Cisco
Cisco Identity Services Engine Software: vulnerabilidades y CVE
Cisco Identity Services Engine Software tiene 49 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE49
Últimos 12 meses0
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2019-15282 | Media (5.3) | 1.2% | — | 16 oct 2019 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an unauthenticated, remote attacker read tcpdump files generated on an affected device. The… |
| CVE-2019-15281 | Media (4.8) | 0.62% | — | 16 oct 2019 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user… |
| CVE-2018-15463 | Media (6.1) | 1.2% | — | 15 ene 2019 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of… |
| CVE-2018-15440 | Media (6.1) | 1.3% | — | 15 ene 2019 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the… |
| CVE-2018-0413 | Alta (8.8) | 1.2% | — | 1 ago 2018 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary… |
| CVE-2018-0339 | Media (6.1) | 1.8% | — | 7 jun 2018 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the… |
| CVE-2018-0327 | Media (6.1) | 1.7% | — | 17 may 2018 | A vulnerability in the web framework of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an… |
| CVE-2018-0289 | Media (6.1) | 1.7% | — | 17 may 2018 | A vulnerability in the logs component of Cisco Identity Services Engine could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability is due to improper validation of… |
| CVE-2017-12316 | Alta (7.5) | 2.0% | — | 16 nov 2017 | A vulnerability in the Guest Portal login page of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to perform multiple login attempts in excess of the configured login attempt limit.… |
| CVE-2017-3835 | Alta (8.8) | 1.8% | — | 22 feb 2017 | A vulnerability in the sponsor portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access notices owned by other users, because of SQL Injection. More Information: CSCvb15627.… |
| CVE-2016-9214 | Media (6.1) | 1.8% | — | 14 dic 2016 | Cisco Identity Services Engine (ISE) contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of the affected… |
| CVE-2016-1485 | Media (6.1) | 1.4% | — | 22 ago 2016 | Cross-site scripting (XSS) vulnerability in Cisco Identity Services Engine 1.3(0.876) allows remote attackers to inject arbitrary web script or HTML via crafted parameters, aka Bug ID CSCva46497. |
| CVE-2016-1402 | Alta (7.5) | 2.0% | — | 21 may 2016 | The Active Directory (AD) integration component in Cisco Identity Service Engine (ISE) before 1.2.0.899 patch 7, when AD group-membership authorization is enabled, allows remote attackers to cause a denial of service… |
| CVE-2015-6317 | Media (6.5) | 1.5% | — | 23 ene 2016 | Cisco Identity Services Engine (ISE) before 2.0 allows remote authenticated users to bypass intended web-resource access restrictions via a direct request, aka Bug ID CSCuu45926. |
| CVE-2015-6323 | Crítica (9.8) | 3.0% | — | 15 ene 2016 | The Admin portal in Cisco Identity Services Engine (ISE) 1.1.x, 1.2.0 before patch 17, 1.2.1 before patch 8, 1.3 before patch 5, and 1.4 before patch 4 allows remote attackers to obtain administrative access via… |
| CVE-2015-6266 | Media (5) | 1.6% | — | 28 ago 2015 | The guest portal in Cisco Identity Services Engine (ISE) 3300 1.2(0.899) does not restrict access to uploaded HTML documents, which allows remote attackers to obtain sensitive information from customized documents via a… |
| CVE-2015-4266 | Media (4.3) | 1.2% | — | 16 jul 2015 | The web interface in Cisco Identity Services Engine (ISE) 1.1(4.1), 1.3(106.146), and 1.3(120.135) does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking… |
| CVE-2015-4267 | Media (6.8) | 1.00% | — | 15 jul 2015 | Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2(0.793), 1.3(0.876), 1.4(0.109), 2.0(0.147), and 2.0(0.169) allows remote attackers to hijack the… |
| CVE-2015-4268 | Media (4.3) | 1.5% | — | 14 jul 2015 | Multiple cross-site scripting (XSS) vulnerabilities in the Infra Admin UI in Cisco Identity Services Engine (ISE) 1.2(1.198) and 1.3(0.876) allow remote attackers to inject arbitrary web script or HTML via unspecified… |
| CVE-2015-4219 | Media (4) | 2.1% | — | 24 jun 2015 | Cisco Secure Access Control System before 5.4(0.46.2) and 5.5 before 5.5(0.46) and Cisco Identity Services Engine 1.0(4.573) do not properly implement access control for support bundles, which allows remote… |
| CVE-2015-4182 | Media (5.5) | 2.1% | — | 12 jun 2015 | The administrative web interface in Cisco Identity Services Engine (ISE) before 1.3 allows remote authenticated users to bypass intended access restrictions, and obtain sensitive information or change settings, via… |
| CVE-2015-0757 | Media (5) | 2.5% | — | 29 may 2015 | The web framework in Cisco Identity Services Engine (ISE) 1.2(1.901) and 1.3(0.722) does not properly implement session handlers, which allows remote attackers to obtain sensitive information by reading web pages, as… |
| CVE-2014-8022 | Media (4.3) | 1.8% | — | 15 ene 2015 | Multiple cross-site scripting (XSS) vulnerabilities in Cisco Identity Services Engine allow remote attackers to inject arbitrary web script or HTML via input to unspecified web pages, aka Bug IDs CSCur69835 and… |
| CVE-2014-8017 | Media (5) | 1.2% | — | 22 dic 2014 | The periodic-backup feature in Cisco Identity Services Engine (ISE) allows remote attackers to discover backup-encryption passwords via a crafted request that triggers inclusion of a password in a reply, aka Bug ID… |
| CVE-2014-8015 | Media (4) | 1.2% | — | 22 dic 2014 | The Sponsor Portal in Cisco Identity Services Engine (ISE) allows remote authenticated users to obtain access to an arbitrary sponsor's guest account via a modified HTTP request, aka Bug ID CSCur64400. |
| CVE-2014-3276 | Media (4) | 2.2% | — | 26 may 2014 | Cisco Identity Services Engine (ISE) 1.2(.1 patch 2) and earlier does not properly handle deadlock conditions during reception of crafted RADIUS accounting packets from multiple NAS devices, which allows remote… |
| CVE-2014-3275 | Media (6.5) | 1.6% | — | 26 may 2014 | SQL injection vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2(.1 patch 2) and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID… |
| CVE-2014-0681 | Media (4.3) | 1.4% | — | 29 ene 2014 | Cross-site scripting (XSS) vulnerability in Cisco Identity Services Engine (ISE) 1.2 patch 2 and earlier allows remote attackers to inject arbitrary web script or HTML via a report containing a crafted URL that is not… |
| CVE-2014-0665 | Media (4) | 1.4% | — | 15 ene 2014 | The RBAC implementation in Cisco Identity Services Engine (ISE) Software does not properly verify privileges for support-bundle downloads, which allows remote authenticated users to obtain sensitive information via a… |
| CVE-2013-5531 | Media (5) | 1.3% | — | 25 oct 2013 | Cisco Identity Services Engine (ISE) 1.x before 1.1.1 allows remote attackers to bypass authentication, and read support-bundle configuration and credentials data, via a crafted session on TCP port 443, aka Bug ID… |