https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 14:15:41 +0000 https://cve.radiocsirt.org/vuln/bdu:2020-02759 bdu:2020-02759 https://cve.radiocsirt.org/vuln/bdu:2020-02759 https://cve.radiocsirt.org/vuln/certfr-2020-avi-340 certfr-2020-avi-340 https://cve.radiocsirt.org/vuln/certfr-2020-avi-340 https://cve.radiocsirt.org/vuln/cisco-sa-iosxe-webui-rce-uk8bxcud <p>A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with administrative privileges to execute arbitrary code with root privileges on the underlying Linux shell. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by first creating a malicious file on the affected device itself and then uploading a second malicious file to the device. A successful exploit could allow the attacker to execute arbitrary code with root privileges or bypass licensing requirements on the device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-rce-uk8BXcUD [&#34;https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-rce-uk8BXcUD&#34;] This advisory is part of the June 3, 2020, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication, which includes 23 Cisco Security Advisories that describe 25 vulnerabilities. For a complete list of the advisories and links to them, see Cisco Event Response: June 2020 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication [&#34; https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-73388&#34;].</p> <p>A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with administrative privileges to execute arbitrary code with root privileges on the underlying Linux shell. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by first creating a malicious file on the affected device itself and then uploading a second malicious file to the device. A successful exploit could allow the attacker to execute arbitrary code with root privileges or bypass licensing requirements on the device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-rce-uk8BXcUD [&#34;https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-rce-uk8BXcUD&#34;] This advisory is part of the June 3, 2020, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication, which includes 23 Cisco Security Advisories that describe 25 vulnerabilities. For a complete list of the advisories and links to them, see Cisco Event Response: June 2020 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication [&#34; https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-73388&#34;].</p> https://cve.radiocsirt.org/vuln/cisco-sa-iosxe-webui-rce-uk8bxcud https://cve.radiocsirt.org/vuln/cnvd-2020-31970 cnvd-2020-31970 https://cve.radiocsirt.org/vuln/cnvd-2020-31970 https://cve.radiocsirt.org/vuln/euvd-2026-201935 EUVD-2026-201935 https://cve.radiocsirt.org/vuln/euvd-2026-201935 https://cve.radiocsirt.org/vuln/fkie_cve-2020-3218 <p>A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with administrative privileges to execute arbitrary code with root privileges on the underlying Linux shell. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by first creating a malicious file on the affected device itself and then uploading a second malicious file to the device. A successful exploit could allow the attacker to execute arbitrary code with root privileges or bypass licensing requirements on the device.</p> <p>A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with administrative privileges to execute arbitrary code with root privileges on the underlying Linux shell. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by first creating a malicious file on the affected device itself and then uploading a second malicious file to the device. A successful exploit could allow the attacker to execute arbitrary code with root privileges or bypass licensing requirements on the device.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-3218 https://cve.radiocsirt.org/vuln/ghsa-2vmg-wrjc-c333 <p>A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with administrative privileges to execute arbitrary code with root privileges on the underlying Linux shell. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by first creating a malicious file on the affected device itself and then uploading a second malicious file to the device. A successful exploit could allow the attacker to execute arbitrary code with root privileges or bypass licensing requirements on the device.</p> <p>A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with administrative privileges to execute arbitrary code with root privileges on the underlying Linux shell. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by first creating a malicious file on the affected device itself and then uploading a second malicious file to the device. A successful exploit could allow the attacker to execute arbitrary code with root privileges or bypass licensing requirements on the device.</p> https://cve.radiocsirt.org/vuln/ghsa-2vmg-wrjc-c333 https://cve.radiocsirt.org/vuln/gsd-2020-3218 gsd-2020-3218 https://cve.radiocsirt.org/vuln/gsd-2020-3218 https://cve.radiocsirt.org/vuln/icsa-22-300-03 <p>The administrator graphical user interface (GUI) lacks correct handling of RBAC, which may allow a malicious user to send modified HTTP requests to the targeted device. If exploited, a read-only remote attacker could potentially execute commands or configuration changes as the administrator. Due to insufficient validation of user input, this vulnerability could allow a malicious user to inject custom input into the web user interface. If exploited, a remote attacker could potentially execute arbitrary code with administrative privileges on the operating system. A vulnerability in the DNS application layer gateway (ALG) functionality used by Network Address Translation (NAT) in Cisco IOS XE software could allow an unauthenticated, remote attacker to reload an affected device. A vulnerability in the Secure Shell (SSH) server code of Cisco IOS software and Cisco IOS XE software could allow an authenticated, remote attacker to reload an affected device. Due to improper input sanitization, this vulnerability could allow a malicious user with administrative privileges to submit specially crafted input in the web user interface. If exploited, a remote attacker could potentially execute arbitrary commands with root privileges on the operating system. Due to improper validation of user supplied input, a malicious user could potentially create a file on the target device and upload a second malicious file to the device. If exploited, a user could execute arbitrary code with root privi…</p> <p>The administrator graphical user interface (GUI) lacks correct handling of RBAC, which may allow a malicious user to send modified HTTP requests to the targeted device. If exploited, a read-only remote attacker could potentially execute commands or configuration changes as the administrator. Due to insufficient validation of user input, this vulnerability could allow a malicious user to inject custom input into the web user interface. If exploited, a remote attacker could potentially execute arbitrary code with administrative privileges on the operating system. A vulnerability in the DNS application layer gateway (ALG) functionality used by Network Address Translation (NAT) in Cisco IOS XE software could allow an unauthenticated, remote attacker to reload an affected device. A vulnerability in the Secure Shell (SSH) server code of Cisco IOS software and Cisco IOS XE software could allow an authenticated, remote attacker to reload an affected device. Due to improper input sanitization, this vulnerability could allow a malicious user with administrative privileges to submit specially crafted input in the web user interface. If exploited, a remote attacker could potentially execute arbitrary commands with root privileges on the operating system. Due to improper validation of user supplied input, a malicious user could potentially create a file on the target device and upload a second malicious file to the device. If exploited, a user could execute arbitrary code with root privi…</p> https://cve.radiocsirt.org/vuln/icsa-22-300-03