Security Vulnerabilities - CVEs Published In 2020
A vulnerability in Cisco Virtual Wide Area Application Services (vWAAS) with Cisco Enterprise NFV Infrastructure Software (NFVIS)-bundled images for Cisco ENCS 5400-W Series and CSP 5000-W Series appliances could allow an unauthenticated, remote attacker to log into the NFVIS CLI of an affected device by using accounts that have a default, static password. The vulnerability exists because the affected software has user accounts with default, static passwords. An attacker with access to the NFVIS CLI of an affected device could exploit this vulnerability by logging into the CLI. A successful exploit could allow the attacker to access the NFVIS CLI with administrator privileges.
CVSS Score
9.8
EPSS Score
0.014
Published
2020-08-26
Multiple vulnerabilities in the web-based management interface of Cisco DNA Center software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. The vulnerabilities exist because the web-based management interface on an affected device does not properly validate user-supplied input. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVSS Score
4.7
EPSS Score
0.009
Published
2020-08-26
A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to view potentially sensitive information on an affected device. The vulnerability is due to incorrect permissions within Apache configuration. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web-based management interface. A successful exploit could allow the attacker to view potentially sensitive information on the affected device.
CVSS Score
5.3
EPSS Score
0.011
Published
2020-08-26
A vulnerability in the role-based access control (RBAC) functionality of the web management software of Cisco Vision Dynamic Signage Director could allow an authenticated, remote attacker to access resources that they should not be able to access and perform actions that they should not be able to perform. The vulnerability exists because the web management software does not properly handle RBAC. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to view and delete certain screen content on the system that the attacker would not normally have privileges to access.
CVSS Score
6.3
EPSS Score
0.007
Published
2020-08-26
NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) via the module "Shop."
CVSS Score
5.4
EPSS Score
0.005
Published
2020-08-26
NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration."
CVSS Score
5.4
EPSS Score
0.005
Published
2020-08-26
NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Content."
CVSS Score
5.4
EPSS Score
0.005
Published
2020-08-26
NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration."
CVSS Score
5.4
EPSS Score
0.005
Published
2020-08-26
In versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, BIG-IP ASM Configuration utility CSRF protection token can be reused multiple times.
CVSS Score
3.1
EPSS Score
0.002
Published
2020-08-26
An issue was discovered in HiveMQ Broker Control Center 4.3.2. A crafted clientid parameter in an MQTT packet (sent to the Broker) is reflected in the client section of the management console. The attacker's JavaScript is loaded in a browser, which can lead to theft of the session and cookie of the administrator's account of the Broker.
CVSS Score
5.4
EPSS Score
0.005
Published
2020-08-26