58.507 CVE tracked
796 Exploited now
188 Used by ransomware
Last sync
Cisco vulnerabilities
6716 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2018-0268 | CRIT 10.0 | cisco digital_network_architecture_center A vulnerability in the container management subsystem of Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authentication and gain elevated privileges. This vulnerability is due to an insecure default con | 5.0% | — |
| CVE-2018-0238 | CRIT 9.9 | cisco unified_computing_system_director A vulnerability in the role-based resource checking functionality of the Cisco Unified Computing System (UCS) Director could allow an authenticated, remote attacker to view unauthorized information for any virtual machine in the UCS Director end-user portal an | 5.0% | — |
| CVE-2020-3218 | HIGH 7.2 | cisco ios_xe A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with administrative privileges to execute arbitrary code with root privileges on the underlying Linux shell. The vulnerability is due to improper validation of | 4.9% | — |
| CVE-2022-20711 | CRIT 10.0 | cisco rv340_firmware Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization prot | 4.9% | — |
| CVE-2007-0481 | HIGH 7.8 | cisco ios_transmission_control_protocol Cisco IOS allows remote attackers to cause a denial of service (crash) via a crafted IPv6 Type 0 Routing header. | 4.9% | — |
| CVE-2016-6441 | CRIT 9.8 | cisco ios_xe A vulnerability in the Transaction Language 1 (TL1) code of Cisco ASR 900 Series routers could allow an unauthenticated, remote attacker to cause a reload of, or remotely execute code on, the affected system. This vulnerability affects Cisco ASR 900 Series Agg | 4.9% | — |
| CVE-2016-6382 | HIGH 7.5 | cisco ios Cisco IOS 15.2 through 15.6 and IOS XE 3.6 through 3.17 and 16.1 allow remote attackers to cause a denial of service (device restart) via a malformed IPv6 Protocol Independent Multicast (PIM) register packet, aka Bug ID CSCuy16399. | 4.9% | — |
| CVE-2012-1336 | HIGH 9.3 | cisco webex_recording_format_player Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 L through SP11 EP26, T27 LB through SP21 EP10, T27 LC before SP25 EP10, and T27 LD before SP32 CP1 allows remote attackers to execute arbitrary code via a crafted WRF file, a different vulner | 4.9% | — |
| CVE-2019-1651 | CRIT 9.9 | cisco vsmart_controller A vulnerability in the vContainer of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to cause a denial of service (DoS) condition and execute arbitrary code as the root user. The vulnerability is due to improper bounds checking by the v | 4.9% | — |
| CVE-2017-6667 | CRIT 9.8 | cisco context_service_development_kit A vulnerability in the update process for the dynamic JAR file of the Cisco Context Service software development kit (SDK) could allow an unauthenticated, remote attacker to execute arbitrary code on the affected device with the privileges of the web server. M | 4.8% | — |
| CVE-2009-2631 | MED 6.8 | aladdin safenet_securewire_access_gateway Multiple clientless SSL VPN products that run in web browsers, including Stonesoft StoneGate; Cisco ASA; SonicWALL E-Class SSL VPN and SonicWALL SSL VPN; SafeNet SecureWire Access Gateway; Juniper Networks Secure Access; Nortel CallPilot; Citrix Access Gateway | 4.8% | — |
| CVE-2016-1395 | CRIT 9.8 | cisco rv110w_wireless-n_vpn_firewall_firmware The web-based management interface on Cisco RV110W devices with firmware before 1.2.1.7, RV130W devices with firmware before 1.0.3.16, and RV215W devices with firmware before 1.3.0.8 allows remote attackers to execute arbitrary code as root via a crafted HTTP | 4.8% | — |
| CVE-2020-3470 | CRIT 9.8 | cisco enterprise_nfv_infrastructure_software Multiple vulnerabilities in the API subsystem of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges. The vulnerabilities are due to improper boundary checks for certain us | 4.8% | — |
| CVE-2018-0150 | CRIT 9.8 | cisco ios_xe A vulnerability in Cisco IOS XE Software could allow an unauthenticated, remote attacker to log in to a device running an affected release of Cisco IOS XE Software with the default username and password that are used at initial boot, aka a Static Credential Vu | 4.8% | — |
| CVE-2020-3119 | HIGH 8.8 | cisco nx-os A vulnerability in the Cisco Discovery Protocol implementation for Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability exists because the Cisco Discovery Pr | 4.8% | — |
| CVE-2016-6371 | HIGH 7.5 | cisco hosted_collaboration_mediation_fulfillment Directory traversal vulnerability in the web interface in Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) 10.6(3) and earlier allows remote attackers to write to arbitrary files via a crafted URL, aka Bug ID CSCuz64717. | 4.8% | — |
| CVE-2018-0293 | HIGH 8.8 | cisco nx-os A vulnerability in role-based access control (RBAC) for Cisco NX-OS Software could allow an authenticated, remote attacker to execute CLI commands that should be restricted for a nonadministrative user. The attacker would have to possess valid user credentials | 4.8% | — |
| CVE-2010-0589 | HIGH 9.3 | cisco secure_desktop The Web Install ActiveX control (CSDWebInstaller) in Cisco Secure Desktop (CSD) before 3.5.841 does not properly verify the signatures of downloaded programs, which allows remote attackers to force the download and execution of arbitrary files via a crafted we | 4.8% | — |
| CVE-2010-0440 | MED 4.3 | cisco adaptive_security_appliance_software Cross-site scripting (XSS) vulnerability in +CSCOT+/translation in Cisco Secure Desktop 3.4.2048, and other versions before 3.5; as used in Cisco ASA appliance before 8.2(1), 8.1(2.7), and 8.0(5); allows remote attackers to inject arbitrary web script or HTML | 4.7% | — |
| CVE-2010-1574 | HIGH 10.0 | cisco industrial_ethernet_3000 IOS 12.2(52)SE and 12.2(52)SE1 on Cisco Industrial Ethernet (IE) 3000 series switches has (1) a community name of public for RO access and (2) a community name of private for RW access, which makes it easier for remote attackers to modify the configuration or | 4.7% | — |
| CVE-2007-2282 | HIGH 10.0 | cisco netflow_collection_engine Cisco Network Services (CNS) NetFlow Collection Engine (NFC) before 6.0 has an nfcuser account with the default password nfcuser, which allows remote attackers to modify the product configuration and, when installed on Linux, obtain login access to the host op | 4.7% | — |
| CVE-2014-3341 | MED 5.0 | cisco nexus_5000 The SNMP module in Cisco NX-OS 7.0(3)N1(1) and earlier on Nexus 5000 and 6000 devices provides different error messages for invalid requests depending on whether the VLAN ID exists, which allows remote attackers to enumerate VLANs via a series of requests, aka | 4.7% | — |
| CVE-2011-2544 | LOW 3.5 | cisco telepresence_mxp_software Cross-site scripting (XSS) vulnerability in the web interface in Cisco TelePresence System MXP Series F9.1 and earlier allows remote authenticated users to inject arbitrary web script or HTML via a crafted Call ID, as demonstrated by resultant cross-site reque | 4.7% | — |
| CVE-2020-3258 | CRIT 9.8 | cisco ios Multiple vulnerabilities in Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series Connected Grid Routers (CGR1000) could allow an unauthenticated, remote attacker or an authenticated, local atta | 4.6% | — |
| CVE-2019-1845 | HIGH 8.6 | cisco telepresence_video_communication_server A vulnerability in the authentication service of the Cisco Unified Communications Manager IM and Presence (Unified CM IM&P) Service, Cisco TelePresence Video Communication Server (VCS), and Cisco Expressway Series could allow an unauthenticated, remote att | 4.6% | — |