Wireless LAN Controller Software Directory Traversal Vulnerability A vulnerability in the web-based interface of Cisco Wireless LAN Controller Software could allow an authenticated, remote attacker to view sensitive information. The issue is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames and pathnames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. A successful exploit could allow the attacker to view system files on the targeted device, which may contain sensitive information.

CVE-2018-0421

2018-10-05T10:29:00.623-04:00

2019-10-09T19:32:02.820-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 105282 SECTRACK 1041684 CISCO 20180905 Cisco Prime Access Registrar Denial of Service Vulnerability A vulnerability in TCP connection management in Cisco Prime Access Registrar could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition when the application unexpectedly restarts. The vulnerability is due to incorrect handling of incoming TCP SYN packets to specific listening ports. The improper handling of the TCP SYN packets could cause a system file description to be allocated and not freed. An attacker could exploit this vulnerability by sending a crafted stream of TCP SYN packets to the application. A successful exploit could allow the attacker to cause the application to eventually restart if a file description cannot be obtained.

cpe:/a:cisco:webex_business_suite_31 cpe:/a:cisco:webex_business_suite_32:- cpe:/a:cisco:webex_business_suite_32:32.15.10 cpe:/a:cisco:webex_business_suite_33:33.0 cpe:/a:cisco:webex_business_suite_33:33.1 cpe:/a:cisco:webex_business_suite_33:33.2 cpe:/a:cisco:webex_business_suite_33:33.3 cpe:/a:cisco:webex_meetings_online:- cpe:/a:cisco:webex_meetings_online:t31.20 cpe:/a:cisco:webex_meetings_online:t31.20.2 cpe:/a:cisco:webex_meetings_server:3.0 cpe:/a:cisco:webex_meetings_server:3.0:mr1

CVE-2018-0422

2018-10-05T10:29:00.730-04:00

2019-10-02T20:03:26.223-04:00

6.9

LOCAL

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-01-04T12:04:11.090-05:00

BID 105281 SECTRACK 1041681 CISCO 20180905 Cisco Webex Meetings Client for Windows Privilege Escalation Vulnerability A vulnerability in the folder permissions of Cisco Webex Meetings client for Windows could allow an authenticated, local attacker to modify locally stored files and execute code on a targeted device with the privilege level of the user. The vulnerability is due to folder permissions that grant a user the permission to read, write, and execute files in the Webex folders. An attacker could exploit this vulnerability to write malicious files to the Webex client directory, affecting all other users of the targeted device. A successful exploit could allow a user to execute commands with elevated privileges. Attacks on single-user systems are less likely to occur, as the attack must be carried out by the user on the user's own system. Multiuser systems have a higher risk of exploitation because folder permissions have an impact on all users of the device. For an attacker to exploit this vulnerability successfully, a second user must execute the locally installed malicious file to allow remote code execution to occur.

cpe:/o:cisco:rv110w_firmware cpe:/o:cisco:rv130w_firmware cpe:/o:cisco:rv215w_firmware

CVE-2018-0423

2018-10-05T10:29:00.857-04:00

2019-10-09T19:32:02.977-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 105285 SECTRACK 1041675 CISCO 20180905 Cisco RV110W, RV130W, and RV215W Routers Management Interface Buffer Overflow Vulnerability A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to cause a denial of service condition or to execute arbitrary code. The vulnerability is due to improper boundary restrictions on user-supplied input in the Guest user feature of the web-based management interface. An attacker could exploit this vulnerability by sending malicious requests to a targeted device, triggering a buffer overflow condition. A successful exploit could allow the attacker to cause the device to stop responding, resulting in a denial of service condition, or could allow the attacker to execute arbitrary code.

cpe:/o:cisco:rv110w_firmware:1.2.1.7 cpe:/o:cisco:rv130w_firmware:1.0.0.21 cpe:/o:cisco:rv130w_firmware:1.0.1.3 cpe:/o:cisco:rv130w_firmware:1.0.2.7 cpe:/o:cisco:rv215w_firmware:1.3.0.8

CVE-2018-0424

2018-10-05T10:29:00.967-04:00

2019-10-09T19:32:03.130-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov SECTRACK 1041677 CISCO 20180905 Cisco RV110W, RV130W, and RV215W Routers Management Interface Command Injection Vulnerability A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an authenticated, remote attacker to execute arbitrary commands. The vulnerability is due to improper validation of user-supplied input to scripts by the web-based management interface. An attacker could exploit this vulnerability by sending malicious requests to a targeted device. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the root user.

cpe:/o:cisco:rv110w_firmware:1.2.1.7 cpe:/o:cisco:rv130w_firmware:1.0.0.21 cpe:/o:cisco:rv130w_firmware:1.0.1.3 cpe:/o:cisco:rv130w_firmware:1.0.2.7 cpe:/o:cisco:rv215w_firmware:1.3.0.8

CVE-2018-0425

2018-10-05T10:29:01.060-04:00

2019-10-09T19:32:03.287-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1041676 CISCO 20180905 Cisco RV110W, RV130W, and RV215W Routers Management Interface Information Disclosure Vulnerability A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper access control to files within the web-based management interface. An attacker could exploit this vulnerability by sending malicious requests to a targeted device. A successful exploit could allow the attacker to gain access to sensitive configuration information, including user authentication credentials.

cpe:/o:cisco:rv110w_firmware:1.2.1.7 cpe:/o:cisco:rv130w_firmware:1.0.0.21 cpe:/o:cisco:rv130w_firmware:1.0.1.3 cpe:/o:cisco:rv130w_firmware:1.0.2.7 cpe:/o:cisco:rv215w_firmware:1.3.0.8

CVE-2018-0426

2018-10-05T10:29:01.170-04:00

2019-10-09T19:32:03.443-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1041678 CISCO 20180905 Cisco RV110W, RV130W, and RV215W Routers Management Interface Directory Traversal Vulnerability A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of directory traversal character sequences within the web-based management interface. An attacker could exploit this vulnerability by sending malicious requests to the targeted device. A successful exploit could allow the attacker to gain access to arbitrary files on the affected device, resulting in the disclosure of sensitive information.

cpe:/a:cisco:application_policy_infrastructure_controller_enterprise_module:dnac1.1

CVE-2018-0427

2018-08-15T16:29:01.253-04:00

2019-10-09T19:32:03.583-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov BID 105106 CISCO 20180815 Cisco Digital Network Architecture Center Command Injection Vulnerability A vulnerability in the CronJob scheduler API of Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to perform a command injection attack. The vulnerability is due to incorrect input validation of user-supplied data. An attacker could exploit this vulnerability by sending a malicious packet. A successful exploit could allow the attacker to execute arbitrary commands with root privileges. Cisco Bug IDs: CSCvi42263.

cpe:/h:cisco:web_security_appliance:11.0.0-fcs-250 cpe:/h:cisco:web_security_appliance:11.5.0-fcs-000 cpe:/h:cisco:web_security_appliance:wsa10.0.0-959 cpe:/h:cisco:web_security_appliance:wsa10.5.0-fcs-000

CVE-2018-0428

2018-08-15T16:29:01.360-04:00

2019-10-09T19:32:03.710-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 105104 SECTRACK 1041536 CISCO 20180815 Cisco Web Security Appliance Privilege Escalation Vulnerability A vulnerability in the account management subsystem of Cisco Web Security Appliance (WSA) could allow an authenticated, local attacker to elevate privileges to root. The attacker must authenticate with valid administrator credentials. The vulnerability is due to improper implementation of access controls. An attacker could exploit this vulnerability by authenticating to the device as a specific user to gain the information needed to elevate privileges to root in a separate login shell. A successful exploit could allow the attacker to escape the CLI subshell and execute system-level commands on the underlying operating system as root. Cisco Bug IDs: CSCvj93548.

CVE-2018-0429

2018-08-09T16:29:00.143-04:00

2019-10-02T20:03:26.223-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2018-10-09T13:27:02.470-04:00

BID 105059 CONFIRM https://github.com/cisco/thor/commit/18de8f9f0762c3a542b1122589edb8af859d9813 Stack-based buffer overflow in the Cisco Thor decoder before commit 18de8f9f0762c3a542b1122589edb8af859d9813 allows local users to cause a denial of service (segmentation fault) and execute arbitrary code via a crafted non-conformant Thor bitstream.

cpe:/a:cisco:unified_computing_system:2.0_base cpe:/a:cisco:unified_computing_system:3.0%283a%29 cpe:/a:cisco:unified_computing_system:3.1%283%29

CVE-2018-0430

2018-10-05T10:29:01.277-04:00

2019-10-09T19:32:03.867-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov SECTRACK 1041686 CISCO 20180905 Cisco Integrated Management Controller Command Injection Vulnerability A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to inject and execute arbitrary commands with root privileges on an affected device. The vulnerability is due to insufficient validation of command input by the affected software. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of the affected software. A successful exploit could allow the attacker to inject and execute arbitrary, system-level commands with root privileges on an affected device.

cpe:/a:cisco:unified_computing_system:2.0_base cpe:/a:cisco:unified_computing_system:3.0%283a%29 cpe:/a:cisco:unified_computing_system:3.1%283%29

CVE-2018-0431

2018-10-05T10:29:01.387-04:00

2019-10-09T19:32:04.007-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

cpe:/a:cisco:vmanage_network_management_system:- cpe:/o:cisco:vedge_1000_firmware:- cpe:/o:cisco:vedge_1000_firmware:16.9 cpe:/o:cisco:vedge_1000_firmware:16.9.1 cpe:/o:cisco:vedge_1000_firmware:16.9.3 cpe:/o:cisco:vedge_100_firmware:- cpe:/o:cisco:vedge_2000_firmware:- cpe:/o:cisco:vedge_5000_firmware:-

CVE-2018-0432

2018-10-05T10:29:01.497-04:00

2019-10-09T19:32:04.130-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov BID 105296 CISCO 20180905 Cisco SD-WAN Solution Privilege Escalation Vulnerability A vulnerability in the error reporting feature of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to gain elevated privileges on an affected device. The vulnerability is due to a failure to properly validate certain parameters included within the error reporting application configuration. An attacker could exploit this vulnerability by sending a crafted command to the error reporting feature. A successful exploit could allow the attacker to gain root-level privileges and take full control of the device.

cpe:/a:cisco:vbond_orchestrator:- cpe:/a:cisco:vedge_cloud_router_platform:- cpe:/a:cisco:vmanage_network_management_system:- cpe:/a:cisco:vsmart_controller:- cpe:/o:cisco:vedge_1000_firmware:- cpe:/o:cisco:vedge_1000_firmware:16.9 cpe:/o:cisco:vedge_1000_firmware:16.9.1 cpe:/o:cisco:vedge_1000_firmware:16.9.3 cpe:/o:cisco:vedge_100_firmware:- cpe:/o:cisco:vedge_2000_firmware:- cpe:/o:cisco:vedge_5000_firmware:-

CVE-2018-0433

2018-10-05T10:29:01.607-04:00

2019-10-09T19:32:04.303-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 105295 CISCO 20180905 Cisco SD-WAN Solution Command Injection Vulnerability A vulnerability in the command-line interface (CLI) in the Cisco SD-WAN Solution could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the CLI utility. The attacker must be authenticated to access the CLI utility. A successful exploit could allow the attacker to execute commands with root privileges.

CVE-2018-0434

2018-10-05T10:29:01.700-04:00

2019-10-09T19:32:04.477-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 105294 CISCO 20180905 Cisco SD-WAN Solution Certificate Validation Vulnerability A vulnerability in the Zero Touch Provisioning feature of the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data by using an invalid certificate. The vulnerability is due to insufficient certificate validation by the affected software. An attacker could exploit this vulnerability by supplying a crafted certificate to an affected device. A successful exploit could allow the attacker to conduct man-in-the-middle attacks to decrypt confidential information on user connections to the affected software.

cpe:/a:cisco:umbrella

CVE-2018-0435

2018-10-05T10:29:01.840-04:00

2019-10-09T19:32:04.647-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov BID 105283 CISCO 20180905 Cisco Umbrella API Unauthorized Access Vulnerability A vulnerability in the Cisco Umbrella API could allow an authenticated, remote attacker to view and modify data across their organization and other organizations. The vulnerability is due to insufficient authentication configurations for the API interface of Cisco Umbrella. An attacker could exploit this vulnerability to view and potentially modify data for their organization or other organizations. A successful exploit could allow the attacker to read or modify data across multiple organizations.

cpe:/a:cisco:webex_teams:-::~~~iphone_os~~ cpe:/a:cisco:webex_teams:3.0.12427.0 cpe:/a:cisco:webex_teams:3.0.12808.0 cpe:/a:cisco:webex_teams:3.13.26920::~~~iphone_os~~

CVE-2018-0436

2018-10-05T10:29:01.933-04:00

2019-10-09T19:32:04.757-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov BID 105301 CISCO 20180905 Cisco Webex Teams Information Disclosure and Modification Vulnerability A vulnerability in Cisco Webex Teams, formerly Cisco Spark, could allow an authenticated, remote attacker to view and modify data for an organization other than their own organization. The vulnerability exists because the affected software performs insufficient checks for associations between user accounts and organization accounts. An attacker who has administrator or compliance officer privileges for one organization account could exploit this vulnerability by using those privileges to view and modify data for another organization account. No customer data was impacted by this vulnerability.

cpe:/a:cisco:umbrella_roaming_module:4.3%281095%29::~~~anyconnect~~

CVE-2018-0437

2018-10-05T10:29:02.043-04:00

2019-10-09T19:32:04.880-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 105292 CISCO 20180905 Cisco Umbrella Enterprise Roaming Client and Enterprise Roaming Module Privilege Escalation Vulnerability EXPLOIT-DB 45339 A vulnerability in the Cisco Umbrella Enterprise Roaming Client (ERC) could allow an authenticated, local attacker to elevate privileges to Administrator. To exploit the vulnerability, the attacker must authenticate with valid local user credentials. This vulnerability is due to improper implementation of file system permissions, which could allow non-administrative users to place files within restricted directories. An attacker could exploit this vulnerability by placing an executable file within the restricted directory, which when executed by the ERC client, would run with Administrator privileges.

CVE-2018-0438

2018-10-05T10:29:02.137-04:00

2019-10-09T19:32:05.023-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 105286 CISCO 20180905 Cisco Umbrella Enterprise Roaming Client Privilege Escalation Vulnerability EXPLOIT-DB 45339 A vulnerability in the Cisco Umbrella Enterprise Roaming Client (ERC) could allow an authenticated, local attacker to elevate privileges to Administrator. To exploit the vulnerability, the attacker must authenticate with valid local user credentials. This vulnerability is due to improper implementation of file system permissions, which could allow non-administrative users to place files within restricted directories. An attacker could exploit this vulnerability by placing an executable file within the restricted directory, which when executed by the ERC client, would run with Administrator privileges.

cpe:/a:cisco:meeting_server:2.0.0 cpe:/a:cisco:meeting_server:2.1.0 cpe:/a:cisco:meeting_server:2.2.0 cpe:/a:cisco:meeting_server:2.2.5 cpe:/a:cisco:meeting_server:2.3.0

CVE-2018-0439

2018-10-05T10:29:02.247-04:00

2019-10-09T19:32:05.147-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 105287 SECTRACK 1041680 CISCO 20180905 Cisco Meeting Server Cross-Site Request Forgery Vulnerability A vulnerability in the web-based management interface of Cisco Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a customized link. A successful exploit could allow the attacker to perform arbitrary actions on an affected device by using a web browser and with the privileges of the user.

cpe:/a:cisco:data_center_network_manager:4.0 cpe:/a:cisco:data_center_network_manager:4.1 cpe:/a:cisco:data_center_network_manager:4.2 cpe:/a:cisco:data_center_network_manager:5.0 cpe:/a:cisco:data_center_network_manager:10.0 cpe:/a:cisco:data_center_network_manager:10.1 cpe:/a:cisco:data_center_network_manager:10.2%281%29 cpe:/a:cisco:data_center_network_manager:10.3%281%29 cpe:/a:cisco:data_center_network_manager:10.4%281%29 cpe:/a:cisco:data_center_network_manager:10.4%282%29

CVE-2018-0440

2018-10-05T10:29:02.357-04:00

2019-10-09T19:32:05.273-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov SECTRACK 1041682 CISCO 20180905 Cisco Data Center Network Manager Privilege Escalation to Underlying Operating System Vulnerability A vulnerability in the web interface of Cisco Data Center Network Manager could allow an authenticated application administrator to execute commands on the underlying operating system with root-level privileges. The vulnerability is due to incomplete input validation of user input within an HTTP request. An attacker could exploit this vulnerability by authenticating to the application and then sending a crafted HTTP request to the targeted application. A successful exploit could allow the authenticated attacker to issue commands on the underlying operating system as the root user.

cpe:/o:cisco:access_points:8.0%28140.0%29 cpe:/o:cisco:access_points:8.2%28141.0%29 cpe:/o:cisco:access_points:8.2%28151.0%29 cpe:/o:cisco:access_points:8.3%28102.0%29 cpe:/o:cisco:access_points:8.3%28112.0%29 cpe:/o:cisco:access_points:8.3%28114.74%29 cpe:/o:cisco:access_points:15.3%283%29jd

CVE-2018-0441

2018-10-17T18:29:00.550-04:00

2019-10-09T19:32:05.397-04:00

6.1

ADJACENT_NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 105680 SECTRACK 1041918 CISCO 20181017 Cisco IOS Access Points Software 802.11r Fast Transition Denial of Service Vulnerability A vulnerability in the 802.11r Fast Transition feature set of Cisco IOS Access Points (APs) Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a corruption of certain timer mechanisms triggered by specific roaming events. This corruption will eventually cause a timer crash. An attacker could exploit this vulnerability by sending malicious reassociation events multiple times to the same AP in a short period of time, causing a DoS condition on the affected AP.

cpe:/o:cisco:wireless_lan_controller_software:3.0 cpe:/o:cisco:wireless_lan_controller_software:3.2 cpe:/o:cisco:wireless_lan_controller_software:3.2.116.21 cpe:/o:cisco:wireless_lan_controller_software:4.0 cpe:/o:cisco:wireless_lan_controller_software:4.0.108 cpe:/o:cisco:wireless_lan_controller_software:4.0.155.0 cpe:/o:cisco:wireless_lan_controller_software:4.0.155.5 cpe:/o:cisco:wireless_lan_controller_software:4.0.179.8 cpe:/o:cisco:wireless_lan_controller_software:4.0.179.11 cpe:/o:cisco:wireless_lan_controller_software:4.0.196 cpe:/o:cisco:wireless_lan_controller_software:4.0.206.0 cpe:/o:cisco:wireless_lan_controller_software:4.0.217.0 cpe:/o:cisco:wireless_lan_controller_software:4.0.219.0 cpe:/o:cisco:wireless_lan_controller_software:4.1 cpe:/o:cisco:wireless_lan_controller_software:4.1.171.0 cpe:/o:cisco:wireless_lan_controller_software:4.1.181.0 cpe:/o:cisco:wireless_lan_controller_software:4.1.185.0 cpe:/o:cisco:wireless_lan_controller_software:4.1m cpe:/o:cisco:wireless_lan_controller_software:4.2 cpe:/o:cisco:wireless_lan_controller_software:4.2.61.0 cpe:/o:cisco:wireless_lan_controller_software:4.2.99.0 cpe:/o:cisco:wireless_lan_controller_software:4.2.112.0 cpe:/o:cisco:wireless_lan_controller_software:4.2.117.0 cpe:/o:cisco:wireless_lan_controller_software:4.2.130.0 cpe:/o:cisco:wireless_lan_controller_software:4.2.173.0 cpe:/o:cisco:wireless_lan_controller_software:4.2.174.0 cpe:/o:cisco:wireless_lan_controller_software:4.2.176.0 cpe:/o:cisco:wireless_lan_controller_software:4.2.182.0 cpe:/o:cisco:wireless_lan_controller_software:4.2m cpe:/o:cisco:wireless_lan_controller_software:5.0 cpe:/o:cisco:wireless_lan_controller_software:5.0.148.0 cpe:/o:cisco:wireless_lan_controller_software:5.0.148.2 cpe:/o:cisco:wireless_lan_controller_software:5.1 cpe:/o:cisco:wireless_lan_controller_software:5.1.151.0 cpe:/o:cisco:wireless_lan_controller_software:5.1.152.0 cpe:/o:cisco:wireless_lan_controller_software:5.1.160.0 cpe:/o:cisco:wireless_lan_controller_software:5.2 cpe:/o:cisco:wireless_lan_controller_software:5.2.157.0 cpe:/o:cisco:wireless_lan_controller_software:5.2.169.0 cpe:/o:cisco:wireless_lan_controller_software:6.0 cpe:/o:cisco:wireless_lan_controller_software:6.0.182.0 cpe:/o:cisco:wireless_lan_controller_software:6.0.188.0 cpe:/o:cisco:wireless_lan_controller_software:6.0.196.0 cpe:/o:cisco:wireless_lan_controller_software:6.0.199.0 cpe:/o:cisco:wireless_lan_controller_software:6.0.199.4 cpe:/o:cisco:wireless_lan_controller_software:7.0 cpe:/o:cisco:wireless_lan_controller_software:7.0%28240.0%29 cpe:/o:cisco:wireless_lan_controller_software:7.0.98.0 cpe:/o:cisco:wireless_lan_controller_software:7.0.98.218 cpe:/o:cisco:wireless_lan_controller_software:7.0.116.0 cpe:/o:cisco:wireless_lan_controller_software:7.0.220.0 cpe:/o:cisco:wireless_lan_controller_software:7.0.235.0 cpe:/o:cisco:wireless_lan_controller_software:7.0_base cpe:/o:cisco:wireless_lan_controller_software:7.1 cpe:/o:cisco:wireless_lan_controller_software:7.1.91.0 cpe:/o:cisco:wireless_lan_controller_software:7.2 cpe:/o:cisco:wireless_lan_controller_software:7.2.103.0 cpe:/o:cisco:wireless_lan_controller_software:7.2.110.0 cpe:/o:cisco:wireless_lan_controller_software:7.3 cpe:/o:cisco:wireless_lan_controller_software:7.3.101.0 cpe:/o:cisco:wireless_lan_controller_software:7.4.1.54 cpe:/o:cisco:wireless_lan_controller_software:7.4.100 cpe:/o:cisco:wireless_lan_controller_software:7.4.110.0 cpe:/o:cisco:wireless_lan_controller_software:7.4.121.0 cpe:/o:cisco:wireless_lan_controller_software:7.4_base cpe:/o:cisco:wireless_lan_controller_software:7.5.102.0 cpe:/o:cisco:wireless_lan_controller_software:7.5.102.11 cpe:/o:cisco:wireless_lan_controller_software:7.6.100.0 cpe:/o:cisco:wireless_lan_controller_software:8.0.72.140

CVE-2018-0442

2018-10-17T18:29:00.647-04:00

2019-10-09T19:32:05.553-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 105664 SECTRACK 1041923 CISCO 20181017 Cisco Wireless LAN Controller Software Control and Provisioning of Wireless Access Points Protocol Information Disclosure Vulnerability A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol component of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to retrieve memory contents, which could lead to the disclosure of confidential information. The vulnerability is due to insufficient condition checks in the part of the code that handles CAPWAP keepalive requests. An attacker could exploit this vulnerability by sending a crafted CAPWAP keepalive packet to a vulnerable Cisco WLC device. A successful exploit could allow the attacker to retrieve the contents of device memory, which could lead to the disclosure of confidential information.

cpe:/o:cisco:wireless_lan_controller_software:8.2%28151.0%29

CVE-2018-0443

2018-10-17T18:29:00.723-04:00

2019-10-09T19:32:05.773-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 105686 SECTRACK 1041922 CISCO 20181017 Cisco Wireless LAN Controller Software Control and Provisioning of Wireless Access Points Protocol Denial of Service Vulnerability A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol component of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to improper input validation on fields within CAPWAP Discovery Request packets by the affected device. An attacker could exploit this vulnerability by sending malicious CAPWAP Discovery Request packets to the Cisco WLC Software. A successful exploit could allow the attacker to cause the Cisco WLC Software to disconnect associated access points (APs). While the APs disconnect and reconnect, service will be unavailable for a brief period of time, resulting in a DoS condition.

cpe:/a:cisco:packaged_contact_center_enterprise:11.6%281%29

CVE-2018-0444

2018-10-05T10:29:02.467-04:00

2019-10-09T19:32:05.927-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CISCO 20180905 Multiple Vulnerabilities in Cisco Packaged Contact Center Enterprise A vulnerability in the web-based management interface of Cisco Packaged Contact Center Enterprise could allow an unauthenticated, remote attacker to conduct a stored XSS attack against a user of the interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a customized link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.

cpe:/a:cisco:packaged_contact_center_enterprise:11.6%281%29

CVE-2018-0445

2018-10-05T10:29:02.577-04:00

2019-10-09T19:32:06.053-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CISCO 20180905 Multiple Vulnerabilities in Cisco Packaged Contact Center Enterprise A vulnerability in the web-based management interface of Cisco Packaged Contact Center Enterprise could allow an unauthenticated, remote attacker to conduct a CSRF attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a customized link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user.

cpe:/a:cisco:network_level_service:1.5%280.128%29

CVE-2018-0446

2018-10-05T10:29:02.700-04:00

2019-10-09T19:32:06.163-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CISCO 20181003 Cisco Industrial Network Director Cross-Site Request Forgery Vulnerability A vulnerability in the web-based management interface of Cisco Industrial Network Director could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious, customized link. A successful exploit could allow the attacker to perform arbitrary actions on the affected device via a web browser and with the privileges of the user.

cpe:/a:cisco:email_security_appliance:-

CVE-2018-0447

2018-10-05T10:29:02.810-04:00

2019-10-09T19:32:06.333-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 105300 SECTRACK 1041687 CISCO 20180905 Cisco Email Security Appliance URL Filtering Bypass Vulnerability A vulnerability in the anti-spam protection mechanisms of Cisco AsyncOS Software for the Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass certain content filters on an affected device. The vulnerability is due to incomplete input and validation checking mechanisms for certain Sender Policy Framework (SPF) messages that are sent to an affected device. An attacker could exploit this vulnerability by sending a customized SPF packet to an affected device. If successful, an exploit could allow the attacker to bypass the URL filters that are configured for the affected device, which could allow malicious URLs to pass through the device.

CVE-2018-0448

2018-10-05T10:29:02.920-04:00

2019-10-09T19:32:06.460-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 105502 CISCO 20181003 Cisco Digital Network Architecture Center Authentication Bypass Vulnerability A vulnerability in the identity management service of Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authentication and take complete control of identity management functions. The vulnerability is due to insufficient security restrictions for critical management functions. An attacker could exploit this vulnerability by sending a valid identity management request to the affected system. An exploit could allow the attacker to view and make unauthorized modifications to existing system users as well as create new users.

cpe:/a:cisco:jabber:12.1%280%29::~~~mac_os_x~~

CVE-2018-0449

2019-01-10T11:29:00.240-05:00

2019-10-09T19:32:06.583-04:00

3.3

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 106520 CISCO 20190109 Cisco Jabber Client Framework Insecure Directory Permissions Vulnerability A vulnerability in the Cisco Jabber Client Framework (JCF) software, installed as part of the Cisco Jabber for Mac client, could allow an authenticated, local attacker to corrupt arbitrary files on an affected device that has elevated privileges. The vulnerability exists due to insecure directory permissions set on a JCF created directory. An authenticated attacker with the ability to access an affected directory could create a hard link to an arbitrary location on the affected system. An attacker could convince another user that has administrative privileges to perform an install or update the Cisco Jabber for Mac client to perform such actions, allowing files to be created in an arbitrary location on the disk or an arbitrary file to be corrupted when it is appended to or overwritten.

cpe:/a:cisco:data_center_network_manager:10.4%282%29

CVE-2018-0450

2018-10-05T10:29:03.027-04:00

2019-10-09T19:32:06.757-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 105288 CISCO 20180905 Cisco Data Center Network Manager Cross-Site Scripting Vulnerability A vulnerability in the web-based management interface of Cisco Data Center Network Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the management interface on an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a customized link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.

cpe:/a:cisco:tetration_analytics:2.0%282.20%29 cpe:/a:cisco:tetration_analytics:2.1%281.31%29

CVE-2018-0451

2018-10-05T10:29:03.137-04:00

2019-10-09T19:32:06.897-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 105270 CISCO 20180905 Cisco Tetration Analytics Cross-Site Request Forgery Vulnerability A vulnerability in the web-based management interface of Cisco Tetration Analytics could allow an authenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a customized link. A successful exploit could allow the attacker to perform arbitrary actions on an affected device by using a web browser and with the privileges of the user.

cpe:/a:cisco:tetration_analytics:2.1:1.29 cpe:/a:cisco:tetration_analytics:2.1:1.31 cpe:/a:cisco:tetration_analytics:2.1:1.33

CVE-2018-0452

2018-10-05T10:29:03.230-04:00

2019-10-09T19:32:07.023-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 105278 CISCO 20180905 Cisco Tetration Analytics Cross-Site Scripting Vulnerability A vulnerability in the web-based management interface of Cisco Tetration Analytics could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a customized link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.

cpe:/a:cisco:firepower_threat_defense:5.4.0 cpe:/a:cisco:firepower_threat_defense:6.0.0 cpe:/a:cisco:firepower_threat_defense:6.0.1 cpe:/a:cisco:firepower_threat_defense:6.1.0 cpe:/a:cisco:firepower_threat_defense:6.2.0 cpe:/a:cisco:firepower_threat_defense:6.2.1 cpe:/a:cisco:firepower_threat_defense:6.2.2

CVE-2018-0453

2018-10-05T10:29:03.340-04:00

2019-10-09T19:32:07.130-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov CISCO 20181003 Cisco Firepower Management Center and Firepower System Software Sourcefire Tunnel Control Channel Command Execution Vulnerability A vulnerability in the Sourcefire tunnel control channel protocol in Cisco Firepower System Software running on Cisco Firepower Threat Defense (FTD) sensors could allow an authenticated, local attacker to execute specific CLI commands with root privileges on the Cisco Firepower Management Center (FMC), or through Cisco FMC on other Firepower sensors and devices that are controlled by the same Cisco FMC. To send the commands, the attacker must have root privileges for at least one affected sensor or the Cisco FMC. The vulnerability exists because the affected software performs insufficient checks for certain CLI commands, if the commands are executed via a Sourcefire tunnel connection. An attacker could exploit this vulnerability by authenticating with root privileges to a Firepower sensor or Cisco FMC, and then sending specific CLI commands to the Cisco FMC or through the Cisco FMC to another Firepower sensor via the Sourcefire tunnel connection. A successful exploit could allow the attacker to modify device configurations or delete files on the device that is running Cisco FMC Software or on any Firepower device that is managed by Cisco FMC.

cpe:/o:cisco:cloud_services_platform_2100_firmware:2.2%284%29

CVE-2018-0454

2018-10-05T10:29:03.450-04:00

2019-10-09T19:32:07.273-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov SECTRACK 1041683 CISCO 20180905 Cisco Cloud Services Platform 2100 Command Injection Vulnerability A vulnerability in the web-based management interface of Cisco Cloud Services Platform 2100 could allow an authenticated, remote attacker to perform command injection. The vulnerability is due to insufficient input validation of command input. An attacker could exploit this vulnerability by sending customized commands to the web-based management interface.

cpe:/a:cisco:firepower_system_software:6.0 cpe:/a:cisco:firepower_system_software:6.0.1 cpe:/a:cisco:firepower_system_software:6.1.0 cpe:/a:cisco:firepower_system_software:6.2.0 cpe:/a:cisco:firepower_system_software:6.2.0.2 cpe:/a:cisco:firepower_system_software:6.2.1 cpe:/a:cisco:firepower_system_software:6.2.2 cpe:/a:cisco:firepower_system_software:6.2.3

CVE-2018-0455

2018-10-05T10:29:03.560-04:00

2019-10-09T19:32:07.397-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CISCO 20181003 Cisco Firepower System Software Detection Engine Denial of Service Vulnerability A vulnerability in the Server Message Block Version 2 (SMBv2) and Version 3 (SMBv3) protocol implementation for the Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause the device to run low on system memory, possibly preventing the device from forwarding traffic. It is also possible that a manual reload of the device may be required to clear the condition. The vulnerability is due to incorrect SMB header validation. An attacker could exploit this vulnerability by sending a custom SMB file transfer through the targeted device. A successful exploit could cause the device to consume an excessive amount of system memory and prevent the SNORT process from forwarding network traffic. This vulnerability can be exploited using either IPv4 or IPv6 in combination with SMBv2 or SMBv3 network traffic.

cpe:/o:cisco:nx-os:9.2%280.43%29

CVE-2018-0456

2018-10-17T16:29:00.253-04:00

2019-10-09T19:32:07.523-04:00

6.8

NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov BID 105668 SECTRACK 1041921 CISCO 20181017 Cisco NX-OS Software Authenticated Simple Network Management Protocol Denial of Service Vulnerability A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco NX-OS Software could allow an authenticated, remote attacker to cause the SNMP application of an affected device to restart unexpectedly. The vulnerability is due to improper validation of SNMP protocol data units (PDUs) in SNMP packets. An attacker could exploit this vulnerability by sending a crafted SNMP packet to an affected device. A successful exploit could allow the attacker to cause the SNMP application to restart multiple times, leading to a system-level restart and a denial of service (DoS) condition.

cpe:/a:cisco:webex_meetings_online:t31 cpe:/a:cisco:webex_meetings_online:t32

CVE-2018-0457

2018-10-05T10:29:03.670-04:00

2019-10-09T19:32:07.677-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 105279 SECTRACK 1041679 CISCO 20180905 Cisco Webex Player WRF Files Denial of Service Vulnerability A vulnerability in the Cisco Webex Player for Webex Recording Format (WRF) files could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. An attacker could exploit this vulnerability by sending a user a link or email attachment with a malicious WRF file and persuading the user to open the file in the Cisco Webex Player. A successful exploit could cause the affected player to crash, resulting in a DoS condition. For more information about this vulnerability, see the Details section of this security advisory.

cpe:/a:cisco:prime_collaboration_assurance:11.6.0

CVE-2018-0458

2018-10-05T10:29:03.777-04:00

2019-10-09T19:32:07.833-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 105293 SECTRACK 1041685 CISCO 20180905 Cisco Prime Collaboration Assurance Cross-Site Scripting Vulnerability A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a customized link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.

cpe:/a:cisco:network_functions_virtualization_infrastructure:-

CVE-2018-0459

2018-10-05T10:29:03.920-04:00

2019-10-09T19:32:07.943-04:00

6.8

NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov BID 105290 CISCO 20180905 Cisco Enterprise NFV Infrastructure Software Denial of Service Vulnerability A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to cause an affected system to reboot or shut down. The vulnerability is due to insufficient server-side authorization checks. An attacker who is logged in to the web-based management interface as a low-privileged user could exploit this vulnerability by sending a crafted HTTP request. A successful exploit could allow the attacker to use the low-privileged user account to reboot or shut down the affected system.

cpe:/a:cisco:network_functions_virtualization_infrastructure:-

CVE-2018-0460

2018-10-05T10:29:04.043-04:00

2019-10-09T19:32:08.070-04:00

6.8

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

NONE

http://nvd.nist.gov BID 105299 CISCO 20180905 Cisco Enterprise NFV Infrastructure Software Information Disclosure Vulnerability A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to read any file on an affected system. The vulnerability is due to insufficient authorization and parameter validation checks. An attacker could exploit this vulnerability by sending a malicious API request with the authentication credentials of a low-privileged user. A successful exploit could allow the attacker to read any file on the affected system.

cpe:/o:cisco:ip_phone_8800_series_firmware:12.5%281%29

CVE-2018-0461

2019-01-10T11:29:00.287-05:00

2019-10-09T19:32:08.177-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 106515 CISCO 20190109 Cisco IP Phone 8800 Series Arbitrary Script Injection Vulnerability A vulnerability in the Cisco IP Phone 8800 Series Software could allow an unauthenticated, remote attacker to conduct an arbitrary script injection attack on an affected device. The vulnerability exists because the software running on an affected device insufficiently validates user-supplied data. An attacker could exploit this vulnerability by persuading a user to click a malicious link provided to the user or through the interface of an affected device. A successful exploit could allow an attacker to execute arbitrary script code in the context of the user interface or access sensitive system-based information, which under normal circumstances should be prohibited.

cpe:/a:cisco:enterprise_network_virtualization_software:nfvis-6.0 cpe:/a:cisco:enterprise_network_virtualization_software:nfvis-8.0

CVE-2018-0462

2018-10-05T10:29:04.137-04:00

2019-10-09T19:32:08.367-04:00

6.8

NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov BID 105291 CISCO 20180905 Cisco Enterprise NFV Infrastructure Software Denial of Service Vulnerability A vulnerability in the user management functionality of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to perform a denial of service (DoS) attack against an affected system. The vulnerability is due to insufficient validation of user-provided input. An attacker could exploit this vulnerability by logging in with a highly privileged user account and performing a sequence of specific user management operations that interfere with the underlying operating system. A successful exploit could allow the attacker to permanently degrade the functionality of the affected system.

cpe:/a:cisco:network_services_orchestrator:1.2.0

CVE-2018-0463

2018-10-05T10:29:04.247-04:00

2019-10-09T19:32:08.477-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CISCO 20180905 Cisco Network Services Orchestrator Network Plug and Play Information Disclosure Vulnerability A vulnerability in the Cisco Network Plug and Play server component of Cisco Network Services Orchestrator (NSO) could allow an unauthenticated, remote attacker to gain unauthorized access to configuration data that is stored on an affected NSO system. The vulnerability exists because the Network Plug and Play component performs incomplete validation when configured to use secure unique device identifiers (SUDI) for authentication. An attacker who controls a Cisco device that supports SUDI authentication and has connectivity to an affected NSO system could exploit this vulnerability. The attacker would need to leverage information about the devices that are being registered on the NSO server to send crafted Cisco Network Plug and Play authentication packets to an affected system. A successful exploit could allow the attacker to gain unauthorized access to configuration data for devices that will be managed by the NSO system.

cpe:/a:cisco:prime_data_center_network_manager:6.3%281%29 cpe:/a:cisco:prime_data_center_network_manager:6.3%282%29 cpe:/a:cisco:prime_data_center_network_manager:7.0%281%29 cpe:/a:cisco:prime_data_center_network_manager:7.0%282%29 cpe:/a:cisco:prime_data_center_network_manager:7.1%281%29 cpe:/a:cisco:prime_data_center_network_manager:10.0 cpe:/a:cisco:prime_data_center_network_manager:10.1 cpe:/a:cisco:prime_data_center_network_manager:10.2 cpe:/a:cisco:prime_data_center_network_manager:10.3%281%29

CVE-2018-0464

2018-10-05T12:29:00.440-04:00

2019-10-09T19:32:08.600-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov BID 105159 SECTRACK 1041585 CISCO 20180828 Cisco Data Center Network Manager Path Traversal Vulnerability MISC https://www.tenable.com/security/research/tra-2018-20 A vulnerability in Cisco Data Center Network Manager software could allow an authenticated, remote attacker to conduct directory traversal attacks and gain access to sensitive files on the targeted system. The vulnerability is due to improper validation of user requests within the management interface. An attacker could exploit this vulnerability by sending malicious requests containing directory traversal character sequences within the management interface. An exploit could allow the attacker to view or create arbitrary files on the targeted system.

cpe:/o:cisco:sf300-08_firmware:1.4.2.4 cpe:/o:cisco:sf300-24_firmware:1.4.2.4 cpe:/o:cisco:sf300-24mp_firmware:1.4.2.4 cpe:/o:cisco:sf300-24p_firmware:1.4.2.4 cpe:/o:cisco:sf300-24pp_firmware:1.4.2.4 cpe:/o:cisco:sf300-48_firmware:1.4.2.4 cpe:/o:cisco:sf300-48p_firmware:1.4.2.4 cpe:/o:cisco:sf300-48pp_firmware:1.4.2.4 cpe:/o:cisco:sf302-08_firmware:1.4.2.4 cpe:/o:cisco:sf302-08mp_firmware:1.4.2.4 cpe:/o:cisco:sf302-08mpp_firmware:1.4.2.4 cpe:/o:cisco:sf302-08p_firmware:1.4.2.4 cpe:/o:cisco:sf302-08pp_firmware:1.4.2.4 cpe:/o:cisco:sg300-10_firmware:1.4.2.4 cpe:/o:cisco:sg300-10mp_firmware:1.4.2.4 cpe:/o:cisco:sg300-10mpp_firmware:1.4.2.4 cpe:/o:cisco:sg300-10p_firmware:1.4.2.4 cpe:/o:cisco:sg300-10pp_firmware:1.4.2.4 cpe:/o:cisco:sg300-10sfp_firmware:1.4.2.4 cpe:/o:cisco:sg300-20_firmware:1.4.2.4 cpe:/o:cisco:sg300-28_firmware:1.4.2.4 cpe:/o:cisco:sg300-28mp_firmware:1.4.2.4 cpe:/o:cisco:sg300-28p_firmware:1.4.2.4 cpe:/o:cisco:sg300-28pp_firmware:1.4.2.4 cpe:/o:cisco:sg300-52_firmware:1.4.2.4 cpe:/o:cisco:sg300-52mp_firmware:1.4.2.4 cpe:/o:cisco:sg300-52p_firmware:1.4.2.4

CVE-2018-0465

2018-10-05T10:29:04.357-04:00

2019-10-09T19:32:08.740-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CISCO 20181003 Cisco Small Business 300 Series Managed Switches Cross-Site Scripting Vulnerability A vulnerability in the web-based management interface of Cisco Small Business 300 Series Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected system. The vulnerability exists because the affected management interface performs insufficient validation of user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or allow the attacker to access sensitive, browser-based information.

cpe:/o:cisco:ios:16.2.1 cpe:/o:cisco:ios_xe:16.2.1

CVE-2018-0466

2018-10-05T10:29:04.467-04:00

2019-10-02T20:03:26.223-04:00

6.1

ADJACENT_NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 105403 SECTRACK 1041737 MISC https://ics-cert.us-cert.gov/advisories/ICSA-19-094-03 CISCO 20180926 Cisco IOS and IOS XE Software OSPFv3 Denial of Service Vulnerability A vulnerability in the Open Shortest Path First version 3 (OSPFv3) implementation in Cisco IOS and IOS XE Software could allow an unauthenticated, adjacent attacker to cause an affected device to reload. The vulnerability is due to incorrect handling of specific OSPFv3 packets. An attacker could exploit this vulnerability by sending crafted OSPFv3 Link-State Advertisements (LSA) to an affected device. An exploit could allow the attacker to cause an affected device to reload, leading to a denial of service (DoS) condition.

cpe:/o:cisco:ios_xe:15.6%282%29sp cpe:/o:cisco:ios_xe:16.6.1 cpe:/o:cisco:ios_xe:everest-16.6.1

CVE-2018-0467

2018-10-05T10:29:04.590-04:00

2019-04-15T08:31:08.757-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1041737 MISC https://ics-cert.us-cert.gov/advisories/ICSA-19-094-03 CISCO 20180926 Cisco IOS and IOS XE Software IPv6 Hop-by-Hop Options Denial of Service Vulnerability A vulnerability in the IPv6 processing code of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload. The vulnerability is due to incorrect handling of specific IPv6 hop-by-hop options. An attacker could exploit this vulnerability by sending a malicious IPv6 packet to or through the affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a denial of service (DoS) condition on an affected device.

cpe:/a:cisco:energy_management_suite:5.2

CVE-2018-0468

2018-12-04T13:29:00.280-05:00

2019-01-02T09:35:26.510-05:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2018-12-28T21:52:44.967-05:00

BID 106124 CISCO 20181204 Cisco Energy Management Suite Default PostgreSQL Password Vulnerability MISC https://www.tenable.com/security/research/tra-2018-42 A vulnerability in the configuration of a local database installed as part of the Cisco Energy Management Suite (CEMS) could allow an authenticated, local attacker to access and alter confidential data. The vulnerability is due to the installation of the PostgreSQL database with unchanged default access credentials. An attacker could exploit this vulnerability by logging in to the machine where CEMS is installed and establishing a local connection to the database. The fix for this vulnerability randomizes the database access password in new installations; however, the fix will not change the password for existing installations. Users are required to manually change the password, as documented in the Workarounds section of this advisory. There are workarounds that address this vulnerability.

cpe:/o:cisco:ios_xe:16.5.1

CVE-2018-0469

2018-10-05T10:29:04.683-04:00

2019-10-09T19:32:09.367-04:00

7.1

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 105423 SECTRACK 1041737 CISCO 20180926 Cisco IOS XE Software Web UI Denial of Service Vulnerability A vulnerability in the web user interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to a double-free-in-memory handling by the affected software when specific HTTP requests are processed. An attacker could exploit this vulnerability by sending specific HTTP requests to the web user interface of the affected software. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a denial of service (DoS) condition on an affected device. To exploit this vulnerability, the attacker must have access to the management interface of the affected software, which is typically connected to a restricted management network.

cpe:/a:cisco:ios_xe:16.1.2 cpe:/a:cisco:ios_xe:16.2.0 cpe:/a:cisco:ios_xe:16.3%281%29

CVE-2018-0470

2018-10-05T10:29:04.810-04:00

2019-10-02T20:03:26.223-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 105397 SECTRACK 1041737 MISC https://ics-cert.us-cert.gov/advisories/ICSA-19-094-03 CISCO 20180926 Cisco IOS XE Software HTTP Denial of Service Vulnerability A vulnerability in the web framework of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a buffer overflow condition on an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to the affected software improperly parsing malformed HTTP packets that are destined to a device. An attacker could exploit this vulnerability by sending a malformed HTTP packet to an affected device for processing. A successful exploit could allow the attacker to cause a buffer overflow condition on the affected device, resulting in a DoS condition.

cpe:/a:cisco:ios_xe:16.6.1 cpe:/a:cisco:ios_xe:16.6.2 cpe:/a:cisco:ios_xe:16.7.1 cpe:/a:cisco:ios_xe:everest-16.6.1

CVE-2018-0471

2018-10-05T10:29:04.920-04:00

2019-10-09T19:32:09.570-04:00

6.1

ADJACENT_NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 105398 SECTRACK 1041737 CISCO 20180926 Cisco IOS XE Software Cisco Discovery Protocol Memory Leak Vulnerability A vulnerability in the Cisco Discovery Protocol (CDP) module of Cisco IOS XE Software Releases 16.6.1 and 16.6.2 could allow an unauthenticated, adjacent attacker to cause a memory leak that may lead to a denial of service (DoS) condition. The vulnerability is due to incorrect processing of certain CDP packets. An attacker could exploit this vulnerability by sending certain CDP packets to an affected device. A successful exploit could cause an affected device to continuously consume memory and eventually result in a memory allocation failure that leads to a crash, triggering a reload of the affected device.

cpe:/o:cisco:ios_xe:15.5%283%29s5.36 cpe:/o:cisco:ios_xe:16.8.1

CVE-2018-0472

2018-10-05T10:29:05.013-04:00

2019-04-15T08:31:09.023-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 105418 SECTRACK 1041735 SECTRACK 1041737 MISC https://ics-cert.us-cert.gov/advisories/ICSA-19-094-04 CISCO 20180926 Cisco IOS XE Software and Cisco ASA 5500-X Series Adaptive Security Appliance IPsec Denial of Service Vulnerability A vulnerability in the IPsec driver code of multiple Cisco IOS XE Software platforms and the Cisco ASA 5500-X Series Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause the device to reload. The vulnerability is due to improper processing of malformed IPsec Authentication Header (AH) or Encapsulating Security Payload (ESP) packets. An attacker could exploit this vulnerability by sending malformed IPsec packets to be processed by an affected device. An exploit could allow the attacker to cause a reload of the affected device.

cpe:/o:cisco:ios:15.2%284%29e cpe:/o:cisco:ios:15.2%285%29

CVE-2018-0473

2018-10-05T10:29:05.137-04:00

2019-10-02T20:03:26.223-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 105427 SECTRACK 1041737 MISC https://ics-cert.us-cert.gov/advisories/ICSA-19-094-03 CISCO 20180926 Cisco IOS Software Precision Time Protocol Denial of Service Vulnerability A vulnerability in the Precision Time Protocol (PTP) subsystem of Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition of the Precision Time Protocol. The vulnerability is due to insufficient processing of PTP packets. An attacker could exploit this vulnerability by sending a custom PTP packet to, or through, an affected device. A successful exploit could allow the attacker to cause a DoS condition for the PTP subsystem, resulting in time synchronization issues across the network.

cpe:/a:cisco:unified_communications_manager:10.5%282.14076.1%29

CVE-2018-0474

2019-01-10T11:29:00.333-05:00

2019-10-09T19:32:09.850-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov BID 106538 CISCO 20190109 Cisco Unified Communications Manager Digest Credentials Disclosure Vulnerability A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view digest credentials in clear text. The vulnerability is due to the incorrect inclusion of saved passwords in configuration pages. An attacker could exploit this vulnerability by logging in to the Cisco Unified Communications Manager web-based management interface and viewing the source code for the configuration page. A successful exploit could allow the attacker to recover passwords and expose those accounts to further attack.

cpe:/o:cisco:ios:15.0%282.0.0%29 cpe:/o:cisco:ios_xe:15.0%282.0.0%29

CVE-2018-0475

2018-10-05T10:29:05.247-04:00

2019-10-09T19:32:10.007-04:00

6.1

ADJACENT_NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 105404 SECTRACK 1041737 CISCO 20180926 Cisco IOS and IOS XE Software Cluster Management Protocol Denial of Service Vulnerability A vulnerability in the implementation of the cluster feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation when handling Cluster Management Protocol (CMP) messages. An attacker could exploit this vulnerability by sending a malicious CMP message to an affected device. A successful exploit could allow the attacker to cause the switch to crash and reload or to hang, resulting in a DoS condition. If the switch hangs it will not reboot automatically, and it will need to be power cycled manually to recover.

cpe:/o:cisco:ios_xe:15.5%283%29s5.1 cpe:/o:cisco:ios_xe:15.5%283%29s6.1 cpe:/o:cisco:ios_xe:16.6.2

CVE-2018-0476

2018-10-05T10:29:05.357-04:00

2019-10-09T19:32:10.130-04:00

7.1

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 105419 SECTRACK 1041734 SECTRACK 1041737 CISCO 20180926 Cisco IOS XE Software NAT Session Initiation Protocol Application Layer Gateway Denial of Service Vulnerability A vulnerability in the Network Address Translation (NAT) Session Initiation Protocol (SIP) Application Layer Gateway (ALG) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to improper processing of SIP packets in transit while NAT is performed on an affected device. An unauthenticated, remote attacker could exploit this vulnerability by sending crafted SIP packets via UDP port 5060 through an affected device that is performing NAT for SIP packets. A successful exploit could allow an attacker to cause the device to reload, resulting in a denial of service (DoS) condition.

cpe:/o:cisco:ios_xe:15.3%283%29s3.16 cpe:/o:cisco:ios_xe:16.7%281%29 cpe:/o:cisco:ios_xe:16.7.1

CVE-2018-0477

2018-10-05T10:29:05.450-04:00

2019-10-09T19:32:10.257-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1041737 CISCO 20180926 Cisco IOS XE Software Command Injection Vulnerabilities A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability exist because the affected software improperly sanitizes command arguments, failing to prevent access to certain internal data structures on an affected device. An attacker who has privileged EXEC mode (privilege level 15) access to an affected device could exploit these vulnerabilities on the device by executing CLI commands that contain custom arguments. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the affected device.

cpe:/o:cisco:ios_xe:3.6%285%29

CVE-2018-0480

2018-10-05T10:29:05.560-04:00

2019-10-09T19:32:10.413-04:00

5.7

ADJACENT_NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 105400 SECTRACK 1041737 CISCO 20180926 Cisco IOS XE Software Errdisable Denial of Service Vulnerability A vulnerability in the errdisable per VLAN feature of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause the device to crash, leading to a denial of service (DoS) condition. The vulnerability is due to a race condition that occurs when the VLAN and port enter an errdisabled state, resulting in an incorrect state in the software. An attacker could exploit this vulnerability by sending frames that trigger the errdisable condition. A successful exploit could allow the attacker to cause the affected device to crash, leading to a DoS condition.

cpe:/o:cisco:ios_xe:15.3%283%29s3.16 cpe:/o:cisco:ios_xe:16.7%281%29 cpe:/o:cisco:ios_xe:16.7.1

CVE-2018-0481

2018-10-05T10:29:05.670-04:00

2019-10-09T19:32:10.523-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

cpe:/a:cisco:prime_infrastructure:3.5%280.0%29

CVE-2018-0482

2019-01-10T11:29:00.380-05:00

2019-10-09T19:32:10.647-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 106514 CISCO 20190109 Cisco Prime Network Control System Stored Cross-Site Scripting Vulnerability A vulnerability in the web-based management interface of Cisco Prime Network Control System could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface of the affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the web-based management interface or allow the attacker to access sensitive browser-based information.

cpe:/a:cisco:jabber:10.0%280%29::~~~windows~~

CVE-2018-0483

2019-01-10T12:29:00.287-05:00

2019-10-09T19:32:10.880-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 106506 CISCO 20190109 Cisco Jabber Client Framework Instant Message Cross-Site Scripting Vulnerability A vulnerability in Cisco Jabber Client Framework (JCF) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of an affected system. The vulnerability is due to insufficient validation of user-supplied input of an affected client. An attacker could exploit this vulnerability by executing arbitrary JavaScript in the Jabber client of the recipient. A successful exploit could allow the attacker to execute arbitrary script code in the context of the targeted client or allow the attacker to access sensitive client-based information.

cpe:/o:cisco:ios:16.6.2 cpe:/o:cisco:ios:16.6.4

CVE-2018-0484

2019-01-10T13:29:00.377-05:00

2019-10-09T19:32:11.037-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 106560 CISCO 20190109 Cisco IOS and IOS XE Software Secure Shell Connection on VRF Vulnerability A vulnerability in the access control logic of the Secure Shell (SSH) server of Cisco IOS and IOS XE Software may allow connections sourced from a virtual routing and forwarding (VRF) instance despite the absence of the vrf-also keyword in the access-class configuration. The vulnerability is due to a missing check in the SSH server. An attacker could use this vulnerability to open an SSH connection to an affected Cisco IOS or IOS XE device with a source address belonging to a VRF instance. Once connected, the attacker would still need to provide valid credentials to access the device.

cpe:/o:cisco:ios:15.6%283%29m cpe:/o:cisco:ios_xe:-

CVE-2018-0485

2018-10-05T10:29:05.777-04:00

2019-10-09T19:32:11.227-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 105433 SECTRACK 1041736 SECTRACK 1041737 CISCO 20180926 Cisco IOS and IOS XE Software SM-1T3/E3 Service Module Denial of Service Vulnerability A vulnerability in the SM-1T3/E3 firmware on Cisco Second Generation Integrated Services Routers (ISR G2) and the Cisco 4451-X Integrated Services Router (ISR4451-X) could allow an unauthenticated, remote attacker to cause the ISR G2 Router or the SM-1T3/E3 module on the ISR4451-X to reload, resulting in a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of user input. An attacker could exploit this vulnerability by first connecting to the SM-1T3/E3 module console and entering a string sequence. A successful exploit could allow the attacker to cause the ISR G2 Router or the SM-1T3/E3 module on the ISR4451-X to reload, resulting in a DoS condition on an affected device.

cpe:/o:debian:debian_linux:7.0 cpe:/o:debian:debian_linux:8.0 cpe:/o:debian:debian_linux:9.0

CVE-2018-0486

2018-01-13T13:29:00.207-05:00

2018-02-15T13:24:28.347-05:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-02-06T22:43:35.320-05:00

SECTRACK 1040177 MLIST [debian-lts-announce] 20180114 [SECURITY] [DLA 1242-1] xmltooling security update MISC https://lists.debian.org/debian-security-announce/2018/msg00007.html MISC https://shibboleth.net/community/advisories/secadv_20180112.txt DEBIAN DSA-4085 Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD.

cpe:/a:arm:mbed_tls:1.3.8 cpe:/a:arm:mbed_tls:1.3.9 cpe:/a:arm:mbed_tls:1.3.10 cpe:/a:arm:mbed_tls:1.3.11 cpe:/a:arm:mbed_tls:1.3.12 cpe:/a:arm:mbed_tls:1.3.13 cpe:/a:arm:mbed_tls:1.3.14 cpe:/a:arm:mbed_tls:1.3.15 cpe:/a:arm:mbed_tls:1.3.16 cpe:/a:arm:mbed_tls:1.3.17 cpe:/a:arm:mbed_tls:1.3.18 cpe:/a:arm:mbed_tls:1.3.19 cpe:/a:arm:mbed_tls:1.3.19:rc1 cpe:/a:arm:mbed_tls:1.3.20 cpe:/a:arm:mbed_tls:1.3.21 cpe:/a:arm:mbed_tls:1.3.21:rc1 cpe:/a:arm:mbed_tls:2.1.0 cpe:/a:arm:mbed_tls:2.1.1 cpe:/a:arm:mbed_tls:2.1.2 cpe:/a:arm:mbed_tls:2.1.3 cpe:/a:arm:mbed_tls:2.1.4 cpe:/a:arm:mbed_tls:2.1.5 cpe:/a:arm:mbed_tls:2.1.6 cpe:/a:arm:mbed_tls:2.1.7 cpe:/a:arm:mbed_tls:2.1.7:rc1 cpe:/a:arm:mbed_tls:2.1.8 cpe:/a:arm:mbed_tls:2.1.9 cpe:/a:arm:mbed_tls:2.1.9:rc1 cpe:/a:arm:mbed_tls:2.2.0 cpe:/a:arm:mbed_tls:2.2.1 cpe:/a:arm:mbed_tls:2.2.2 cpe:/a:arm:mbed_tls:2.2.3 cpe:/a:arm:mbed_tls:2.3.0 cpe:/a:arm:mbed_tls:2.3.1 cpe:/a:arm:mbed_tls:2.3.2 cpe:/a:arm:mbed_tls:2.4.0 cpe:/a:arm:mbed_tls:2.4.1 cpe:/a:arm:mbed_tls:2.4.2 cpe:/a:arm:mbed_tls:2.4.2:rc1 cpe:/a:arm:mbed_tls:2.5.0 cpe:/a:arm:mbed_tls:2.5.0:rc1 cpe:/a:arm:mbed_tls:2.5.1 cpe:/a:arm:mbed_tls:2.6.0 cpe:/a:arm:mbed_tls:2.6.0:rc1 cpe:/a:arm:mbed_tls:2.6.1 cpe:/a:arm:mbed_tls:2.6.1:rc1 cpe:/o:debian:debian_linux:8.0 cpe:/o:debian:debian_linux:9.0

CVE-2018-0487

2018-02-13T10:29:00.217-05:00

2019-03-26T14:20:43.097-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-03-19T14:44:44.003-04:00

BID 103056 GENTOO GLSA-201804-19 CONFIRM https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01 DEBIAN DSA-4138 DEBIAN DSA-4147 ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via a crafted certificate chain that is mishandled during RSASSA-PSS signature verification within a TLS or DTLS session.

cpe:/a:arm:mbed_tls:1.3.0 cpe:/a:arm:mbed_tls:1.3.1 cpe:/a:arm:mbed_tls:1.3.2 cpe:/a:arm:mbed_tls:1.3.3 cpe:/a:arm:mbed_tls:1.3.4 cpe:/a:arm:mbed_tls:1.3.5 cpe:/a:arm:mbed_tls:1.3.6 cpe:/a:arm:mbed_tls:1.3.7 cpe:/a:arm:mbed_tls:1.3.8 cpe:/a:arm:mbed_tls:1.3.9 cpe:/a:arm:mbed_tls:1.3.10 cpe:/a:arm:mbed_tls:1.3.11 cpe:/a:arm:mbed_tls:1.3.12 cpe:/a:arm:mbed_tls:1.3.13 cpe:/a:arm:mbed_tls:1.3.14 cpe:/a:arm:mbed_tls:1.3.15 cpe:/a:arm:mbed_tls:1.3.16 cpe:/a:arm:mbed_tls:1.3.17 cpe:/a:arm:mbed_tls:1.3.18 cpe:/a:arm:mbed_tls:1.3.19 cpe:/a:arm:mbed_tls:1.3.19:rc1 cpe:/a:arm:mbed_tls:1.3.20 cpe:/a:arm:mbed_tls:1.3.21 cpe:/a:arm:mbed_tls:1.3.21:rc1 cpe:/a:arm:mbed_tls:2.1.0 cpe:/a:arm:mbed_tls:2.1.1 cpe:/a:arm:mbed_tls:2.1.2 cpe:/a:arm:mbed_tls:2.1.3 cpe:/a:arm:mbed_tls:2.1.4 cpe:/a:arm:mbed_tls:2.1.5 cpe:/a:arm:mbed_tls:2.1.6 cpe:/a:arm:mbed_tls:2.1.7 cpe:/a:arm:mbed_tls:2.1.7:rc1 cpe:/a:arm:mbed_tls:2.1.8 cpe:/a:arm:mbed_tls:2.1.9 cpe:/a:arm:mbed_tls:2.1.9:rc1 cpe:/a:arm:mbed_tls:2.2.0 cpe:/a:arm:mbed_tls:2.2.1 cpe:/a:arm:mbed_tls:2.2.2 cpe:/a:arm:mbed_tls:2.2.3 cpe:/a:arm:mbed_tls:2.3.0 cpe:/a:arm:mbed_tls:2.3.1 cpe:/a:arm:mbed_tls:2.3.2 cpe:/a:arm:mbed_tls:2.4.0 cpe:/a:arm:mbed_tls:2.4.1 cpe:/a:arm:mbed_tls:2.4.2 cpe:/a:arm:mbed_tls:2.4.2:rc1 cpe:/a:arm:mbed_tls:2.5.0 cpe:/a:arm:mbed_tls:2.5.0:rc1 cpe:/a:arm:mbed_tls:2.5.1 cpe:/a:arm:mbed_tls:2.6.0 cpe:/a:arm:mbed_tls:2.6.0:rc1 cpe:/a:arm:mbed_tls:2.6.1 cpe:/a:arm:mbed_tls:2.6.1:rc1 cpe:/o:debian:debian_linux:8.0 cpe:/o:debian:debian_linux:9.0

CVE-2018-0488

2018-02-13T10:29:00.263-05:00

2019-03-26T14:27:47.590-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-03-19T14:44:06.347-04:00

BID 103057 GENTOO GLSA-201804-19 CONFIRM https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01 DEBIAN DSA-4138 DEBIAN DSA-4147 ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0, when the truncated HMAC extension and CBC are used, allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption) via a crafted application packet within a TLS or DTLS session.

cpe:/a:arubanetworks:clearpass:6.6.0 cpe:/a:arubanetworks:clearpass:6.6.1 cpe:/a:arubanetworks:clearpass:6.6.2 cpe:/a:arubanetworks:clearpass:6.6.3 cpe:/a:arubanetworks:clearpass:6.6.4 cpe:/a:arubanetworks:clearpass:6.6.5 cpe:/a:arubanetworks:clearpass:6.6.7 cpe:/a:arubanetworks:clearpass:6.6.8 cpe:/a:arubanetworks:clearpass:6.6.9 cpe:/a:arubanetworks:clearpass:6.7.0 cpe:/a:arubanetworks:clearpass:6.7.1 cpe:/o:debian:debian_linux:7.0 cpe:/o:debian:debian_linux:8.0 cpe:/o:debian:debian_linux:9.0

CVE-2018-0489

2018-02-27T10:29:00.490-05:00

2018-03-23T11:18:53.200-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-03-21T12:42:06.870-04:00

CONFIRM http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-003.txt BID 103172 SECTRACK 1040435 MLIST [debian-lts-announce] 20180228 [SECURITY] [DLA 1296-1] xmltooling security update CONFIRM https://shibboleth.net/community/advisories/secadv_20180227.txt DEBIAN DSA-4126 Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this issue exists because of an incomplete fix for CVE-2018-0486.

cpe:/a:torproject:tor:0.2.9.14 cpe:/a:torproject:tor:0.3.1.1:alpha cpe:/a:torproject:tor:0.3.1.2:alpha cpe:/a:torproject:tor:0.3.1.3:alpha cpe:/a:torproject:tor:0.3.1.4:alpha cpe:/a:torproject:tor:0.3.1.5:alpha cpe:/a:torproject:tor:0.3.1.6:rc cpe:/a:torproject:tor:0.3.1.7 cpe:/a:torproject:tor:0.3.1.8 cpe:/a:torproject:tor:0.3.1.9 cpe:/a:torproject:tor:0.3.2.1:alpha cpe:/a:torproject:tor:0.3.2.2:alpha cpe:/a:torproject:tor:0.3.2.3:alpha cpe:/a:torproject:tor:0.3.2.4:alpha cpe:/a:torproject:tor:0.3.2.5:alpha cpe:/a:torproject:tor:0.3.2.6:alpha cpe:/a:torproject:tor:0.3.2.7:rc cpe:/a:torproject:tor:0.3.2.8:rc cpe:/a:torproject:tor:0.3.2.9 cpe:/o:debian:debian_linux:9.0

CVE-2018-0490

2018-03-05T10:29:00.207-05:00

2019-04-30T10:58:53.197-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-04-26T13:07:32.110-04:00

CONFIRM https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915 CONFIRM https://trac.torproject.org/projects/tor/ticket/25074 DEBIAN DSA-4183 An issue was discovered in Tor before 0.2.9.15, 0.3.1.x before 0.3.1.10, and 0.3.2.x before 0.3.2.10. The directory-authority protocol-list subprotocol implementation allows remote attackers to cause a denial of service (NULL pointer dereference and directory-authority crash) via a misformatted relay descriptor that is mishandled during voting.

cpe:/a:torproject:tor:0.3.2.1:alpha cpe:/a:torproject:tor:0.3.2.2:alpha cpe:/a:torproject:tor:0.3.2.3:alpha cpe:/a:torproject:tor:0.3.2.4:alpha cpe:/a:torproject:tor:0.3.2.5:alpha cpe:/a:torproject:tor:0.3.2.6:alpha cpe:/a:torproject:tor:0.3.2.7:rc cpe:/a:torproject:tor:0.3.2.8:rc cpe:/a:torproject:tor:0.3.2.9

CVE-2018-0491

2018-03-05T10:29:00.270-05:00

2019-03-26T14:52:49.663-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-03-19T11:18:04.337-04:00

CONFIRM https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915 CONFIRM https://trac.torproject.org/projects/tor/ticket/24700 CONFIRM https://trac.torproject.org/projects/tor/ticket/25117 EXPLOIT-DB 44994 A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. It allows remote attackers to cause a denial of service (relay crash) because the KIST implementation allows a channel to be added more than once in the pending list.

cpe:/a:beep_project:beep:1.3.4 cpe:/o:debian:debian_linux:7.0 cpe:/o:debian:debian_linux:8.0 cpe:/o:debian:debian_linux:9.0

CVE-2018-0492

2018-04-03T03:29:00.220-04:00

2019-03-14T14:43:09.570-04:00

4.4

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-03-14T13:42:16.900-04:00

MLIST [debian-lts-announce] 20180403 [SECURITY] [DLA 1338-1] beep security update CONFIRM https://lists.debian.org/debian-security-announce/2018/msg00089.html GENTOO GLSA-201805-15 CONFIRM https://security-tracker.debian.org/tracker/CVE-2018-0492 DEBIAN DSA-4163 EXPLOIT-DB 44452 Johnathan Nightingale beep through 1.3.4, if setuid, has a race condition that allows local privilege escalation.

cpe:/a:eyrie:remctl:1.0 cpe:/a:eyrie:remctl:1.1 cpe:/a:eyrie:remctl:1.2 cpe:/a:eyrie:remctl:1.2.1 cpe:/a:eyrie:remctl:1.3 cpe:/a:eyrie:remctl:1.4 cpe:/a:eyrie:remctl:1.5 cpe:/a:eyrie:remctl:1.6 cpe:/a:eyrie:remctl:1.7 cpe:/a:eyrie:remctl:1.8 cpe:/a:eyrie:remctl:1.9 cpe:/a:eyrie:remctl:1.10 cpe:/a:eyrie:remctl:1.11 cpe:/a:eyrie:remctl:1.12 cpe:/a:eyrie:remctl:2.0 cpe:/a:eyrie:remctl:2.1 cpe:/a:eyrie:remctl:2.2 cpe:/a:eyrie:remctl:2.3 cpe:/a:eyrie:remctl:2.4 cpe:/a:eyrie:remctl:2.5 cpe:/a:eyrie:remctl:2.6 cpe:/a:eyrie:remctl:2.7 cpe:/a:eyrie:remctl:2.8 cpe:/a:eyrie:remctl:2.9 cpe:/a:eyrie:remctl:2.10 cpe:/a:eyrie:remctl:2.11 cpe:/a:eyrie:remctl:2.12 cpe:/a:eyrie:remctl:2.13 cpe:/a:eyrie:remctl:2.14 cpe:/a:eyrie:remctl:2.15 cpe:/a:eyrie:remctl:2.16 cpe:/a:eyrie:remctl:2.17 cpe:/a:eyrie:remctl:2.18 cpe:/a:eyrie:remctl:3.0 cpe:/a:eyrie:remctl:3.1 cpe:/a:eyrie:remctl:3.2 cpe:/a:eyrie:remctl:3.3 cpe:/a:eyrie:remctl:3.4 cpe:/a:eyrie:remctl:3.5 cpe:/a:eyrie:remctl:3.6 cpe:/a:eyrie:remctl:3.7 cpe:/a:eyrie:remctl:3.8 cpe:/a:eyrie:remctl:3.9 cpe:/a:eyrie:remctl:3.10 cpe:/a:eyrie:remctl:3.11 cpe:/a:eyrie:remctl:3.12 cpe:/a:eyrie:remctl:3.13 cpe:/o:debian:debian_linux:9.0

CVE-2018-0493

2018-04-03T03:29:00.283-04:00

2018-05-21T09:03:00.727-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2018-05-08T15:59:55.407-04:00

CONFIRM https://git.eyrie.org/?p=kerberos/remctl.git;a=commit;h=86c7e44090c988112a37589d2c7a94029eb5e641 DEBIAN DSA-4159 CONFIRM https://www.eyrie.org/~eagle/software/remctl/security/2018-04-01.html remctld in remctl before 3.14, when an attacker is authorized to execute a command that uses the sudo option, has a use-after-free that leads to a daemon crash, memory corruption, or arbitrary command execution.

cpe:/a:gnu:wget:- cpe:/a:gnu:wget:1.4.0 cpe:/a:gnu:wget:1.4.1 cpe:/a:gnu:wget:1.4.2 cpe:/a:gnu:wget:1.4.3 cpe:/a:gnu:wget:1.5.0 cpe:/a:gnu:wget:1.5.3 cpe:/a:gnu:wget:1.6 cpe:/a:gnu:wget:1.7 cpe:/a:gnu:wget:1.7.1 cpe:/a:gnu:wget:1.8 cpe:/a:gnu:wget:1.8.1 cpe:/a:gnu:wget:1.8.2 cpe:/a:gnu:wget:1.9 cpe:/a:gnu:wget:1.9.1 cpe:/a:gnu:wget:1.10 cpe:/a:gnu:wget:1.10.1 cpe:/a:gnu:wget:1.10.2 cpe:/a:gnu:wget:1.11 cpe:/a:gnu:wget:1.11.1 cpe:/a:gnu:wget:1.11.2 cpe:/a:gnu:wget:1.11.3 cpe:/a:gnu:wget:1.11.4 cpe:/a:gnu:wget:1.11.4-1::~~gnuwin32~~~ cpe:/a:gnu:wget:1.12 cpe:/a:gnu:wget:1.13 cpe:/a:gnu:wget:1.13.1 cpe:/a:gnu:wget:1.13.3 cpe:/a:gnu:wget:1.13.4 cpe:/a:gnu:wget:1.14 cpe:/a:gnu:wget:1.15 cpe:/a:gnu:wget:1.16 cpe:/a:gnu:wget:1.16.1 cpe:/a:gnu:wget:1.16.2 cpe:/a:gnu:wget:1.16.3 cpe:/a:gnu:wget:1.17 cpe:/a:gnu:wget:1.17.1 cpe:/a:gnu:wget:1.18 cpe:/a:gnu:wget:1.19 cpe:/a:gnu:wget:1.19.1 cpe:/a:gnu:wget:1.19.2 cpe:/a:gnu:wget:1.19.3 cpe:/a:gnu:wget:1.19.4 cpe:/o:canonical:ubuntu_linux:12.04::~~esm~~~ cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:17.10 cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~ cpe:/o:debian:debian_linux:7.0 cpe:/o:debian:debian_linux:8.0 cpe:/o:debian:debian_linux:9.0 cpe:/o:redhat:enterprise_linux_desktop:7.0 cpe:/o:redhat:enterprise_linux_server:7.0 cpe:/o:redhat:enterprise_linux_workstation:7.0

CVE-2018-0494

2018-05-06T18:29:00.217-04:00

2019-03-14T21:22:23.727-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-14T13:40:00.303-04:00

BID 104129 SECTRACK 1040838 REDHAT RHSA-2018:3052 MISC https://git.savannah.gnu.org/cgit/wget.git/commit/?id=1fc9c95ec144499e69dc8ec76dbe07799d7d82cd MLIST [debian-lts-announce] 20180511 [SECURITY] [DLA 1375-1] wget security update MISC https://lists.gnu.org/archive/html/bug-wget/2018-05/msg00020.html MISC https://savannah.gnu.org/bugs/?53763 GENTOO GLSA-201806-01 MISC https://sintonen.fi/advisories/gnu-wget-cookie-injection.txt UBUNTU USN-3643-1 UBUNTU USN-3643-2 DEBIAN DSA-4195 EXPLOIT-DB 44601 GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line.

cpe:/a:gnupg:libgcrypt:0.1.0 cpe:/a:gnupg:libgcrypt:0.2.0 cpe:/a:gnupg:libgcrypt:0.2.6 cpe:/a:gnupg:libgcrypt:0.2.8 cpe:/a:gnupg:libgcrypt:0.2.10 cpe:/a:gnupg:libgcrypt:0.2.15 cpe:/a:gnupg:libgcrypt:0.2.17 cpe:/a:gnupg:libgcrypt:0.2.18 cpe:/a:gnupg:libgcrypt:0.2.19 cpe:/a:gnupg:libgcrypt:0.3.0 cpe:/a:gnupg:libgcrypt:0.3.1 cpe:/a:gnupg:libgcrypt:0.3.2 cpe:/a:gnupg:libgcrypt:0.3.3 cpe:/a:gnupg:libgcrypt:0.3.4 cpe:/a:gnupg:libgcrypt:0.3.5 cpe:/a:gnupg:libgcrypt:0.4.0 cpe:/a:gnupg:libgcrypt:0.4.1 cpe:/a:gnupg:libgcrypt:0.4.2 cpe:/a:gnupg:libgcrypt:0.4.3 cpe:/a:gnupg:libgcrypt:0.4.4 cpe:/a:gnupg:libgcrypt:0.4.5 cpe:/a:gnupg:libgcrypt:0.9.0 cpe:/a:gnupg:libgcrypt:0.9.1 cpe:/a:gnupg:libgcrypt:0.9.2 cpe:/a:gnupg:libgcrypt:0.9.3 cpe:/a:gnupg:libgcrypt:0.9.4 cpe:/a:gnupg:libgcrypt:0.9.5 cpe:/a:gnupg:libgcrypt:0.9.6 cpe:/a:gnupg:libgcrypt:0.9.7 cpe:/a:gnupg:libgcrypt:0.9.8 cpe:/a:gnupg:libgcrypt:0.9.9 cpe:/a:gnupg:libgcrypt:0.9.10 cpe:/a:gnupg:libgcrypt:0.9.11 cpe:/a:gnupg:libgcrypt:1.0.0 cpe:/a:gnupg:libgcrypt:1.0.1 cpe:/a:gnupg:libgcrypt:1.0.2 cpe:/a:gnupg:libgcrypt:1.0.3 cpe:/a:gnupg:libgcrypt:1.0.4 cpe:/a:gnupg:libgcrypt:1.1.0 cpe:/a:gnupg:libgcrypt:1.1.2 cpe:/a:gnupg:libgcrypt:1.1.3 cpe:/a:gnupg:libgcrypt:1.1.4 cpe:/a:gnupg:libgcrypt:1.1.5 cpe:/a:gnupg:libgcrypt:1.1.6 cpe:/a:gnupg:libgcrypt:1.1.7 cpe:/a:gnupg:libgcrypt:1.1.8 cpe:/a:gnupg:libgcrypt:1.1.9 cpe:/a:gnupg:libgcrypt:1.1.10 cpe:/a:gnupg:libgcrypt:1.1.11 cpe:/a:gnupg:libgcrypt:1.1.12 cpe:/a:gnupg:libgcrypt:1.1.42 cpe:/a:gnupg:libgcrypt:1.1.43 cpe:/a:gnupg:libgcrypt:1.1.44 cpe:/a:gnupg:libgcrypt:1.1.90 cpe:/a:gnupg:libgcrypt:1.1.91 cpe:/a:gnupg:libgcrypt:1.1.92 cpe:/a:gnupg:libgcrypt:1.1.93 cpe:/a:gnupg:libgcrypt:1.1.94 cpe:/a:gnupg:libgcrypt:1.2.0 cpe:/a:gnupg:libgcrypt:1.2.1 cpe:/a:gnupg:libgcrypt:1.2.2 cpe:/a:gnupg:libgcrypt:1.2.3 cpe:/a:gnupg:libgcrypt:1.2.4 cpe:/a:gnupg:libgcrypt:1.3.0 cpe:/a:gnupg:libgcrypt:1.3.1 cpe:/a:gnupg:libgcrypt:1.3.2 cpe:/a:gnupg:libgcrypt:1.4.0 cpe:/a:gnupg:libgcrypt:1.4.1 cpe:/a:gnupg:libgcrypt:1.4.1:rc1 cpe:/a:gnupg:libgcrypt:1.4.2 cpe:/a:gnupg:libgcrypt:1.4.2:rc1 cpe:/a:gnupg:libgcrypt:1.4.2:rc2 cpe:/a:gnupg:libgcrypt:1.4.3 cpe:/a:gnupg:libgcrypt:1.4.4 cpe:/a:gnupg:libgcrypt:1.4.5 cpe:/a:gnupg:libgcrypt:1.4.6 cpe:/a:gnupg:libgcrypt:1.5.0 cpe:/a:gnupg:libgcrypt:1.5.0:beta1 cpe:/a:gnupg:libgcrypt:1.5.1 cpe:/a:gnupg:libgcrypt:1.5.2 cpe:/a:gnupg:libgcrypt:1.5.3 cpe:/a:gnupg:libgcrypt:1.5.4 cpe:/a:gnupg:libgcrypt:1.5.5 cpe:/a:gnupg:libgcrypt:1.5.6 cpe:/a:gnupg:libgcrypt:1.6.0 cpe:/a:gnupg:libgcrypt:1.6.1 cpe:/a:gnupg:libgcrypt:1.6.2 cpe:/a:gnupg:libgcrypt:1.6.3 cpe:/a:gnupg:libgcrypt:1.6.4 cpe:/a:gnupg:libgcrypt:1.6.5 cpe:/a:gnupg:libgcrypt:1.6.6 cpe:/a:gnupg:libgcrypt:1.7.0 cpe:/a:gnupg:libgcrypt:1.7.1 cpe:/a:gnupg:libgcrypt:1.7.2 cpe:/a:gnupg:libgcrypt:1.7.3 cpe:/a:gnupg:libgcrypt:1.7.4 cpe:/a:gnupg:libgcrypt:1.7.5 cpe:/a:gnupg:libgcrypt:1.7.6 cpe:/a:gnupg:libgcrypt:1.7.7 cpe:/a:gnupg:libgcrypt:1.7.8 cpe:/a:gnupg:libgcrypt:1.7.9 cpe:/a:gnupg:libgcrypt:1.8.0 cpe:/a:gnupg:libgcrypt:1.8.1 cpe:/a:gnupg:libgcrypt:1.8.2 cpe:/a:oracle:traffic_director:11.1.1.9.0 cpe:/a:redhat:ansible_tower:3.3 cpe:/o:canonical:ubuntu_linux:12.04::~~esm~~~ cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:17.10 cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:18.10 cpe:/o:debian:debian_linux:8.0 cpe:/o:debian:debian_linux:9.0 cpe:/o:redhat:enterprise_linux_desktop:7.0 cpe:/o:redhat:enterprise_linux_server:7.0 cpe:/o:redhat:enterprise_linux_workstation:7.0

CVE-2018-0495

2018-06-13T19:29:00.333-04:00

2019-05-30T14:29:00.443-04:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1041144 SECTRACK 1041147 REDHAT RHSA-2018:3221 REDHAT RHSA-2018:3505 REDHAT RHSA-2019:1296 REDHAT RHSA-2019:1297 REDHAT RHSA-2019:1543 REDHAT RHSA-2019:2237 MISC https://dev.gnupg.org/T4011 MISC https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=9010d1576e278a4274ad3f4aa15776c28f6ba965 MLIST [debian-lts-announce] 20180629 [SECURITY] [DLA 1405-1] libgcrypt20 security update MISC https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000426.html UBUNTU USN-3689-1 UBUNTU USN-3689-2 UBUNTU USN-3692-1 UBUNTU USN-3692-2 UBUNTU USN-3850-1 UBUNTU USN-3850-2 DEBIAN DSA-4231 MISC https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/ MISC https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.

cpe:/o:debian:debian_linux:8.0

CVE-2018-0496

2018-06-12T16:29:00.467-04:00

2019-03-01T08:01:38.413-05:00

6.4

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-02-28T12:40:41.560-05:00

CONFIRM https://git.savannah.gnu.org/cgit/freedink/dfarc.git/commit/?id=40cc957f52e772f45125126439ba9333cf2d2998 MLIST [debian-lts-announce] 20190224 [SECURITY] [DLA 1686-1] freedink-dfarc security update CONFIRM https://savannah.gnu.org/forum/forum.php?forum_id=9169 Directory traversal issues in the D-Mod extractor in DFArc and DFArc2 (as well as in RTsoft's Dink Smallwood HD / ProtonSDK version) before 3.14 allow an attacker to overwrite arbitrary files on the user's system.

cpe:/a:arm:mbed_tls:1.3.0 cpe:/a:arm:mbed_tls:1.3.1 cpe:/a:arm:mbed_tls:1.3.2 cpe:/a:arm:mbed_tls:1.3.3 cpe:/a:arm:mbed_tls:1.3.4 cpe:/a:arm:mbed_tls:1.3.5 cpe:/a:arm:mbed_tls:1.3.6 cpe:/a:arm:mbed_tls:1.3.7 cpe:/a:arm:mbed_tls:1.3.8 cpe:/a:arm:mbed_tls:1.3.9 cpe:/a:arm:mbed_tls:1.3.10 cpe:/a:arm:mbed_tls:1.3.11 cpe:/a:arm:mbed_tls:1.3.12 cpe:/a:arm:mbed_tls:1.3.13 cpe:/a:arm:mbed_tls:1.3.14 cpe:/a:arm:mbed_tls:1.3.15 cpe:/a:arm:mbed_tls:1.3.16 cpe:/a:arm:mbed_tls:1.3.17 cpe:/a:arm:mbed_tls:1.3.18 cpe:/a:arm:mbed_tls:1.3.19 cpe:/a:arm:mbed_tls:1.3.19:rc1 cpe:/a:arm:mbed_tls:1.3.20 cpe:/a:arm:mbed_tls:1.3.21 cpe:/a:arm:mbed_tls:1.3.21:rc1 cpe:/a:arm:mbed_tls:1.3.22 cpe:/a:arm:mbed_tls:1.3.22:rc1 cpe:/a:arm:mbed_tls:2.0.0 cpe:/a:arm:mbed_tls:2.1.0 cpe:/a:arm:mbed_tls:2.1.1 cpe:/a:arm:mbed_tls:2.1.2 cpe:/a:arm:mbed_tls:2.1.3 cpe:/a:arm:mbed_tls:2.1.4 cpe:/a:arm:mbed_tls:2.1.5 cpe:/a:arm:mbed_tls:2.1.6 cpe:/a:arm:mbed_tls:2.1.7 cpe:/a:arm:mbed_tls:2.1.7:rc1 cpe:/a:arm:mbed_tls:2.1.8 cpe:/a:arm:mbed_tls:2.1.9 cpe:/a:arm:mbed_tls:2.1.9:rc1 cpe:/a:arm:mbed_tls:2.1.10 cpe:/a:arm:mbed_tls:2.1.10:rc1 cpe:/a:arm:mbed_tls:2.1.11 cpe:/a:arm:mbed_tls:2.1.11:rc1 cpe:/a:arm:mbed_tls:2.1.12 cpe:/a:arm:mbed_tls:2.1.13 cpe:/a:arm:mbed_tls:2.2.0 cpe:/a:arm:mbed_tls:2.2.1 cpe:/a:arm:mbed_tls:2.2.2 cpe:/a:arm:mbed_tls:2.2.3 cpe:/a:arm:mbed_tls:2.3.0 cpe:/a:arm:mbed_tls:2.3.1 cpe:/a:arm:mbed_tls:2.3.2 cpe:/a:arm:mbed_tls:2.4.0 cpe:/a:arm:mbed_tls:2.4.1 cpe:/a:arm:mbed_tls:2.4.2 cpe:/a:arm:mbed_tls:2.4.2:rc1 cpe:/a:arm:mbed_tls:2.5.0 cpe:/a:arm:mbed_tls:2.5.0:rc1 cpe:/a:arm:mbed_tls:2.5.1 cpe:/a:arm:mbed_tls:2.6.0 cpe:/a:arm:mbed_tls:2.6.0:rc1 cpe:/a:arm:mbed_tls:2.6.1 cpe:/a:arm:mbed_tls:2.6.1:rc1 cpe:/a:arm:mbed_tls:2.7.0 cpe:/a:arm:mbed_tls:2.7.0:rc1 cpe:/a:arm:mbed_tls:2.7.1 cpe:/a:arm:mbed_tls:2.7.2 cpe:/a:arm:mbed_tls:2.7.2:rc1 cpe:/a:arm:mbed_tls:2.7.3 cpe:/a:arm:mbed_tls:2.7.4 cpe:/a:arm:mbed_tls:2.8.0 cpe:/a:arm:mbed_tls:2.8.0:rc1 cpe:/a:arm:mbed_tls:2.9.0 cpe:/a:arm:mbed_tls:2.10.0 cpe:/a:arm:mbed_tls:2.11.0 cpe:/o:debian:debian_linux:8.0 cpe:/o:debian:debian_linux:9.0

CVE-2018-0497

2018-07-28T13:29:00.240-04:00

2019-10-02T20:03:26.223-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-09-26T11:31:14.097-04:00

MLIST [debian-lts-announce] 20180925 [SECURITY] [DLA 1518-1] polarssl security update CONFIRM https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-02 DEBIAN DSA-4296 ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14 allows remote attackers to achieve partial plaintext recovery (for a CBC based ciphersuite) via a timing-based side-channel attack. This vulnerability exists because of an incorrect fix (with a wrong SHA-384 calculation) for CVE-2013-0169.

cpe:/a:arm:mbed_tls:1.3.0 cpe:/a:arm:mbed_tls:1.3.1 cpe:/a:arm:mbed_tls:1.3.2 cpe:/a:arm:mbed_tls:1.3.3 cpe:/a:arm:mbed_tls:1.3.4 cpe:/a:arm:mbed_tls:1.3.5 cpe:/a:arm:mbed_tls:1.3.6 cpe:/a:arm:mbed_tls:1.3.7 cpe:/a:arm:mbed_tls:1.3.8 cpe:/a:arm:mbed_tls:1.3.9 cpe:/a:arm:mbed_tls:1.3.10 cpe:/a:arm:mbed_tls:1.3.11 cpe:/a:arm:mbed_tls:1.3.12 cpe:/a:arm:mbed_tls:1.3.13 cpe:/a:arm:mbed_tls:1.3.14 cpe:/a:arm:mbed_tls:1.3.15 cpe:/a:arm:mbed_tls:1.3.16 cpe:/a:arm:mbed_tls:1.3.17 cpe:/a:arm:mbed_tls:1.3.18 cpe:/a:arm:mbed_tls:1.3.19 cpe:/a:arm:mbed_tls:1.3.19:rc1 cpe:/a:arm:mbed_tls:1.3.20 cpe:/a:arm:mbed_tls:1.3.21 cpe:/a:arm:mbed_tls:1.3.21:rc1 cpe:/a:arm:mbed_tls:1.3.22 cpe:/a:arm:mbed_tls:1.3.22:rc1 cpe:/a:arm:mbed_tls:2.0.0 cpe:/a:arm:mbed_tls:2.1.0 cpe:/a:arm:mbed_tls:2.1.1 cpe:/a:arm:mbed_tls:2.1.2 cpe:/a:arm:mbed_tls:2.1.3 cpe:/a:arm:mbed_tls:2.1.4 cpe:/a:arm:mbed_tls:2.1.5 cpe:/a:arm:mbed_tls:2.1.6 cpe:/a:arm:mbed_tls:2.1.7 cpe:/a:arm:mbed_tls:2.1.7:rc1 cpe:/a:arm:mbed_tls:2.1.8 cpe:/a:arm:mbed_tls:2.1.9 cpe:/a:arm:mbed_tls:2.1.9:rc1 cpe:/a:arm:mbed_tls:2.1.10 cpe:/a:arm:mbed_tls:2.1.10:rc1 cpe:/a:arm:mbed_tls:2.1.11 cpe:/a:arm:mbed_tls:2.1.11:rc1 cpe:/a:arm:mbed_tls:2.1.12 cpe:/a:arm:mbed_tls:2.1.13 cpe:/a:arm:mbed_tls:2.2.0 cpe:/a:arm:mbed_tls:2.2.1 cpe:/a:arm:mbed_tls:2.2.2 cpe:/a:arm:mbed_tls:2.2.3 cpe:/a:arm:mbed_tls:2.3.0 cpe:/a:arm:mbed_tls:2.3.1 cpe:/a:arm:mbed_tls:2.3.2 cpe:/a:arm:mbed_tls:2.4.0 cpe:/a:arm:mbed_tls:2.4.1 cpe:/a:arm:mbed_tls:2.4.2 cpe:/a:arm:mbed_tls:2.4.2:rc1 cpe:/a:arm:mbed_tls:2.5.0 cpe:/a:arm:mbed_tls:2.5.0:rc1 cpe:/a:arm:mbed_tls:2.5.1 cpe:/a:arm:mbed_tls:2.6.0 cpe:/a:arm:mbed_tls:2.6.0:rc1 cpe:/a:arm:mbed_tls:2.6.1 cpe:/a:arm:mbed_tls:2.6.1:rc1 cpe:/a:arm:mbed_tls:2.7.0 cpe:/a:arm:mbed_tls:2.7.0:rc1 cpe:/a:arm:mbed_tls:2.7.1 cpe:/a:arm:mbed_tls:2.7.2 cpe:/a:arm:mbed_tls:2.7.2:rc1 cpe:/a:arm:mbed_tls:2.7.3 cpe:/a:arm:mbed_tls:2.7.4 cpe:/a:arm:mbed_tls:2.8.0 cpe:/a:arm:mbed_tls:2.8.0:rc1 cpe:/a:arm:mbed_tls:2.9.0 cpe:/a:arm:mbed_tls:2.10.0 cpe:/a:arm:mbed_tls:2.11.0 cpe:/o:debian:debian_linux:8.0 cpe:/o:debian:debian_linux:9.0

CVE-2018-0498

2018-07-28T13:29:00.287-04:00

2019-10-02T20:03:26.223-04:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-09-26T11:29:37.827-04:00

MLIST [debian-lts-announce] 20180925 [SECURITY] [DLA 1518-1] polarssl security update CONFIRM https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-02 DEBIAN DSA-4296 ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14 allows local users to achieve partial plaintext recovery (for a CBC based ciphersuite) via a cache-based side-channel attack.

cpe:/a:xapian:xapian-core:0.5.0 cpe:/a:xapian:xapian-core:0.5.1 cpe:/a:xapian:xapian-core:0.5.2 cpe:/a:xapian:xapian-core:0.5.3 cpe:/a:xapian:xapian-core:0.5.4 cpe:/a:xapian:xapian-core:0.5.5 cpe:/a:xapian:xapian-core:0.6.0 cpe:/a:xapian:xapian-core:0.6.1 cpe:/a:xapian:xapian-core:0.6.2 cpe:/a:xapian:xapian-core:0.6.3 cpe:/a:xapian:xapian-core:0.6.4 cpe:/a:xapian:xapian-core:0.6.5 cpe:/a:xapian:xapian-core:0.7.0 cpe:/a:xapian:xapian-core:0.7.1 cpe:/a:xapian:xapian-core:0.7.2 cpe:/a:xapian:xapian-core:0.7.3 cpe:/a:xapian:xapian-core:0.7.4 cpe:/a:xapian:xapian-core:0.7.5 cpe:/a:xapian:xapian-core:0.8.0 cpe:/a:xapian:xapian-core:0.8.1 cpe:/a:xapian:xapian-core:0.8.2 cpe:/a:xapian:xapian-core:0.8.3 cpe:/a:xapian:xapian-core:0.8.4 cpe:/a:xapian:xapian-core:0.8.5 cpe:/a:xapian:xapian-core:0.9.0 cpe:/a:xapian:xapian-core:0.9.1 cpe:/a:xapian:xapian-core:0.9.2 cpe:/a:xapian:xapian-core:0.9.3 cpe:/a:xapian:xapian-core:0.9.4 cpe:/a:xapian:xapian-core:0.9.5 cpe:/a:xapian:xapian-core:0.9.6 cpe:/a:xapian:xapian-core:0.9.7 cpe:/a:xapian:xapian-core:0.9.8 cpe:/a:xapian:xapian-core:0.9.9 cpe:/a:xapian:xapian-core:0.9.10 cpe:/a:xapian:xapian-core:1.0.0 cpe:/a:xapian:xapian-core:1.0.1 cpe:/a:xapian:xapian-core:1.0.2 cpe:/a:xapian:xapian-core:1.0.3 cpe:/a:xapian:xapian-core:1.0.4 cpe:/a:xapian:xapian-core:1.0.5 cpe:/a:xapian:xapian-core:1.0.6 cpe:/a:xapian:xapian-core:1.0.7 cpe:/a:xapian:xapian-core:1.0.8 cpe:/a:xapian:xapian-core:1.0.9 cpe:/a:xapian:xapian-core:1.0.10 cpe:/a:xapian:xapian-core:1.0.11 cpe:/a:xapian:xapian-core:1.0.12 cpe:/a:xapian:xapian-core:1.0.13 cpe:/a:xapian:xapian-core:1.0.14 cpe:/a:xapian:xapian-core:1.0.15 cpe:/a:xapian:xapian-core:1.0.16 cpe:/a:xapian:xapian-core:1.0.17 cpe:/a:xapian:xapian-core:1.0.18 cpe:/a:xapian:xapian-core:1.0.19 cpe:/a:xapian:xapian-core:1.0.20 cpe:/a:xapian:xapian-core:1.0.21 cpe:/a:xapian:xapian-core:1.0.22 cpe:/a:xapian:xapian-core:1.0.23 cpe:/a:xapian:xapian-core:1.1.0 cpe:/a:xapian:xapian-core:1.1.1 cpe:/a:xapian:xapian-core:1.1.2 cpe:/a:xapian:xapian-core:1.1.3 cpe:/a:xapian:xapian-core:1.1.4 cpe:/a:xapian:xapian-core:1.1.5 cpe:/a:xapian:xapian-core:1.2.0 cpe:/a:xapian:xapian-core:1.2.1 cpe:/a:xapian:xapian-core:1.2.2 cpe:/a:xapian:xapian-core:1.2.3 cpe:/a:xapian:xapian-core:1.2.4 cpe:/a:xapian:xapian-core:1.2.5 cpe:/a:xapian:xapian-core:1.2.6 cpe:/a:xapian:xapian-core:1.2.7 cpe:/a:xapian:xapian-core:1.2.8 cpe:/a:xapian:xapian-core:1.2.9 cpe:/a:xapian:xapian-core:1.2.10 cpe:/a:xapian:xapian-core:1.2.11 cpe:/a:xapian:xapian-core:1.2.12 cpe:/a:xapian:xapian-core:1.2.13 cpe:/a:xapian:xapian-core:1.2.14 cpe:/a:xapian:xapian-core:1.2.15 cpe:/a:xapian:xapian-core:1.2.16 cpe:/a:xapian:xapian-core:1.2.17 cpe:/a:xapian:xapian-core:1.2.18 cpe:/a:xapian:xapian-core:1.2.19 cpe:/a:xapian:xapian-core:1.2.20 cpe:/a:xapian:xapian-core:1.2.21 cpe:/a:xapian:xapian-core:1.2.22 cpe:/a:xapian:xapian-core:1.2.23 cpe:/a:xapian:xapian-core:1.3.0 cpe:/a:xapian:xapian-core:1.3.1 cpe:/a:xapian:xapian-core:1.3.2 cpe:/a:xapian:xapian-core:1.3.3 cpe:/a:xapian:xapian-core:1.3.4 cpe:/a:xapian:xapian-core:1.3.5 cpe:/a:xapian:xapian-core:1.3.6 cpe:/a:xapian:xapian-core:1.3.7 cpe:/a:xapian:xapian-core:1.4.0 cpe:/a:xapian:xapian-core:1.4.1 cpe:/a:xapian:xapian-core:1.4.2 cpe:/a:xapian:xapian-core:1.4.3 cpe:/a:xapian:xapian-core:1.4.4 cpe:/a:xapian:xapian-core:1.4.5 cpe:/o:canonical:ubuntu_linux:17.10 cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~

CVE-2018-0499

2018-07-02T08:29:00.220-04:00

2018-08-28T13:46:35.233-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-08-21T10:43:21.577-04:00

CONFIRM https://lists.xapian.org/pipermail/xapian-discuss/2018-July/009652.html CONFIRM https://trac.xapian.org/wiki/SecurityFixes/2018-07-02 UBUNTU USN-3709-1 A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by Xapian::MSet::snippet().

cpe:/a:haxx:curl:7.54.1 cpe:/a:haxx:curl:7.55.0 cpe:/a:haxx:curl:7.55.1 cpe:/a:haxx:curl:7.56.0 cpe:/a:haxx:curl:7.56.1 cpe:/a:haxx:curl:7.57.0 cpe:/a:haxx:curl:7.58.0 cpe:/a:haxx:curl:7.59.0 cpe:/a:haxx:curl:7.60.0 cpe:/o:canonical:ubuntu_linux:17.10 cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~

CVE-2018-0500

2018-07-11T09:29:00.317-04:00

2019-03-29T15:01:05.480-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-03-20T10:07:04.620-04:00

SECTRACK 1041280 REDHAT RHSA-2018:2486 CONFIRM https://curl.haxx.se/docs/adv_2018-70a2.html CONFIRM https://github.com/curl/curl/commit/ba1dbd78e5f1ed67c1b8d37ac89d90e5e330b628 GENTOO GLSA-201807-04 UBUNTU USN-3710-1 Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable by an attacker who can control the data that curl transmits over SMTP with certain settings (i.e., use of a nonstandard --limit-rate argument or CURLOPT_BUFFERSIZE value).

cpe:/a:debian:advanced_package_tool:1.6.1 cpe:/a:debian:advanced_package_tool:1.6.2 cpe:/a:debian:advanced_package_tool:1.6.3 cpe:/a:debian:advanced_package_tool:1.7.0:alpha cpe:/a:debian:advanced_package_tool:1.7.0:alpha1 cpe:/a:debian:advanced_package_tool:1.7.0:alpha2 cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~

CVE-2018-0501

2018-08-20T20:29:00.227-04:00

2019-01-17T13:49:46.183-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-11-28T12:17:47.397-05:00

MISC https://mirror.fail MISC https://salsa.debian.org/apt-team/apt/commit/29658a3a74af49e2a24e17bdebb20e1612aac3ec MISC https://salsa.debian.org/apt-team/apt/commit/aebd4278bacc728ab00ebe31556983e140f60e47 UBUNTU USN-3746-1 The mirror:// method implementation in Advanced Package Tool (APT) 1.6.x before 1.6.4 and 1.7.x before 1.7.0~alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail.

cpe:/a:zsh:zsh:3.1.5:- cpe:/a:zsh:zsh:3.1.5:pws-1 cpe:/a:zsh:zsh:3.1.5:pws-10 cpe:/a:zsh:zsh:3.1.5:pws-11 cpe:/a:zsh:zsh:3.1.5:pws-12 cpe:/a:zsh:zsh:3.1.5:pws-13 cpe:/a:zsh:zsh:3.1.5:pws-14 cpe:/a:zsh:zsh:3.1.5:pws-16-w6109 cpe:/a:zsh:zsh:3.1.5:pws-16-w6117 cpe:/a:zsh:zsh:3.1.5:pws-16-w6119 cpe:/a:zsh:zsh:3.1.5:pws-16-w6133 cpe:/a:zsh:zsh:3.1.5:pws-2 cpe:/a:zsh:zsh:3.1.5:pws-21 cpe:/a:zsh:zsh:3.1.5:pws-22 cpe:/a:zsh:zsh:3.1.5:pws-23 cpe:/a:zsh:zsh:3.1.5:pws-24 cpe:/a:zsh:zsh:3.1.5:pws-3 cpe:/a:zsh:zsh:3.1.5:pws-4 cpe:/a:zsh:zsh:3.1.5:pws-5 cpe:/a:zsh:zsh:3.1.5:pws-6 cpe:/a:zsh:zsh:3.1.5:pws-7 cpe:/a:zsh:zsh:3.1.5:pws-8 cpe:/a:zsh:zsh:3.1.5:pws-9 cpe:/a:zsh:zsh:3.1.6:- cpe:/a:zsh:zsh:3.1.6:bart-7 cpe:/a:zsh:zsh:3.1.6:bart-7-2 cpe:/a:zsh:zsh:3.1.6:bart-8 cpe:/a:zsh:zsh:3.1.6:dev-14 cpe:/a:zsh:zsh:3.1.6:dev-15 cpe:/a:zsh:zsh:3.1.6:dev-16 cpe:/a:zsh:zsh:3.1.6:dev-17 cpe:/a:zsh:zsh:3.1.6:dev-18 cpe:/a:zsh:zsh:3.1.6:dev-19 cpe:/a:zsh:zsh:3.1.6:dev-20 cpe:/a:zsh:zsh:3.1.6:dev-21 cpe:/a:zsh:zsh:3.1.6:dev-22 cpe:/a:zsh:zsh:3.1.6:pws-1 cpe:/a:zsh:zsh:3.1.6:pws-10 cpe:/a:zsh:zsh:3.1.6:pws-11 cpe:/a:zsh:zsh:3.1.6:pws-12 cpe:/a:zsh:zsh:3.1.6:pws-13 cpe:/a:zsh:zsh:3.1.6:pws-2 cpe:/a:zsh:zsh:3.1.6:pws-3 cpe:/a:zsh:zsh:3.1.6:pws-4 cpe:/a:zsh:zsh:3.1.6:pws-5 cpe:/a:zsh:zsh:3.1.6:pws-9 cpe:/a:zsh:zsh:3.1.6:test-1 cpe:/a:zsh:zsh:3.1.6:test-2 cpe:/a:zsh:zsh:3.1.7:- cpe:/a:zsh:zsh:3.1.7:pre-2 cpe:/a:zsh:zsh:3.1.7:pre-3 cpe:/a:zsh:zsh:3.1.7:pre-4 cpe:/a:zsh:zsh:3.1.7:prep-1 cpe:/a:zsh:zsh:3.1.8 cpe:/a:zsh:zsh:3.1.9:- cpe:/a:zsh:zsh:3.1.9:dev-1 cpe:/a:zsh:zsh:3.1.9:dev-2 cpe:/a:zsh:zsh:3.1.9:dev-3 cpe:/a:zsh:zsh:3.1.9:dev-4 cpe:/a:zsh:zsh:3.1.9:dev-5 cpe:/a:zsh:zsh:3.1.9:dev-6 cpe:/a:zsh:zsh:3.1.9:dev-7 cpe:/a:zsh:zsh:3.1.9:dev-8 cpe:/a:zsh:zsh:4.0.1:- cpe:/a:zsh:zsh:4.0.1:pre-1 cpe:/a:zsh:zsh:4.0.1:pre-3 cpe:/a:zsh:zsh:4.0.1:pre-4 cpe:/a:zsh:zsh:4.0.1:pre-5 cpe:/a:zsh:zsh:4.0.2:- cpe:/a:zsh:zsh:4.0.2:pre-2 cpe:/a:zsh:zsh:4.0.3 cpe:/a:zsh:zsh:4.0.4 cpe:/a:zsh:zsh:4.0.5 cpe:/a:zsh:zsh:4.0.6 cpe:/a:zsh:zsh:4.0.7 cpe:/a:zsh:zsh:4.0.8 cpe:/a:zsh:zsh:4.0.9 cpe:/a:zsh:zsh:4.1.0:dev-1 cpe:/a:zsh:zsh:4.1.0:dev-2 cpe:/a:zsh:zsh:4.1.0:dev-3 cpe:/a:zsh:zsh:4.1.0:dev-4 cpe:/a:zsh:zsh:4.1.0:dev-5 cpe:/a:zsh:zsh:4.1.0:dev-7 cpe:/a:zsh:zsh:4.1.1:- cpe:/a:zsh:zsh:4.1.1:test-1 cpe:/a:zsh:zsh:4.1.1:test-3 cpe:/a:zsh:zsh:4.2.0:- cpe:/a:zsh:zsh:4.2.0:pre-1 cpe:/a:zsh:zsh:4.2.0:pre-2 cpe:/a:zsh:zsh:4.2.0:pre-3 cpe:/a:zsh:zsh:4.2.0:pre-4 cpe:/a:zsh:zsh:4.2.1:- cpe:/a:zsh:zsh:4.2.1:test-a cpe:/a:zsh:zsh:4.2.2 cpe:/a:zsh:zsh:4.2.3 cpe:/a:zsh:zsh:4.2.4 cpe:/a:zsh:zsh:4.2.5 cpe:/a:zsh:zsh:4.2.6:- cpe:/a:zsh:zsh:4.2.6:dev-2 cpe:/a:zsh:zsh:4.3.0:dev-3 cpe:/a:zsh:zsh:4.3.0:dev-4 cpe:/a:zsh:zsh:4.3.0:dev-5 cpe:/a:zsh:zsh:4.3.1 cpe:/a:zsh:zsh:4.3.2 cpe:/a:zsh:zsh:4.3.3 cpe:/a:zsh:zsh:4.3.4:- cpe:/a:zsh:zsh:4.3.4:dev-2 cpe:/a:zsh:zsh:4.3.4:dev-4 cpe:/a:zsh:zsh:4.3.4:dev-5 cpe:/a:zsh:zsh:4.3.4:dev-6 cpe:/a:zsh:zsh:4.3.4:dev-7 cpe:/a:zsh:zsh:4.3.4:dev-8 cpe:/a:zsh:zsh:4.3.5:- cpe:/a:zsh:zsh:4.3.5:dev-1 cpe:/a:zsh:zsh:4.3.5:dev-2 cpe:/a:zsh:zsh:4.3.5:dev-3 cpe:/a:zsh:zsh:4.3.5:dev-4 cpe:/a:zsh:zsh:4.3.6:- cpe:/a:zsh:zsh:4.3.6:dev-1 cpe:/a:zsh:zsh:4.3.6:dev-2 cpe:/a:zsh:zsh:4.3.7 cpe:/a:zsh:zsh:4.3.8 cpe:/a:zsh:zsh:4.3.9:- cpe:/a:zsh:zsh:4.3.9:dev-3 cpe:/a:zsh:zsh:4.3.9:dev-5 cpe:/a:zsh:zsh:4.3.10:- cpe:/a:zsh:zsh:4.3.10:dev-2 cpe:/a:zsh:zsh:4.3.10:test-3 cpe:/a:zsh:zsh:4.3.11:- cpe:/a:zsh:zsh:4.3.11:dev-4 cpe:/a:zsh:zsh:4.3.12:- cpe:/a:zsh:zsh:4.3.12:test-3 cpe:/a:zsh:zsh:4.3.13 cpe:/a:zsh:zsh:4.3.14 cpe:/a:zsh:zsh:4.3.15 cpe:/a:zsh:zsh:4.3.16 cpe:/a:zsh:zsh:4.3.17:- cpe:/a:zsh:zsh:4.3.17:test-2 cpe:/a:zsh:zsh:5.0.0:- cpe:/a:zsh:zsh:5.0.0:test-1 cpe:/a:zsh:zsh:5.0.1 cpe:/a:zsh:zsh:5.0.2:- cpe:/a:zsh:zsh:5.0.2:test-1 cpe:/a:zsh:zsh:5.0.2:test-2 cpe:/a:zsh:zsh:5.0.2:test-3 cpe:/a:zsh:zsh:5.0.3:- cpe:/a:zsh:zsh:5.0.3:test-1 cpe:/a:zsh:zsh:5.0.3:test-2 cpe:/a:zsh:zsh:5.0.4 cpe:/a:zsh:zsh:5.0.5:- cpe:/a:zsh:zsh:5.0.5:dev-1 cpe:/a:zsh:zsh:5.0.5:dev-2 cpe:/a:zsh:zsh:5.0.5:dev-3 cpe:/a:zsh:zsh:5.0.6:- cpe:/a:zsh:zsh:5.0.6:dev-1 cpe:/a:zsh:zsh:5.0.7:- cpe:/a:zsh:zsh:5.0.7:dev-2 cpe:/a:zsh:zsh:5.0.7:dev-4 cpe:/a:zsh:zsh:5.0.8:- cpe:/a:zsh:zsh:5.0.8:test-2 cpe:/a:zsh:zsh:5.0.8:test-3 cpe:/a:zsh:zsh:5.1:- cpe:/a:zsh:zsh:5.1:test-1 cpe:/a:zsh:zsh:5.1.1:- cpe:/a:zsh:zsh:5.1.1:test-1 cpe:/a:zsh:zsh:5.1.1:test-2 cpe:/a:zsh:zsh:5.1.1:test-3 cpe:/a:zsh:zsh:5.2:- cpe:/a:zsh:zsh:5.2:test-1 cpe:/a:zsh:zsh:5.2:test-2 cpe:/a:zsh:zsh:5.2:test-3 cpe:/a:zsh:zsh:5.3 cpe:/a:zsh:zsh:5.3.1:- cpe:/a:zsh:zsh:5.3.1:test-2 cpe:/a:zsh:zsh:5.4 cpe:/a:zsh:zsh:5.4.1 cpe:/a:zsh:zsh:5.4.2:- cpe:/a:zsh:zsh:5.4.2:test-1 cpe:/a:zsh:zsh:5.4.2:test-2 cpe:/a:zsh:zsh:5.5 cpe:/a:zsh:zsh:5.5.1:- cpe:/a:zsh:zsh:5.5.1:test-1 cpe:/a:zsh:zsh:5.5.1:test-2 cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~

CVE-2018-0502

2018-09-05T04:29:00.230-04:00

2019-03-12T16:34:11.653-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-03-11T11:07:25.970-04:00

MISC https://bugs.debian.org/908000 GENTOO GLSA-201903-02 MISC https://sourceforge.net/p/zsh/code/ci/1c4c7b6a4d17294df028322b70c53803a402233d UBUNTU USN-3764-1 MISC https://www.zsh.org/mla/zsh-announce/136 An issue was discovered in zsh before 5.6. The beginning of a #! script file was mishandled, potentially leading to an execve call to a program named on the second line.

cpe:/a:mediawiki:mediawiki:1.27.5 cpe:/a:mediawiki:mediawiki:1.29.3 cpe:/a:mediawiki:mediawiki:1.30.1 cpe:/a:mediawiki:mediawiki:1.31.0 cpe:/a:mediawiki:mediawiki:1.31.0:rc0 cpe:/a:mediawiki:mediawiki:1.31.0:rc1 cpe:/a:mediawiki:mediawiki:1.31.0:rc2 cpe:/o:debian:debian_linux:9.0

CVE-2018-0503

2018-10-04T16:29:00.327-04:00

2019-10-02T20:03:26.223-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-11-19T11:47:49.027-05:00

SECTRACK 1041695 MLIST [wikitech-l] 20180920 Security release: 1.27.5 / 1.29.3 / 1.30.1 / 1.31.1 CONFIRM https://phabricator.wikimedia.org/T169545 DEBIAN DSA-4301 Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where contrary to the documentation, $wgRateLimits entry for 'user' overrides that for 'newbie'.

CVE-2018-0504

2018-10-04T16:29:00.513-04:00

2018-11-23T13:33:02.103-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2018-11-19T11:54:55.847-05:00

SECTRACK 1041695 MLIST [wikitech-l] 20180920 Security release: 1.27.5 / 1.29.3 / 1.30.1 / 1.31.1 CONFIRM https://phabricator.wikimedia.org/T187638 DEBIAN DSA-4301 Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains an information disclosure flaw in the Special:Redirect/logid

CVE-2018-0505

2018-10-04T16:29:00.687-04:00

2019-10-02T20:03:26.223-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-11-19T11:58:21.910-05:00

SECTRACK 1041695 MLIST [wikitech-l] 20180920 Security release: 1.27.5 / 1.29.3 / 1.30.1 / 1.31.1 CONFIRM https://phabricator.wikimedia.org/T194605 DEBIAN DSA-4301 Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where BotPasswords can bypass CentralAuth's account lock

cpe:/a:nootka_project:nootka:1.4.4::~~~android~~

CVE-2018-0506

2018-01-26T11:29:00.273-05:00

2018-02-13T13:31:45.320-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-02-12T13:46:06.597-05:00

JVN JVN#10103841 Nootka 1.4.4 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.

cpe:/a:ntt-east:flet%27s_virus_clear_easy_setup_%26_application_tool:11 cpe:/a:ntt-east:flet%27s_virus_clear_v6_easy_setup_%26_application_tool:11

CVE-2018-0507

2018-01-26T11:29:00.333-05:00

2018-02-13T12:54:23.583-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2018-02-12T14:42:11.460-05:00

JVN JVN#26255241 Untrusted search path vulnerability in FLET'S VIRUS CLEAR Easy Setup & Application Tool ver.11 and earlier versions, FLET'S VIRUS CLEAR v6 Easy Setup & Application Tool ver.11 and earlier versions allow an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

cpe:/a:kkcald_project:kkcald:0.7.21

CVE-2018-0508

2018-02-01T09:29:00.217-05:00

2018-02-14T10:25:10.187-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-02-14T09:52:44.200-05:00

CONFIRM http://dbit.web.fc2.com/ JVN JVN#91393903 Cross-site scripting vulnerability in epg search result viewer (kkcald) 0.7.21 and earlier allows an attacker to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:kkcald_project:kkcald:0.7.21

CVE-2018-0509

2018-02-01T09:29:00.340-05:00

2018-02-14T10:24:50.857-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2018-02-14T10:03:18.677-05:00

CONFIRM http://dbit.web.fc2.com/ JVN JVN#91393903 Cross-site request forgery (CSRF) vulnerability in epg search result viewer (kkcald) 0.7.21 and earlier allows an attacker to hijack the authentication of administrators via unspecified vectors.

cpe:/a:kkcald_project:kkcald:0.7.19

CVE-2018-0510

2018-02-01T09:29:00.433-05:00

2018-02-14T10:25:03.763-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2018-02-14T10:01:52.857-05:00

CONFIRM http://dbit.web.fc2.com/ JVN JVN#91393903 Buffer overflow in epg search result viewer (kkcald) 0.7.19 and earlier allows remote attackers to perform unintended operations or execute DoS (denial of service) attacks via unspecified vectors.

cpe:/a:meowapps:wp_retina_2x:0.1::~~~wordpress~~ cpe:/a:meowapps:wp_retina_2x:0.2.2::~~~wordpress~~ cpe:/a:meowapps:wp_retina_2x:0.3.0::~~~wordpress~~ cpe:/a:meowapps:wp_retina_2x:0.9.4::~~~wordpress~~ cpe:/a:meowapps:wp_retina_2x:1.0.0::~~~wordpress~~ cpe:/a:meowapps:wp_retina_2x:1.6.0::~~~wordpress~~ cpe:/a:meowapps:wp_retina_2x:2.6.0::~~~wordpress~~ cpe:/a:meowapps:wp_retina_2x:3.0.0::~~~wordpress~~ cpe:/a:meowapps:wp_retina_2x:3.1.0::~~~wordpress~~ cpe:/a:meowapps:wp_retina_2x:3.3.6::~~~wordpress~~ cpe:/a:meowapps:wp_retina_2x:3.4.2::~~~wordpress~~ cpe:/a:meowapps:wp_retina_2x:3.5.2::~~~wordpress~~ cpe:/a:meowapps:wp_retina_2x:4.4.0::~~~wordpress~~ cpe:/a:meowapps:wp_retina_2x:4.4.6::~~~wordpress~~ cpe:/a:meowapps:wp_retina_2x:4.5.8::~~~wordpress~~ cpe:/a:meowapps:wp_retina_2x:4.6.0::~~~wordpress~~ cpe:/a:meowapps:wp_retina_2x:4.7.4::~~~wordpress~~ cpe:/a:meowapps:wp_retina_2x:4.7.5::~~~wordpress~~ cpe:/a:meowapps:wp_retina_2x:4.7.6::~~~wordpress~~ cpe:/a:meowapps:wp_retina_2x:4.7.7::~~~wordpress~~ cpe:/a:meowapps:wp_retina_2x:4.8.0::~~~wordpress~~ cpe:/a:meowapps:wp_retina_2x:5.0.5::~~~wordpress~~ cpe:/a:meowapps:wp_retina_2x:5.1.4::~~~wordpress~~ cpe:/a:meowapps:wp_retina_2x:5.2.0::~~~wordpress~~

CVE-2018-0511

2018-02-01T09:29:00.480-05:00

2019-07-24T14:25:51.360-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-23T12:17:37.753-04:00

JVN JVN#30636823 CONFIRM https://plugins.trac.wordpress.org/changeset/1802137/#file1 Cross-site scripting vulnerability in WP Retina 2x prior to version 5.2.2 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.

cpe:/o:iodata:bx-vp1_firmware:2.01 cpe:/o:iodata:gv-ntx1_firmware:1.02.00 cpe:/o:iodata:gv-ntx2_firmware:1.02.00 cpe:/o:iodata:hdl-a_firmware:1.26 cpe:/o:iodata:hdl-ah_firmware:1.26 cpe:/o:iodata:hdl-gt_firmware:1.37 cpe:/o:iodata:hdl-gtr_firmware:1.37 cpe:/o:iodata:hdl-t_firmware:1.12 cpe:/o:iodata:hdl-xr2u_firmware:2.01 cpe:/o:iodata:hdl-xr2uw_firmware:2.01 cpe:/o:iodata:hdl-xr_firmware:2.01 cpe:/o:iodata:hdl-xrw_firmware:2.01 cpe:/o:iodata:hdl-xv_firmware:1.50 cpe:/o:iodata:hdl-xvw_firmware:1.50 cpe:/o:iodata:hdl2-a_firmware:1.26 cpe:/o:iodata:hdl2-ah_firmware:1.26 cpe:/o:iodata:hfas1_firmware:1.40 cpe:/o:iodata:hls-c_firmware:1.12 cpe:/o:iodata:hvl-a_firmware:2.04 cpe:/o:iodata:hvl-at_firmware:2.04 cpe:/o:iodata:hvl-ata_firmware:2.04 cpe:/o:iodata:hvl-s_firmware:1.00 cpe:/o:iodata:whg-ac1750_firmware:1.07 cpe:/o:iodata:whg-ac1750a_firmware:3.00 cpe:/o:iodata:whg-ac1750al_firmware:1.07 cpe:/o:iodata:whg-napg_firmware:1.08 cpe:/o:iodata:whg-napga_firmware:1.08 cpe:/o:iodata:whg-napgal_firmware:1.05 cpe:/o:iodata:wn-ac1167dgr_firmware:1.02 cpe:/o:iodata:wn-ac1300ex_firmware:1.02 cpe:/o:iodata:wn-ac1600dgr_firmware:2.06 cpe:/o:iodata:wn-ac583rk_firmware:1.06 cpe:/o:iodata:wn-ac583trk_firmware:1.05 cpe:/o:iodata:wn-ag300dgr_firmware:1.05 cpe:/o:iodata:wn-ag750dgr_firmware:1.08 cpe:/o:iodata:wn-ax1167gr_firmware:3.11 cpe:/o:iodata:wn-g300ex_firmware:1.01 cpe:/o:iodata:wn-g300r3_firmware:1.04 cpe:/o:iodata:wn-g300r_firmware:1.14 cpe:/o:iodata:wn-g300sr_firmware:1.00 cpe:/o:iodata:wn-gx300gr_firmware:2.00 cpe:/o:iodata:wnpr1167f_firmware:1.00 cpe:/o:iodata:wnpr1167g_firmware:1.00 cpe:/o:iodata:wnpr1750g_firmware:1.01 cpe:/o:iodata:wnpr2600g_firmware:1.01

CVE-2018-0512

2018-02-08T09:29:00.213-05:00

2018-03-06T08:41:37.133-05:00

7.7

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2018-03-05T14:20:05.663-05:00

CONFIRM http://www.iodata.jp/support/information/2018/magicalfinder/ JVN JVN#36048131 Devices with IP address setting tool "MagicalFinder" provided by I-O DATA DEVICE, INC. allow authenticated attackers to execute arbitrary OS commands via unspecified vectors.

cpe:/a:mtssb.mt-systems:simple_booking:1.2.1::~~c~wordpress~~ cpe:/a:mtssb.mt-systems:simple_booking:1.28.0::~~business~wordpress~~

CVE-2018-0513

2018-02-08T09:29:00.277-05:00

2018-03-10T10:20:18.243-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-02-23T19:45:19.193-05:00

CONFIRM http://mtssb.mt-systems.jp/jvn99312352/ JVN JVN#99312352 Cross-site scripting vulnerability in MTS Simple Booking C, MTS Simple Booking Business version 1.28.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:futomi:mp_form_mail_cgi:2.0.13::~~ecommerce~~~

CVE-2018-0514

2018-02-08T09:29:00.323-05:00

2018-03-10T10:16:27.470-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-02-23T19:15:11.780-05:00

CONFIRM http://www.futomi.com/library/mpmailec.html#history JVN JVN#15462187 MP Form Mail CGI eCommerce Edition Ver 2.0.13 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.

cpe:/a:flets:azukeru_backup_tool:1.5.2.6

CVE-2018-0515

2018-02-16T12:29:00.277-05:00

2018-03-14T13:51:46.167-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2018-03-08T13:00:00.713-05:00

MISC https://flets.com/azukeru/login/news/info_180213.html JVN JVN#04564808 Untrusted search path vulnerability in "FLET'S Azukeru Backup Tool" version 1.5.2.6 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

cpe:/a:flets:address_selection_tool:4.0 cpe:/a:flets:address_selection_tool:6.0

CVE-2018-0516

2018-02-16T12:29:00.340-05:00

2018-03-14T13:51:29.507-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2018-03-08T13:11:04.373-05:00

MISC http://flets-w.com/topics/2018/20180207a.html JVN JVN#87403477 Untrusted search path vulnerability in FLET'S v4 / v6 address selection tool allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

cpe:/a:kddi:anshin_net_security:6.0.1.44::~~windows~~~

CVE-2018-0517

2018-02-08T09:29:00.370-05:00

2018-03-10T10:12:46.577-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2018-02-27T12:55:44.970-05:00

JVN JVN#70615027 Untrusted search path vulnerability in Anshin net security for Windows Version 16.0.1.44 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

CVE-2018-0518

2018-02-23T10:29:00.213-05:00

2018-03-20T15:16:05.380-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-03-13T16:56:52.257-04:00

JVN JVN#75453852 MISC https://linecorp.com/en/security/article/136 LINE for iOS version 7.1.3 to 7.1.5 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

cpe:/o:fsi:fs010w_firmware:1.3.0

CVE-2018-0519

2018-02-23T10:29:00.290-05:00

2018-03-19T11:24:39.113-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-03-12T21:27:10.307-04:00

JVN JVN#83834277 Cross-site scripting vulnerability in FS010W firmware FS010W_00_V1.3.0 and earlier allows an attacker to inject arbitrary web script or HTML via unspecified vectors.

cpe:/o:fsi:fs010w_firmware:1.3.0

CVE-2018-0520

2018-02-23T10:29:00.337-05:00

2018-03-16T13:51:45.573-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2018-03-12T14:58:11.263-04:00

JVN JVN#83834277 Cross-site request forgery (CSRF) vulnerability in FS010W firmware FS010W_00_V1.3.0 and earlier allows an attacker to hijack the authentication of administrators via unspecified vectors.

cpe:/o:buffalo:wxr-1900dhp2_firmware:2.48

CVE-2018-0521

2018-03-09T11:29:00.410-05:00

2018-03-26T12:06:41.883-04:00

8.3

ADJACENT_NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-03-23T19:05:00.510-04:00

CONFIRM http://buffalo.jp/support_s/s20180223.html JVN JVN#97144273 Buffalo WXR-1900DHP2 firmware Ver.2.48 and earlier allows an attacker to bypass authentication and execute arbitrary commands on the device via unspecified vectors.

cpe:/o:buffalo:wxr-1900dhp2_firmware:2.48

CVE-2018-0522

2018-03-09T11:29:00.470-05:00

2018-03-26T12:09:50.933-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2018-03-23T19:01:26.643-04:00

CONFIRM http://buffalo.jp/support_s/s20180223.html JVN JVN#97144273 Buffer overflow in Buffalo WXR-1900DHP2 firmware Ver.2.48 and earlier allows an attacker to execute arbitrary code via a specially crafted file.

cpe:/o:buffalo:wxr-1900dhp2_firmware:2.48

CVE-2018-0523

2018-03-09T11:29:00.533-05:00

2018-03-26T12:10:02.683-04:00

8.3

ADJACENT_NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-03-23T18:50:16.057-04:00

CONFIRM http://buffalo.jp/support_s/s20180223.html JVN JVN#97144273 Buffalo WXR-1900DHP2 firmware Ver.2.48 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors.

cpe:/a:jubat:jubatus:1.0.2

CVE-2018-0524

2018-03-09T11:29:00.597-05:00

2018-03-27T12:43:08.407-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2018-03-22T21:30:21.620-04:00

MISC https://github.com/jubatus/jubatus/blob/master/ChangeLog.rst JVN JVN#56132776 Jubatus 1.0.2 and earlier allows remote code execution via unspecified vectors.

cpe:/a:jubat:jubatus:1.0.2

CVE-2018-0525

2018-03-09T11:29:00.660-05:00

2018-03-27T12:42:32.937-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-03-23T10:40:09.707-04:00

MISC https://github.com/jubatus/jubatus/blob/master/ChangeLog.rst JVN JVN#56132776 Directory traversal vulnerability in Jubatus 1.0.2 and earlier allows remote attackers to read arbitrary files via unspecified vectors.

cpe:/a:cybozu:office:10.0.0 cpe:/a:cybozu:office:10.0.1 cpe:/a:cybozu:office:10.0.2 cpe:/a:cybozu:office:10.1.0 cpe:/a:cybozu:office:10.1.2 cpe:/a:cybozu:office:10.2.0 cpe:/a:cybozu:office:10.3.0 cpe:/a:cybozu:office:10.4.0 cpe:/a:cybozu:office:10.5.0 cpe:/a:cybozu:office:10.6.0 cpe:/a:cybozu:office:10.6.1 cpe:/a:cybozu:office:10.7.0

CVE-2018-0526

2018-06-26T10:29:00.223-04:00

2018-08-08T14:03:20.203-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-08-08T11:53:58.620-04:00

JVN JVN#51737843 CONFIRM https://support.cybozu.com/ja-jp/article/10030 Cybozu Office 10.0.0 to 10.7.0 allow remote attackers to display an image located in an external server via unspecified vectors.

CVE-2018-0527

2018-06-26T10:29:00.270-04:00

2018-08-09T09:38:50.083-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-08-08T10:35:41.723-04:00

JVN JVN#51737843 CONFIRM https://support.cybozu.com/ja-jp/article/10029 Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2018-0528

2018-06-26T10:29:00.317-04:00

2018-08-09T09:25:30.423-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2018-08-08T10:52:20.150-04:00

JVN JVN#51737843 CONFIRM https://support.cybozu.com/ja-jp/article/9812 Cybozu Office 10.0.0 to 10.7.0 allows authenticated attackers to bypass authentication to view the schedules that are not permitted to access via unspecified vectors.

CVE-2018-0529

2018-06-26T10:29:00.380-04:00

2018-08-08T14:06:39.417-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2018-08-08T11:58:51.347-04:00

JVN JVN#51737843 CONFIRM https://support.cybozu.com/ja-jp/article/10052 Cybozu Office 10.0.0 to 10.7.0 allows remote attackers to cause a denial of service via unspecified vectors.

cpe:/a:cybozu:garoon:3.5.0 cpe:/a:cybozu:garoon:3.5.1 cpe:/a:cybozu:garoon:3.5.2 cpe:/a:cybozu:garoon:3.5.3 cpe:/a:cybozu:garoon:3.5.4 cpe:/a:cybozu:garoon:3.5.5 cpe:/a:cybozu:garoon:3.7:sp1 cpe:/a:cybozu:garoon:3.7:sp2 cpe:/a:cybozu:garoon:3.7:sp3 cpe:/a:cybozu:garoon:3.7.0 cpe:/a:cybozu:garoon:3.7.1 cpe:/a:cybozu:garoon:3.7.2 cpe:/a:cybozu:garoon:3.7.3 cpe:/a:cybozu:garoon:3.7.4 cpe:/a:cybozu:garoon:3.7.5 cpe:/a:cybozu:garoon:4.0.0 cpe:/a:cybozu:garoon:4.0.1 cpe:/a:cybozu:garoon:4.0.2 cpe:/a:cybozu:garoon:4.0.3 cpe:/a:cybozu:garoon:4.2.0 cpe:/a:cybozu:garoon:4.2.1 cpe:/a:cybozu:garoon:4.2.2 cpe:/a:cybozu:garoon:4.2.3 cpe:/a:cybozu:garoon:4.2.4 cpe:/a:cybozu:garoon:4.2.5 cpe:/a:cybozu:garoon:4.2.6

CVE-2018-0530

2018-04-16T10:29:00.217-04:00

2018-05-17T09:24:29.220-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2018-05-16T21:38:51.620-04:00

JVN JVN#65268217 CONFIRM https://support.cybozu.com/ja-jp/article/9326 SQL injection vulnerability in the Cybozu Garoon 3.5.0 to 4.2.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.

cpe:/a:cybozu:garoon:3.0.0 cpe:/a:cybozu:garoon:3.0.1 cpe:/a:cybozu:garoon:3.0.2 cpe:/a:cybozu:garoon:3.0.3 cpe:/a:cybozu:garoon:3.1.0 cpe:/a:cybozu:garoon:3.1.1 cpe:/a:cybozu:garoon:3.1.2 cpe:/a:cybozu:garoon:3.1.3 cpe:/a:cybozu:garoon:3.5.0 cpe:/a:cybozu:garoon:3.5.1 cpe:/a:cybozu:garoon:3.5.2 cpe:/a:cybozu:garoon:3.5.3 cpe:/a:cybozu:garoon:3.5.4 cpe:/a:cybozu:garoon:3.5.5 cpe:/a:cybozu:garoon:3.7:sp1 cpe:/a:cybozu:garoon:3.7:sp2 cpe:/a:cybozu:garoon:3.7:sp3 cpe:/a:cybozu:garoon:3.7.0 cpe:/a:cybozu:garoon:3.7.1 cpe:/a:cybozu:garoon:3.7.2 cpe:/a:cybozu:garoon:3.7.3 cpe:/a:cybozu:garoon:3.7.4 cpe:/a:cybozu:garoon:3.7.5 cpe:/a:cybozu:garoon:4.0.0 cpe:/a:cybozu:garoon:4.0.1 cpe:/a:cybozu:garoon:4.0.2 cpe:/a:cybozu:garoon:4.0.3 cpe:/a:cybozu:garoon:4.2.0 cpe:/a:cybozu:garoon:4.2.1 cpe:/a:cybozu:garoon:4.2.2 cpe:/a:cybozu:garoon:4.2.3 cpe:/a:cybozu:garoon:4.2.4 cpe:/a:cybozu:garoon:4.2.5 cpe:/a:cybozu:garoon:4.2.6

CVE-2018-0531

2018-04-16T10:29:00.297-04:00

2019-10-02T20:03:26.223-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-05-16T21:37:09.757-04:00

JVN JVN#65268217 CONFIRM https://support.cybozu.com/ja-jp/article/9349 Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to view or alter an access privilege of a folder and/or notification settings via unspecified vectors.

CVE-2018-0532

2018-04-16T10:29:00.360-04:00

2018-05-17T09:09:33.610-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-05-16T21:40:34.797-04:00

JVN JVN#65268217 CONFIRM https://support.cybozu.com/ja-jp/article/9378 Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to alter setting data of the Standard database via unspecified vectors.

CVE-2018-0533

2018-04-16T10:29:00.437-04:00

2019-10-02T20:03:26.223-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-05-16T21:33:13.123-04:00

JVN JVN#65268217 CONFIRM https://support.cybozu.com/ja-jp/article/9375 Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to alter setting data of session authentication via unspecified vectors.

cpe:/a:arsenol_project:arsenol:0.5

CVE-2018-0534

2018-03-22T09:29:00.280-04:00

2018-04-17T10:38:28.973-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-04-12T14:58:48.763-04:00

JVN JVN#30864198 Cross-site scripting vulnerability in ArsenoL Version 0.5 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:php_2chbbs_project:php_2chbbs:bbs18c

CVE-2018-0535

2018-03-22T09:29:00.343-04:00

2018-04-13T14:42:40.720-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-04-13T13:40:33.177-04:00

JVN JVN#48774168 Cross-site scripting vulnerability in PHP 2chBBS version bbs18c allows an attacker to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:qqq_systems_project:qqq_systems:2.24

CVE-2018-0536

2018-03-22T09:29:00.390-04:00

2018-04-12T12:18:05.073-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-04-12T10:41:58.647-04:00

JVN JVN#64990648 Cross-site scripting vulnerability in QQQ SYSTEMS ver2.24 allows an attacker to inject arbitrary web script or HTML via quiz.cgi.

cpe:/a:qqq_systems_project:qqq_systems:2.24

CVE-2018-0537

2018-03-22T09:29:00.437-04:00

2018-04-12T12:17:36.340-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-04-12T10:41:34.177-04:00

JVN JVN#96655441 Cross-site scripting vulnerability in QQQ SYSTEMS ver2.24 allows an attacker to inject arbitrary web script or HTML via quiz_op.cgi.

cpe:/a:qqq_systems_project:qqq_systems:2.24

CVE-2018-0538

2018-03-22T09:29:00.497-04:00

2018-04-17T10:38:48.960-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-04-12T10:31:46.540-04:00

JVN JVN#46471407 Cross-site scripting vulnerability in QQQ SYSTEMS ver2.24 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:qqq_systems_project:qqq_systems:2.24

CVE-2018-0539

2018-03-22T09:29:00.547-04:00

2018-04-13T09:14:27.750-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-04-12T10:45:52.190-04:00

JVN JVN#22536871 QQQ SYSTEMS version 2.24 allows an attacker to execute arbitrary commands via unspecified vectors.

cpe:/a:vix_project:vix:2.21.148.0

CVE-2018-0540

2018-03-22T09:29:00.593-04:00

2018-04-20T12:55:57.923-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2018-04-16T14:56:43.453-04:00

JVN JVN#56764650 Untrusted search path vulnerability in ViX version 2.21.148.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

cpe:/a:tinyftp_project:tinyftp:0.52:d

CVE-2018-0541

2018-03-22T09:29:00.653-04:00

2018-04-17T10:39:13.943-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-04-12T15:04:16.113-04:00

JVN JVN#92259864 Buffer overflow in Tiny FTP Daemon Ver0.52d allows an attacker to cause a denial-of-service (DoS) condition or execute arbitrary code via unspecified vectors.

cpe:/a:webproxy_project:webproxy:1.7.8

CVE-2018-0542

2018-03-22T09:29:00.700-04:00

2018-04-13T14:40:53.000-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-04-13T13:31:01.747-04:00

JVN JVN#87226910 Directory traversal vulnerability in WebProxy version 1.7.8 allows an attacker to read arbitrary files via unspecified vectors.

cpe:/a:woodybells:jtrim:1.53c

CVE-2018-0543

2018-03-09T11:29:00.720-05:00

2018-03-26T12:12:29.797-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2018-03-23T18:27:31.647-04:00

CONFIRM http://woodybells.com/jtrim.html JVN JVN#71816327 Untrusted search path vulnerability in Jtrim 1.53c and earlier (Installer) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

cpe:/a:woodybells:winshot:1.53a

CVE-2018-0544

2018-03-09T11:29:00.767-05:00

2018-03-26T12:25:37.470-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2018-03-23T14:32:41.657-04:00

MISC http://woodybells.com/winshot.html JVN JVN#01837169 Untrusted search path vulnerability in WinShot 1.53a and earlier (Installer) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

cpe:/a:lxr_project:lxr:1.0.0 cpe:/a:lxr_project:lxr:1.1 cpe:/a:lxr_project:lxr:1.2 cpe:/a:lxr_project:lxr:2.0 cpe:/a:lxr_project:lxr:2.0.1 cpe:/a:lxr_project:lxr:2.0.2 cpe:/a:lxr_project:lxr:2.0.3 cpe:/a:lxr_project:lxr:2.1.0 cpe:/a:lxr_project:lxr:2.2.0 cpe:/a:lxr_project:lxr:2.2.1 cpe:/a:lxr_project:lxr:2.3.0

CVE-2018-0545

2018-04-09T09:29:00.507-04:00

2018-05-15T08:52:46.300-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-05-07T11:20:06.370-04:00

JVN JVN#72589538 CONFIRM http://lxr.sourceforge.net/en/bugsandlimits.php LXR version 1.0.0 to 2.3.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors.

cpe:/a:soflyy:wp_all_import:2.12::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:2.13::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:2.14::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.0::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.0.2::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.0.4::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.1.0::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.1.1::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.1.2::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.1.3::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.1.4::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.1.5::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.2.0::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.2.1::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.2.2::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.2.3::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.2.4::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.2.5::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.2.6::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.2.7::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.2.8::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.2.9::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.3.0::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.3.1::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.3.2::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.3.3::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.3.4::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.3.5::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.3.6::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.3.7::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.3.8::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.3.9::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.4.0::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.4.1::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.4.2::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.4.3::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.4.4::~~~wordpress~~ cpe:/a:soflyy:wp_all_import:3.4.5::~~~wordpress~~

CVE-2018-0546

2018-03-09T11:29:00.830-05:00

2018-03-27T20:00:27.070-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-03-27T09:22:02.353-04:00

JVN JVN#33527174 CONFIRM https://plugins.trac.wordpress.org/changeset/1742744/ CONFIRM https://wordpress.org/plugins/wp-all-import/#developers Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.6 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:soflyy:wp_all_import:3.4.6::~~~wordpress~~

CVE-2018-0547

2018-03-09T11:29:00.893-05:00

2018-03-28T17:53:37.603-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-03-27T09:25:26.107-04:00

JVN JVN#60032768 CONFIRM https://plugins.trac.wordpress.org/changeset/1827741/ CONFIRM https://wordpress.org/plugins/wp-all-import/#developers Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.7 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:cybozu:garoon:4.0.0 cpe:/a:cybozu:garoon:4.0.1 cpe:/a:cybozu:garoon:4.0.2 cpe:/a:cybozu:garoon:4.0.3 cpe:/a:cybozu:garoon:4.2.0 cpe:/a:cybozu:garoon:4.2.1 cpe:/a:cybozu:garoon:4.2.2 cpe:/a:cybozu:garoon:4.2.3 cpe:/a:cybozu:garoon:4.2.4 cpe:/a:cybozu:garoon:4.2.5 cpe:/a:cybozu:garoon:4.2.6 cpe:/a:cybozu:garoon:4.6.0

CVE-2018-0548

2018-04-16T10:29:00.500-04:00

2019-10-02T20:03:26.223-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-05-16T21:34:52.707-04:00

JVN JVN#65268217 CONFIRM https://support.cybozu.com/ja-jp/article/9886 Cybozu Garoon 4.0.0 to 4.6.0 allows remote authenticated attackers to bypass access restriction to view the closed title of "Space" via unspecified vectors.

CVE-2018-0549

2018-04-16T10:29:00.563-04:00

2018-05-17T09:33:15.057-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-05-16T21:23:56.680-04:00

JVN JVN#65268217 CONFIRM https://support.cybozu.com/ja-jp/article/10058 Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.6.0 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2018-0550

2018-04-16T10:29:00.640-04:00

2019-10-02T20:03:26.223-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2018-05-16T21:27:40.267-04:00

JVN JVN#65268217 CONFIRM https://support.cybozu.com/ja-jp/article/10056 Cybozu Garoon 3.5.0 to 4.6.1 allows remote authenticated attackers to bypass access restriction to view the closed title of "Cabinet" via unspecified vectors.

CVE-2018-0551

2018-04-16T10:29:00.687-04:00

2018-05-17T09:33:30.477-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-05-16T21:20:24.513-04:00

JVN JVN#65268217 CONFIRM https://support.cybozu.com/ja-jp/article/10211 Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.6.1 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:securebrain:phishwall_client:5.1.26::~~chrome~windows~~ cpe:/a:securebrain:phishwall_client:5.1.26::~~firefox~windows~~

CVE-2018-0552

2018-03-22T09:29:00.747-04:00

2018-04-20T12:56:29.643-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2018-04-16T14:32:50.980-04:00

JVN JVN#39896275 CONFIRM https://www.securebrain.co.jp/about/news/2018/03/180314.html Untrusted search path vulnerability in The installer of PhishWall Client Firefox and Chrome edition for Windows Ver. 5.1.26 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

cpe:/a:glamo:iremocon_wifi:4.1.7::~~~android~~

CVE-2018-0553

2018-04-09T09:29:00.570-04:00

2018-05-14T14:34:50.697-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-05-11T20:00:24.797-04:00

JVN JVN#43382653 MISC https://play.google.com/store/apps/details?id=jp.co.glamo.iremoconwifi The iRemoconWiFi App for Android version 4.1.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

cpe:/o:buffalo:wzr-1750dhp2_firmware:2.30

CVE-2018-0554

2018-04-09T09:29:00.633-04:00

2018-05-16T08:52:36.077-04:00

8.3

ADJACENT_NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-05-11T15:18:04.700-04:00

CONFIRM http://buffalo.jp/support_s/s20180328.html JVN JVN#93397125 Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to bypass authentication and execute arbitrary commands on the device via unspecified vectors.

cpe:/o:buffalo:wzr-1750dhp2_firmware:2.30

CVE-2018-0555

2018-04-09T09:29:00.697-04:00

2018-05-16T08:52:54.623-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2018-05-11T15:13:15.073-04:00

CONFIRM http://buffalo.jp/support_s/s20180328.html JVN JVN#93397125 Buffer overflow in Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to execute arbitrary code via a specially crafted file.

cpe:/o:buffalo:wzr-1750dhp2_firmware:2.30

CVE-2018-0556

2018-04-09T09:29:00.757-04:00

2018-05-16T08:53:05.607-04:00

8.3

ADJACENT_NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-05-11T15:04:27.717-04:00

CONFIRM http://buffalo.jp/support_s/s20180328.html JVN JVN#93397125 Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors.

cpe:/a:cybozu:mailwise:5.0.0 cpe:/a:cybozu:mailwise:5.0.1 cpe:/a:cybozu:mailwise:5.0.4 cpe:/a:cybozu:mailwise:5.0.5 cpe:/a:cybozu:mailwise:5.0.6 cpe:/a:cybozu:mailwise:5.1.0 cpe:/a:cybozu:mailwise:5.1.1 cpe:/a:cybozu:mailwise:5.1.2 cpe:/a:cybozu:mailwise:5.1.3 cpe:/a:cybozu:mailwise:5.1.4 cpe:/a:cybozu:mailwise:5.2.0 cpe:/a:cybozu:mailwise:5.2.1 cpe:/a:cybozu:mailwise:5.3.0 cpe:/a:cybozu:mailwise:5.3.1 cpe:/a:cybozu:mailwise:5.3.2 cpe:/a:cybozu:mailwise:5.4.0 cpe:/a:cybozu:mailwise:5.4.1

CVE-2018-0557

2018-06-26T10:29:00.427-04:00

2018-08-08T14:35:12.483-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-08-08T12:05:06.660-04:00

JVN JVN#52319657 CONFIRM https://support.cybozu.com/ja-jp/article/10194 Stored cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML 'E-mail Details Screen' via unspecified vectors.

CVE-2018-0558

2018-06-26T10:29:00.473-04:00

2018-08-08T14:28:13.090-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-08-08T12:04:39.500-04:00

JVN JVN#52319657 CONFIRM https://support.cybozu.com/ja-jp/article/10193 Reflected cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML in 'System settings' via unspecified vectors.

CVE-2018-0559

2018-06-26T10:29:00.537-04:00

2018-08-08T14:28:04.480-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-08-08T12:01:13.187-04:00

JVN JVN#52319657 CONFIRM https://support.cybozu.com/ja-jp/article/10196 Cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML 'Address' via unspecified vectors.

cpe:/a:hatena:hatena_bookmark:3.0::~~~iphone_os~~ cpe:/a:hatena:hatena_bookmark:3.70::~~~iphone_os~~

CVE-2018-0560

2018-04-16T10:29:00.767-04:00

2018-05-21T13:10:53.203-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-05-18T14:20:01.650-04:00

CONFIRM http://bookmark.hatenastaff.com/entry/2018/04/09/170000 JVN JVN#77753476 Hatena Bookmark App for iOS Version 3.0 to 3.70 allows remote attackers to spoof the address bar via vectors related to URL display.

cpe:/a:securebrain:phishwall:3.7.15::~~internet_explorer~~~

CVE-2018-0561

2018-04-16T10:29:00.827-04:00

2018-05-21T11:05:47.217-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2018-05-17T11:55:26.070-04:00

JVN JVN#92220486 CONFIRM https://www.securebrain.co.jp/about/news/2018/04/180411.html Untrusted search path vulnerability in The installer of PhishWall Client Internet Explorer edition Ver. 3.7.15 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

cpe:/a:coderium:soundengine:5.21::~~free~~~

CVE-2018-0562

2018-04-16T10:29:00.890-04:00

2018-05-21T11:04:34.197-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2018-05-17T11:48:50.283-04:00

JVN JVN#85056623 CONFIRM https://soundengine.jp/wordpress/penguin_press/press_release/4187/ Untrusted search path vulnerability in Installer of SoundEngine Free ver.5.21 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

cpe:/a:ntt-east:flet%27s_virus_clear_easy_setup_%26_application_tool:13.0 cpe:/a:ntt-east:flet%27s_virus_clear_v6_easy_setup_%26_application_tool:13.0

CVE-2018-0563

2018-06-26T10:29:00.583-04:00

2018-08-30T09:07:17.033-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2018-08-15T11:47:45.510-04:00

JVN JVN#20040004 MISC https://flets.com/customer/next/sec/setup/esat_install.html MISC https://flets.com/customer/tec/fvc/setup/esat_install.html Untrusted search path vulnerability in the installer of FLET'S VIRUS CLEAR Easy Setup & Application Tool ver.13.0 and earlier versions and FLET'S VIRUS CLEAR v6 Easy Setup & Application Tool ver.13.0 and earlier versions allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

cpe:/a:lockon:ec-cube:3.0.0 cpe:/a:lockon:ec-cube:3.0.1 cpe:/a:lockon:ec-cube:3.0.3 cpe:/a:lockon:ec-cube:3.0.4 cpe:/a:lockon:ec-cube:3.0.5 cpe:/a:lockon:ec-cube:3.0.6 cpe:/a:lockon:ec-cube:3.0.7 cpe:/a:lockon:ec-cube:3.0.8 cpe:/a:lockon:ec-cube:3.0.9 cpe:/a:lockon:ec-cube:3.0.10 cpe:/a:lockon:ec-cube:3.0.12 cpe:/a:lockon:ec-cube:3.0.13 cpe:/a:lockon:ec-cube:3.0.14 cpe:/a:lockon:ec-cube:3.0.15

CVE-2018-0564

2018-04-20T09:29:00.260-04:00

2018-05-24T09:42:18.227-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-05-23T15:39:06.787-04:00

JVN JVN#52695336 CONFIRM https://www.ec-cube.net/info/weakness/20180416/ Session fixation vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3..4, EC-CUBE 3.0.5, EC-CUBE 3.0.6, EC-CUBE 3.0.7, EC-CUBE 3.0.8, EC-CUBE 3.0.9, EC-CUBE 3.0.10, EC-CUBE 3.0.11, EC-CUBE 3.0.12, EC-CUBE 3.0.12-p1, EC-CUBE 3.0.13, EC-CUBE 3.0.14, EC-CUBE 3.0.15) allows remote attackers to perform arbitrary operations via unspecified vectors.

CVE-2018-0565

2018-06-26T10:29:00.630-04:00

2018-08-08T14:16:12.957-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-08-08T11:18:32.227-04:00

JVN JVN#51737843 CONFIRM https://support.cybozu.com/ja-jp/article/10200 Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.8.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:cybozu:office:10.0.1 cpe:/a:cybozu:office:10.0.2 cpe:/a:cybozu:office:10.1.0 cpe:/a:cybozu:office:10.1.2 cpe:/a:cybozu:office:10.2.0 cpe:/a:cybozu:office:10.3.0 cpe:/a:cybozu:office:10.4.0 cpe:/a:cybozu:office:10.5.0 cpe:/a:cybozu:office:10.6.0 cpe:/a:cybozu:office:10.6.1 cpe:/a:cybozu:office:10.7.0 cpe:/a:cybozu:office:10.8.0

CVE-2018-0566

2018-06-26T10:29:00.693-04:00

2019-10-02T20:03:26.223-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2018-08-08T11:29:31.307-04:00

JVN JVN#51737843 CONFIRM https://support.cybozu.com/ja-jp/article/10195 Cybozu Office 10.0.0 to 10.8.0 allows authenticated attackers to bypass authentication to obtain the schedules without access privilege via unspecified vectors.

CVE-2018-0567

2018-06-26T10:29:00.740-04:00

2019-10-02T20:03:26.223-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2018-08-08T11:37:07.020-04:00

JVN JVN#51737843 CONFIRM https://support.cybozu.com/ja-jp/article/10198 Cybozu Office 10.0.0 to 10.8.0 allows authenticated attackers to bypass access restriction to access and write non-public data via unspecified vectors.

cpe:/a:sitebridge:joruri_gw:3.2.0

CVE-2018-0568

2018-05-14T09:29:00.540-04:00

2018-06-19T12:42:09.757-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2018-06-19T12:21:47.253-04:00

JVN JVN#95589314 MISC https://github.com/joruri/joruri-gw/blob/master/doc/INSTALL.txt Unrestricted file upload vulnerability in SiteBridge Inc. Joruri Gw Ver 3.2.0 and earlier allows remote authenticated users to execute arbitrary PHP code via unspecified vectors.

cpe:/a:basercms:basercms:3.0.0 cpe:/a:basercms:basercms:3.0.0.1 cpe:/a:basercms:basercms:3.0.1 cpe:/a:basercms:basercms:3.0.1.1 cpe:/a:basercms:basercms:3.0.2 cpe:/a:basercms:basercms:3.0.2.1 cpe:/a:basercms:basercms:3.0.3 cpe:/a:basercms:basercms:3.0.3.1 cpe:/a:basercms:basercms:3.0.4 cpe:/a:basercms:basercms:3.0.4.1 cpe:/a:basercms:basercms:3.0.5 cpe:/a:basercms:basercms:3.0.5.1 cpe:/a:basercms:basercms:3.0.5.2 cpe:/a:basercms:basercms:3.0.6 cpe:/a:basercms:basercms:3.0.6:- cpe:/a:basercms:basercms:3.0.6:beta cpe:/a:basercms:basercms:3.0.6.1 cpe:/a:basercms:basercms:3.0.6.2 cpe:/a:basercms:basercms:3.0.7 cpe:/a:basercms:basercms:3.0.7.1 cpe:/a:basercms:basercms:3.0.8 cpe:/a:basercms:basercms:3.0.8.1 cpe:/a:basercms:basercms:3.0.9 cpe:/a:basercms:basercms:3.0.9.1 cpe:/a:basercms:basercms:3.0.10 cpe:/a:basercms:basercms:3.0.10.1 cpe:/a:basercms:basercms:3.0.11 cpe:/a:basercms:basercms:3.0.11.1 cpe:/a:basercms:basercms:3.0.12 cpe:/a:basercms:basercms:3.0.13 cpe:/a:basercms:basercms:3.0.14 cpe:/a:basercms:basercms:3.0.15 cpe:/a:basercms:basercms:4.0.1 cpe:/a:basercms:basercms:4.0.2 cpe:/a:basercms:basercms:4.0.2.1 cpe:/a:basercms:basercms:4.0.3 cpe:/a:basercms:basercms:4.0.4 cpe:/a:basercms:basercms:4.0.5 cpe:/a:basercms:basercms:4.0.5.1 cpe:/a:basercms:basercms:4.0.5.2 cpe:/a:basercms:basercms:4.0.6 cpe:/a:basercms:basercms:4.0.7 cpe:/a:basercms:basercms:4.0.8 cpe:/a:basercms:basercms:4.0.9 cpe:/a:basercms:basercms:4.0.10 cpe:/a:basercms:basercms:4.0.10.1 cpe:/a:basercms:basercms:4.0.11 cpe:/a:basercms:basercms:4.1.0 cpe:/a:basercms:basercms:4.1.0.1

CVE-2018-0569

2018-06-26T10:29:00.787-04:00

2018-08-21T08:36:39.453-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2018-08-14T13:45:10.997-04:00

JVN JVN#67881316 MISC https://basercms.net/security/JVN67881316 baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to execute arbitrary OS commands via unspecified vectors.

CVE-2018-0570

2018-06-26T10:29:00.850-04:00

2018-08-21T08:36:52.110-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-08-14T13:30:48.230-04:00

JVN JVN#67881316 MISC https://basercms.net/security/JVN67881316 Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2018-0571

2018-06-26T10:29:00.897-04:00

2018-08-21T08:37:00.517-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-08-14T13:48:24.950-04:00

JVN JVN#67881316 MISC https://basercms.net/security/JVN67881316 baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers with a site operator privilege to upload arbitrary files.

CVE-2018-0572

2018-06-26T10:29:00.957-04:00

2019-10-02T20:03:26.223-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2018-08-14T13:49:24.203-04:00

JVN JVN#67881316 MISC https://basercms.net/security/JVN67881316 baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to bypass access restriction to view or alter a restricted content via unspecified vectors.

CVE-2018-0573

2018-06-26T10:29:01.007-04:00

2019-10-02T20:03:26.223-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-08-14T13:51:01.690-04:00

JVN JVN#67881316 MISC https://basercms.net/security/JVN67881316 baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction for a content to view a file which is uploaded by a site user via unspecified vectors.

CVE-2018-0574

2018-06-26T10:29:01.067-04:00

2018-08-21T08:37:27.360-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-08-14T13:43:55.010-04:00

JVN JVN#67881316 MISC https://basercms.net/security/JVN67881316 Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2018-0575

2018-06-26T10:29:01.113-04:00

2018-08-21T08:37:35.893-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-08-14T13:47:15.403-04:00

JVN JVN#67881316 MISC https://basercms.net/security/JVN67881316 baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction in mail form to view a file which is uploaded by a site user via unspecified vectors.

cpe:/a:wp-events-plugin:events_manager:1.0::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:1.0.1::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:2.0:-:~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:2.0:beta1:~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:2.0:beta2:~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:2.0:beta3:~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:2.0:beta4:~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:2.0:rc1:~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:2.0:rc2:~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:2.1::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:2.2::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:2.2.1::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:2.2.2::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:3.0::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:3.0.1::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:3.0.2::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:3.0.3::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:3.0.4::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:3.0.5::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:3.0.6::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:3.0.7::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:3.0.8::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:3.0.9::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:3.0.81::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:3.0.91::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:3.0.92::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:3.0.93::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:3.0.94::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:3.0.95::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:3.0.96::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:3.0.97::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:3.0.98::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.0::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.0:-:~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.0:rc1:~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.0:rc2:~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.0.1::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.0.2::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.0.3::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.0.4::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.0.5::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.0.6::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.0.7::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.0.8::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.0.9::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.0.81::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.0.82::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.0.83::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.1::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.2::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.11::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.12::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.13::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.14::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.15::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.16::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.17::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.18::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.171::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.200::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.211::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.212::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.300::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.301::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.302::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.303::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.304::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:4.305::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.0::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.0.1::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.0.2::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.0.3::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.0.4::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.0.41::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.0.50::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.0.51::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.1::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.1.1::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.1.2::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.1.3::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.1.4::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.1.4.1::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.1.4.3::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.1.5::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.1.6::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.1.7::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.1.8::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.1.8.1::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.1.8.2::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.1.8.3::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.1.8.4::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.1.8.5::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.2::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.2.1::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.2.2::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.2.3::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.2.4::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.2.5::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.2.6::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.2.7::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.2.8::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.2.9::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.3::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.3.1::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.3.2::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.3.2.1::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.3.3::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.3.4::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.3.5::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.3.6::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.3.6.1::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.3.7::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.3.8::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.3.9::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.4::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.4.1::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.4.1.1::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.4.2::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.4.3::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.4.4::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.4.42::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.5::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.5.1::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.5.2::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.5.3::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.5.3.1::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.5.4::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.5.5::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.5.6::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.5.7::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.5.7.1::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.6::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.6.1::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.6.2::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.6.3::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.6.4::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.6.5::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.6.6::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.6.6.1::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.7::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.7.1::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.7.2::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.7.3::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.8::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.8.0.1::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.8.1::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.8.1.1::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.8.1.2::~~~wordpress~~ cpe:/a:wp-events-plugin:events_manager:5.8.1.3::~~~wordpress~~

CVE-2018-0576

2018-05-14T09:29:00.757-04:00

2018-06-06T09:06:08.900-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-06-05T16:16:34.520-04:00

JVN JVN#85531148 CONFIRM https://wordpress.org/plugins/events-manager/#developers Cross-site scripting vulnerability in Events Manager plugin prior to version 5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2018-0577

2018-05-14T09:29:00.960-04:00

2018-06-13T12:57:55.580-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-06-13T12:45:08.603-04:00

JVN JVN#01040170 MISC https://wordpress.org/plugins/wp-google-map-plugin/#developers Cross-site scripting vulnerability in WP Google Map Plugin prior to version 4.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:pixelyoursite:pixelyoursite:1.0::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:1.01::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:1.02::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:1.03::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:1.04::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:1.05::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:2.0::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:2.1::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:2.2::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:2.2.1::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:2.2.2::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:2.2.3::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:2.2.4::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:3.0::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:3.0.1::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:3.0.2::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:3.0.3::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:3.1.0::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:4.0.0::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:4.0.1::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:4.0.2::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:4.0.3::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:5.0::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:5.0.1::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:5.0.2::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:5.0.3::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:5.0.4::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:5.0.5::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:5.0.5.2::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:5.0.6::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:5.0.7::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:5.0.8::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:5.0.9::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:5.1.0::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:5.2.0::~~~wordpress~~ cpe:/a:pixelyoursite:pixelyoursite:5.2.1::~~~wordpress~~

CVE-2018-0578

2018-05-14T09:29:01.197-04:00

2018-06-13T12:58:04.207-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-06-13T12:38:35.667-04:00

JVN JVN#61081552 CONFIRM https://wordpress.org/plugins/pixelyoursite/#developers Cross-site scripting vulnerability in PixelYourSite plugin prior to version 5.3.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.1::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.1.1::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.1.2::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.1.3::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.1.4::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.1.5::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.1.6::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.1.7::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.1.8::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.1.8.1::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.1.9::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.1.9.5::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.2::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.2.1::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.2.2::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.2.3::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.3::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.3.1::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.3.2::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.3.3::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.3.4::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.3.5::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.4::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.4.1::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.4.2::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.4.3::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.5::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.5.1::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.5.2::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.5.2.1::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.5.3::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:0.5.4::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.0.1::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.1::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.1.1::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.1.2::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.2::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.3::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.3.1::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.3.2::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.3.3::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.3.4::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.4::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.4.1::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.4.2::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.5::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.5.1::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.5.2::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.6::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.6.1::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.6.2::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.6.2.1::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.6.2.2::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.6.3::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.7::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.7.1::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.7.2::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.7.3::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.7.3.1::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.7.4::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.7.4.1::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.7.4.2::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.7.4.3::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:1.7.4.4::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.0.1::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.0.2::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.0.3::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.0.4::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.0.5::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.0.6::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.0.6.1::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.0.6.2::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.0.6.3::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.0.7::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.0.8::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.0.8.1::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.0.8.2::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.0.9::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.1::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.1.1::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.1.2::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.1.3::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.1.4::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.1.4.1::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.1.4.2::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.1.4.3::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.1.4.4::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.1.4.5::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.1.5::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.1.6::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.1.6.1::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.1.6.2::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.1.6.3::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.2::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.2.1::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.2.2::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.2.3::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.2.3.1::~~~wordpress~~ cpe:/a:webdados:open_graph_for_facebook%2c_google%2b_and_twitter_card_tags:2.2.4::~~~wordpress~~

CVE-2018-0579

2018-05-14T09:29:01.383-04:00

2018-06-19T12:21:01.873-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-06-18T09:49:37.677-04:00

JVN JVN#08386386 CONFIRM https://wordpress.org/plugins/wonderm00ns-simple-facebook-open-graph-tags/#developers Cross-site scripting vulnerability in Open Graph for Facebook, Google+ and Twitter Card Tags plugin prior to version 2.2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:celsys:clip_studio_action:1.5.5::~~~windows~~ cpe:/a:celsys:clip_studio_modeler:1.6.3::~~~windows~~ cpe:/a:celsys:clip_studio_paint:1.7.3::~~~windows~~

CVE-2018-0580

2018-05-14T09:29:01.570-04:00

2018-06-20T10:50:01.680-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2018-06-18T13:06:28.027-04:00

MISC http://www.clipstudio.net/en/dl JVN JVN#68345747 MISC https://www.clip-studio.com/clip_site/download/clipstudioaction/csaupdater/index_win Untrusted search path vulnerability in CELSYS, Inc CLIP STUDIO series (CLIP STUDIO PAINT (for Windows) EX/PRO/DEBUT Ver.1.7.3 and earlier, CLIP STUDIO ACTION (for Windows) Ver.1.5.5 and earlier, with its timestamp prior to April 25, 2018, 12:11:31, and CLIP STUDIO MODELER (for Windows) Ver.1.6.3 and earlier, with its timestamp prior to April 25, 2018, 17:02:49) allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.

cpe:/o:asus:rt-ac87u_firmware:3.0.0.4.378.3754

CVE-2018-0581

2018-05-14T09:29:01.790-04:00

2018-06-18T12:24:53.827-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-06-14T16:34:14.510-04:00

JVN JVN#33901663 MISC https://www.asus.com/Networking/RTAC87U/HelpDesk_BIOS/ Cross-site scripting vulnerability in ASUS RT-AC87U Firmware version prior to 3.0.0.4.378.9383 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/o:asus:rt-ac68u_firmware:3.0.0.4.374.4755 cpe:/o:asus:rt-ac68u_firmware:3.0.0.4.374.5047 cpe:/o:asus:rt-ac68u_firmware:3.0.0.4.374_4561 cpe:/o:asus:rt-ac68u_firmware:3.0.0.4.374_4887 cpe:/o:asus:rt-ac68u_firmware:3.0.0.4.374_4983 cpe:/o:asus:rt-ac68u_firmware:3.0.0.4.376.3715

CVE-2018-0582

2018-05-14T09:29:01.960-04:00

2018-06-15T15:36:11.017-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-06-14T16:51:23.357-04:00

JVN JVN#73742314 MISC https://www.asus.com/Networking/RTAC68U/HelpDesk_BIOS/ Cross-site scripting vulnerability in ASUS RT-AC68U Firmware version prior to 3.0.0.4.380.1031 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2018-0583

2018-05-14T09:29:02.163-04:00

2018-06-15T15:36:41.830-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-06-14T16:55:59.080-04:00

JVN JVN#34562916 MISC https://www.asus.com/Networking/RTAC1200HP/HelpDesk_BIOS/ Cross-site scripting vulnerability in ASUS RT-AC1200HP Firmware version prior to 3.0.0.4.380.4180 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:iij:smartkey:2.1.0::~~~android~~

CVE-2018-0584

2018-06-26T10:29:01.160-04:00

2018-08-21T07:32:56.150-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-08-15T10:00:13.817-04:00

JVN JVN#27137002 IIJ SmartKey App for Android version 2.1.0 and earlier allows remote attackers to bypass authentication [effect_of_bypassing_authentication] via unspecified vectors.

cpe:/a:ultimatemember:ultimate_member:1.0.0::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.10::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.15::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.16::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.17::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.18::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.19::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.20::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.21::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.22::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.23::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.24::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.25::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.26::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.27::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.28::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.29::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.30::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.31::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.32::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.33::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.34::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.35::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.36::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.37::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.38::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.39::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.40::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.41::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.42::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.43::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.44::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.45::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.46::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.47::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.48::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.49::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.50::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.51::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.52::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.53::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.54::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.55::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.56::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.57::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.58::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.59::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.60::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.61::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.62::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.63::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.64::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.65::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.66::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.67::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.68::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.69::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.70::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.71::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.72::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.73::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.74::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.75::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.76::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.77::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.78::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.79::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.80::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.81::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.82::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.83::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.84::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.85::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.86::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.87::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.88::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.89::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.90::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.91::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.92::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.93::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.94::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.95::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.0.96::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.1.0::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.1.1::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.1.2::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.1.3::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.1.4::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.1.5::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.1.6::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.2.2::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.2.3::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.2.4::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.2.5::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.2.6::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.2.7::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.2.8::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.2.9::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.2.91::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.2.92::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.2.93::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.2.94::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.2.95::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.2.96::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.2.97::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.2.98::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.2.99::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.2.993::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.2.994::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.2.995::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.2.996::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.2.997::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.0::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.1::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.11::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.12::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.13::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.14::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.15::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.16::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.17::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.18::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.19::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.20::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.21::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.22::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.23::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.24::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.25::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.26::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.27::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.28::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.29::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.30::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.31::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.32::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.33::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.34::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.35::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.36::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.37::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.38::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.39::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.40::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.41::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.42::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.43::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.44::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.45::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.46::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.47::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.48::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.49::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.50::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.51::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.52::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.53::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.54::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.55::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.56::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.57::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.58::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.59::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.60::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.61::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.62::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.63::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.64::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.65::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.66::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.67::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.68::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.69::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.70::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.71::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.72::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.73::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.74::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.75::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.76::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.77::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.78::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.79::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.80::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.81::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.82::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.83::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.84::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.85::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.86::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.87::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:1.3.88::~~~wordpress~~ cpe:/a:ultimatemember:ultimate_member:2.0::~~~wordpress~~

CVE-2018-0585

2018-05-14T09:29:02.353-04:00

2018-06-06T09:06:18.417-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-06-05T16:22:10.733-04:00

JVN JVN#28804532 CONFIRM https://wordpress.org/plugins/ultimate-member/#developers Cross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:ultimatemember:user_profile_%26_membership:1.0.0::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.10::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.15::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.16::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.17::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.18::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.19::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.20::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.21::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.22::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.23::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.24::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.25::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.26::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.27::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.28::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.29::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.30::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.31::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.32::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.33::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.34::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.35::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.36::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.37::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.38::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.39::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.40::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.41::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.42::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.43::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.44::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.45::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.46::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.47::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.48::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.49::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.50::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.51::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.52::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.53::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.54::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.55::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.56::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.57::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.58::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.59::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.60::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.61::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.62::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.63::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.64::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.65::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.66::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.67::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.68::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.69::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.70::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.71::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.72::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.73::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.74::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.75::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.76::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.77::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.78::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.79::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.80::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.81::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.82::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.83::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.84::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.85::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.86::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.87::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.88::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.89::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.90::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.91::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.92::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.93::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.94::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.95::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.0.96::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.1.0::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.1.1::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.1.2::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.1.3::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.1.4::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.1.5::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.1.6::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.2.2::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.2.3::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.2.4::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.2.5::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.2.6::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.2.7::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.2.8::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.2.9::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.2.91::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.2.92::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.2.93::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.2.94::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.2.95::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.2.96::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.2.97::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.2.98::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.2.99::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.2.993::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.2.994::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.2.995::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.2.996::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.2.997::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.0::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.1::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.11::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.12::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.13::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.14::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.15::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.16::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.17::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.18::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.19::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.20::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.21::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.22::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.23::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.24::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.25::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.26::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.27::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.28::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.29::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.30::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.31::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.32::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.33::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.34::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.35::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.36::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.37::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.38::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.39::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.40::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.41::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.42::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.43::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.44::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.45::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.46::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.47::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.48::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.49::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.50::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.51::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.52::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.53::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.54::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.55::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.56::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.57::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.58::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.59::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.60::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.61::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.62::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.63::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.64::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.65::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.66::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.67::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.68::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.69::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.70::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.71::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.72::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.73::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.74::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.75::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.76::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.77::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.78::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.79::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.80::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.81::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.82::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.83::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.84::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.85::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.86::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.87::~~~wordpress~~ cpe:/a:ultimatemember:user_profile_%26_membership:1.3.88::~~~wordpress~~

CVE-2018-0586

2018-05-14T09:29:02.570-04:00

2018-06-18T10:35:32.920-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2018-06-15T11:07:49.363-04:00

JVN JVN#28804532 CONFIRM https://wordpress.org/plugins/ultimate-member/#developers Directory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to read arbitrary files via unspecified vectors.

CVE-2018-0587

2018-05-14T09:29:02.757-04:00

2018-06-15T15:48:46.327-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-06-15T11:35:06.057-04:00

JVN JVN#28804532 CONFIRM https://wordpress.org/plugins/ultimate-member/#developers Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated users to upload arbitrary image files via unspecified vectors.

CVE-2018-0588

2018-05-14T09:29:02.960-04:00

2018-06-18T10:40:51.237-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2018-06-15T11:26:34.290-04:00

JVN JVN#28804532 CONFIRM https://wordpress.org/plugins/ultimate-member/#developers Directory traversal vulnerability in the AJAX function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to read arbitrary files via unspecified vectors.

CVE-2018-0589

2018-05-14T09:29:03.163-04:00

2019-10-02T20:03:26.223-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-06-15T10:45:29.310-04:00

JVN JVN#28804532 CONFIRM https://wordpress.org/plugins/ultimate-member/#developers Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to add a new form in the 'Forms' page via unspecified vectors.

CVE-2018-0590

2018-05-14T09:29:03.353-04:00

2019-10-02T20:03:26.223-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-06-15T10:38:34.567-04:00

JVN JVN#28804532 CONFIRM https://wordpress.org/plugins/ultimate-member/#developers Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the other users profiles via unspecified vectors.

cpe:/a:t-joy:kinepass:3.1.1::~~~android~~ cpe:/a:t-joy:kinepass:3.1.2::~~~iphone_os~~

CVE-2018-0591

2018-05-14T09:29:03.447-04:00

2018-06-25T13:00:04.360-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-06-18T13:51:17.307-04:00

MISC https://itunes.apple.com/us/app/kinepasu-apuridekantan-bian/id637453055?mt=8 JVN JVN#83671755 MISC https://play.google.com/store/apps/details?id=jp.tjoy.kinepass&hl=en The KINEPASS App for Android Ver 3.1.1 and earlier, and for iOS Ver 3.1.2 and earlier do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

cpe:/a:microsoft:onedrive:-

CVE-2018-0592

2018-06-26T10:29:01.207-04:00

2018-08-17T13:07:14.713-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2018-08-14T15:17:06.293-04:00

JVN JVN#91151862 BID 104563 MISC https://blogs.technet.microsoft.com/srd/2018/04/04/triaging-a-dll-planting-vulnerability/ Untrusted search path vulnerability in Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

cpe:/a:microsoft:onedrive:-

CVE-2018-0593

2018-06-26T10:29:01.270-04:00

2018-08-17T13:07:35.217-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2018-08-14T15:15:37.897-04:00

JVN JVN#91151862 BID 104563 MISC https://blogs.technet.microsoft.com/srd/2018/04/04/triaging-a-dll-planting-vulnerability/ Untrusted search path vulnerability in the installer of Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

cpe:/a:microsoft:skype:-

CVE-2018-0594

2018-06-26T10:29:01.303-04:00

2018-08-17T13:07:48.953-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2018-08-14T15:17:53.497-04:00

JVN JVN#91151862 BID 104563 MISC https://blogs.technet.microsoft.com/srd/2018/04/04/triaging-a-dll-planting-vulnerability/ Untrusted search path vulnerability in Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

cpe:/a:microsoft:skype:-

CVE-2018-0595

2018-06-26T10:29:01.363-04:00

2018-08-17T13:11:29.167-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2018-08-14T14:27:28.530-04:00

JVN JVN#91151862 BID 104563 MISC https://blogs.technet.microsoft.com/srd/2018/04/04/triaging-a-dll-planting-vulnerability/ Untrusted search path vulnerability in the installer of Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

cpe:/a:microsoft:visual_studio_community:-

CVE-2018-0596

2018-06-26T10:29:01.410-04:00

2018-08-17T13:12:07.437-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2018-08-14T14:16:38.493-04:00

JVN JVN#91151862 BID 104563 MISC https://blogs.technet.microsoft.com/srd/2018/04/04/triaging-a-dll-planting-vulnerability/ Untrusted search path vulnerability in the installer of Visual Studio Community allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

cpe:/a:microsoft:visual_studio_code:-

CVE-2018-0597

2018-06-26T10:29:01.473-04:00

2018-11-23T11:27:58.480-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2018-11-23T11:20:48.333-05:00

JVN JVN#91151862 BID 104563 MISC https://blogs.technet.microsoft.com/srd/2018/04/04/triaging-a-dll-planting-vulnerability/ Untrusted search path vulnerability in the installer of Visual Studio Code allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

cpe:/o:microsoft:windows:-

CVE-2018-0598

2018-06-26T10:29:01.507-04:00

2018-08-17T13:21:41.777-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2018-08-14T14:09:50.317-04:00

JVN JVN#72748502 MISC https://blogs.technet.microsoft.com/srd/2018/04/04/triaging-a-dll-planting-vulnerability/ Untrusted search path vulnerability in Self-extracting archive files created by IExpress bundled with Microsoft Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

cpe:/o:microsoft:windows:-

CVE-2018-0599

2018-06-26T10:29:01.553-04:00

2018-08-17T13:23:00.763-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2018-08-14T14:10:31.160-04:00

JVN JVN#81196185 MISC https://blogs.technet.microsoft.com/srd/2018/04/04/triaging-a-dll-planting-vulnerability/ Untrusted search path vulnerability in the installer of Visual C++ Redistributable allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

cpe:/a:sony:playmemories_home:5.5.01

CVE-2018-0600

2018-06-26T10:29:01.600-04:00

2018-08-17T13:19:04.393-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2018-08-14T13:31:46.863-04:00

JVN JVN#13940333 MISC http://support.d-imaging.sony.co.jp/www/disoft/int/download/playmemories-home/win/ja/index.html Untrusted search path vulnerability in the installer of PlayMemories Home for Windows ver.5.5.01 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

cpe:/a:axpdfium_project:axpdfium:0.01

CVE-2018-0601

2018-06-26T10:29:01.647-04:00

2018-08-17T13:17:27.763-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2018-08-14T13:02:16.587-04:00

JVN JVN#79301396 MISC https://github.com/yak1ex/axpdfium/wiki/JVN%2379301396(en) Untrusted search path vulnerability in axpdfium v0.01 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

CVE-2018-0602

2018-06-26T10:29:01.693-04:00

2018-08-17T13:13:13.037-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-08-14T11:51:07.317-04:00

JVN JVN#16471686 MISC https://wordpress.org/plugins/email-subscribers/#developers Cross-site scripting vulnerability in Email Subscribers & Newsletters versions prior to 3.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:geminilabs:site_reviews:1.0.0::~~~wordpress~~ cpe:/a:geminilabs:site_reviews:1.1.1::~~~wordpress~~ cpe:/a:geminilabs:site_reviews:1.2.2::~~~wordpress~~ cpe:/a:geminilabs:site_reviews:2.0.4::~~~wordpress~~ cpe:/a:geminilabs:site_reviews:2.1.8::~~~wordpress~~ cpe:/a:geminilabs:site_reviews:2.2.3::~~~wordpress~~ cpe:/a:geminilabs:site_reviews:2.3.2::~~~wordpress~~ cpe:/a:geminilabs:site_reviews:2.4.5::~~~wordpress~~ cpe:/a:geminilabs:site_reviews:2.5.2::~~~wordpress~~ cpe:/a:geminilabs:site_reviews:2.6.2::~~~wordpress~~ cpe:/a:geminilabs:site_reviews:2.7.4::~~~wordpress~~ cpe:/a:geminilabs:site_reviews:2.8.4::~~~wordpress~~ cpe:/a:geminilabs:site_reviews:2.9.5::~~~wordpress~~ cpe:/a:geminilabs:site_reviews:2.10.4::~~~wordpress~~ cpe:/a:geminilabs:site_reviews:2.11.3::~~~wordpress~~ cpe:/a:geminilabs:site_reviews:2.12.5::~~~wordpress~~ cpe:/a:geminilabs:site_reviews:2.13.2::~~~wordpress~~ cpe:/a:geminilabs:site_reviews:2.14.3::~~~wordpress~~

CVE-2018-0603

2018-06-26T10:29:01.740-04:00

2018-08-17T13:12:47.083-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-08-14T11:37:16.477-04:00

JVN JVN#60978548 MISC https://wordpress.org/plugins/site-reviews/#developers MISC https://wpvulndb.com/vulnerabilities/9102 Cross-site scripting vulnerability in Site Reviews versions prior to 2.15.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:pixelpost:pixelpost:1.7.3

CVE-2018-0604

2018-06-26T10:29:01.787-04:00

2019-10-02T20:03:26.223-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2018-08-15T09:39:48.560-04:00

JVN JVN#27978559 Pixelpost v1.7.3 and earlier allows remote code execution via unspecified vectors.

cpe:/a:pixelpost:pixelpost:1.7.3

CVE-2018-0605

2018-06-26T10:29:01.833-04:00

2018-08-27T13:13:48.120-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-08-14T13:34:38.977-04:00

JVN JVN#27978559 Cross-site scripting vulnerability in Pixelpost v1.7.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:pixelpost:pixelpost:1.7.3

CVE-2018-0606

2018-06-26T10:29:01.880-04:00

2018-08-17T13:22:27.667-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2018-08-15T09:39:07.387-04:00

JVN JVN#27978559 SQL injection vulnerability in the Pixelpost v1.7.3 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2018-0607

2018-07-26T13:29:00.457-04:00

2018-09-24T13:29:39.187-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2018-09-24T13:19:08.060-04:00

JVN JVN#13415512 CONFIRM https://kb.cybozu.support/article/33120/ SQL injection vulnerability in the Notifications application in the Cybozu Garoon 3.5.0 to 4.6.2 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.

cpe:/a:h2o_project:h2o:2.2.4

CVE-2018-0608

2018-06-26T10:29:01.927-04:00

2018-08-17T13:22:38.073-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2018-08-14T20:02:46.670-04:00

JVN JVN#93226941 MISC https://github.com/h2o/h2o/issues/1775 Buffer overflow in H2O version 2.2.4 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (DoS) via unspecified vectors.

cpe:/a:linecorp:line:4.3.0.724::~~~windows~~

CVE-2018-0609

2018-06-26T10:29:01.973-04:00

2018-08-17T13:23:26.717-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2018-08-15T09:46:08.083-04:00

JVN JVN#92265618 MISC https://linecorp.com/en/security/article/172 Untrusted search path vulnerability in LINE for Windows versions before 5.8.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

cpe:/a:zenphoto:zenphoto:1.4.14

CVE-2018-0610

2018-06-26T10:29:02.020-04:00

2019-10-02T20:03:26.223-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2018-08-15T11:20:42.347-04:00

JVN JVN#33124193 MISC https://www.zenphoto.org/news/zenphoto-1.5 Local file inclusion vulnerability in Zenphoto 1.4.14 and earlier allows a remote attacker with an administrative privilege to execute arbitrary code or obtain sensitive information.

cpe:/a:ana:ana:4.0.22::~~~iphone_os~~

CVE-2018-0611

2018-06-26T10:29:02.067-04:00

2018-08-28T12:48:19.277-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-08-15T11:14:19.507-04:00

JVN JVN#71535108 MISC