58.507 CVE tracked
796 Exploited now
188 Used by ransomware
Last sync
Cisco vulnerabilities
6716 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2015-6287 | MED 5.0 | cisco web_security_virtual_appliance Cisco Web Security Appliance (WSA) 8.0.6-078 and 8.0.6-115 allows remote attackers to cause a denial of service (service outage) via a flood of TCP traffic that leads to DNS resolution delays, aka Bug IDs CSCur32005 and CSCur07907. | 2.0% | — |
| CVE-2011-0387 | HIGH 8.0 | cisco telepresence_multipoint_switch The administrative web interface on Cisco TelePresence Multipoint Switch (CTMS) devices with software 1.0.x, 1.1.x, 1.5.x, and 1.6.x allows remote authenticated users to cause a denial of service or have unspecified other impact via vectors involving access to | 2.0% | — |
| CVE-2018-0398 | CRIT 9.8 | cisco finesse Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a server-side request forgery (SSRF) attack. Cisco Bug IDs: CSCvg71018. | 2.0% | — |
| CVE-2018-0199 | MED 6.1 | cisco jabber A vulnerability in Cisco Jabber Client Framework (JCF) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of an affected device. The vulnerability is due to improper neutralization of script in attribu | 2.0% | — |
| CVE-2012-2496 | MED 6.8 | cisco anyconnect_secure_mobility_client A certain Java applet in the VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 3.x before 3.0 MR7 on 64-bit Linux platforms does not properly restrict use of Java components, which allows remote attackers to exec | 2.0% | — |
| CVE-2009-0615 | HIGH 9.0 | cisco application_control_engine_device_manager Directory traversal vulnerability in Cisco Application Networking Manager (ANM) before 2.0 and Application Control Engine (ACE) Device Manager before A3(2.1) allows remote authenticated users to read or modify arbitrary files via unspecified vectors, related t | 2.0% | — |
| CVE-2021-1401 | HIGH 8.8 | cisco wap125_firmware Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to obtain sensitive information from or inject arbitrary commands on an | 2.0% | — |
| CVE-2021-1602 | HIGH 8.2 | cisco small_business_rv_series_router_firmware A vulnerability in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected d | 2.0% | — |
| CVE-2018-0227 | HIGH 7.5 | cisco adaptive_security_appliance_software A vulnerability in the Secure Sockets Layer (SSL) Virtual Private Network (VPN) Client Certificate Authentication feature for Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to establish an SSL VPN connection and bypass | 2.0% | — |
| CVE-2017-12316 | HIGH 7.5 | cisco identity_services_engine_software A vulnerability in the Guest Portal login page of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to perform multiple login attempts in excess of the configured login attempt limit. The vulnerability is due to insufficient | 2.0% | — |
| CVE-2014-0728 | HIGH 7.5 | cisco unified_communications_manager SQL injection vulnerability in the Java database interface in Cisco Unified Communications Manager (UCM) 10.0(1) and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05313. | 2.0% | — |
| CVE-2017-6790 | MED 6.8 | cisco telepresence_video_communication_server A vulnerability in the Session Initiation Protocol (SIP) on the Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the targeted appliance. The vulnerability is due | 2.0% | — |
| CVE-2014-3303 | MED 4.0 | cisco webex_meetings_server The web framework in Cisco WebEx Meetings Server does not properly restrict the content of query strings, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser histo | 2.0% | — |
| CVE-2014-3280 | MED 4.0 | cisco unified_communications_domain_manager The web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not properly implement access control, which allows remote authenticated users to obtain potentially sensitive user information by visiting an unspecified A | 2.0% | — |
| CVE-2014-3282 | MED 4.0 | cisco unified_communications_domain_manager The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not properly implement access control, which allows remote authenticated users to obtain sensitive number-translation information | 2.0% | — |
| CVE-2013-5560 | MED 5.4 | cisco adaptive_security_appliance_software The IPv6 implementation in Cisco Adaptive Security Appliance (ASA) Software 9.1.3 and earlier, when NAT64 or NAT66 is enabled, does not properly process NAT rules, which allows remote attackers to cause a denial of service (device reload) via crafted packets, | 2.0% | — |
| CVE-2013-5559 | MED 6.8 | cisco anyconnect_secure_mobility_client Buffer overflow in the Active Template Library (ATL) framework in the VPNAPI COM module in Cisco AnyConnect Secure Mobility Client 2.x allows user-assisted remote attackers to execute arbitrary code via a crafted HTML document, aka Bug ID CSCuj58139. | 2.0% | — |
| CVE-2006-3289 | LOW 2.6 | cisco wireless_control_system Cross-site scripting (XSS) vulnerability in the login page of the HTTP interface for the Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(51) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a | 2.0% | — |
| CVE-2006-0764 | MED 5.1 | cisco anomaly_guard_module The Authentication, Authorization, and Accounting (AAA) capability in versions 5.0(1) and 5.0(3) of the software used by multiple Cisco Anomaly Detection and Mitigation products, when running with an incomplete TACACS+ configuration without a "tacacs-server ho | 2.0% | — |
| CVE-2019-1697 | MED 6.8 | cisco adaptive_security_appliance_software A vulnerability in the implementation of the Lightweight Directory Access Protocol (LDAP) feature in Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affect | 2.0% | — |
| CVE-2019-1693 | MED 6.5 | cisco adaptive_security_appliance_software A vulnerability in the WebVPN service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vu | 2.0% | — |
| CVE-2019-1721 | MED 6.5 | cisco telepresence_video_communication_server A vulnerability in the phone book feature of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to cause the CPU to increase to 100% utilization, causing a denial of service (DoS) condi | 2.0% | — |
| CVE-2015-4225 | MED 4.0 | cisco nx-os Cisco Application Policy Infrastructure Controller (APIC) 1.0(1.110a) and 1.0(1e) on Nexus 9000 devices does not properly implement RBAC health scoring, which allows remote authenticated users to obtain sensitive information via unspecified vectors, aka Bug ID | 2.0% | — |
| CVE-2015-4214 | MED 4.0 | cisco unified_meetingplace Cisco Unified MeetingPlace 8.6(1.2) and 8.6(1.9) allows remote authenticated users to discover cleartext passwords by reading HTML source code, aka Bug ID CSCuu33050. | 2.0% | — |
| CVE-2013-5554 | HIGH 7.5 | cisco wide_area_application_services_mobile Directory traversal vulnerability in the web-management interface in the server in Cisco Wide Area Application Services (WAAS) Mobile before 3.5.5 allows remote attackers to upload and execute arbitrary files via a crafted POST request, aka Bug ID CSCuh69773. | 2.0% | — |