alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2021-1325 (published 2021-02-04)
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: cisco
Affected products: rv016_multi-wan_vpn_router, rv016_multi-wan_vpn_router_firmware, rv042_dual_wan_vpn_router, rv042_dual_wan_vpn_router_firmware, rv042g_dual_gigabit_wan_vpn_router, rv042g_dual_gigabit_wan_vpn_router_firmware, rv082_dual_wan_vpn_router, rv082_dual_wan_vpn_router_firmware, rv320_dual_gigabit_wan_vpn_router, rv320_dual_gigabit_wan_vpn_router_firmware, rv325_dual_gigabit_wan_vpn_router, rv325_dual_gigabit_wan_vpn_router_firmware
CVE-2021-1326 (published 2021-02-04)
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: cisco
Affected products: rv016_multi-wan_vpn_router, rv016_multi-wan_vpn_router_firmware, rv042_dual_wan_vpn_router, rv042_dual_wan_vpn_router_firmware, rv042g_dual_gigabit_wan_vpn_router, rv042g_dual_gigabit_wan_vpn_router_firmware, rv082_dual_wan_vpn_router, rv082_dual_wan_vpn_router_firmware, rv320_dual_gigabit_wan_vpn_router, rv320_dual_gigabit_wan_vpn_router_firmware, rv325_dual_gigabit_wan_vpn_router, rv325_dual_gigabit_wan_vpn_router_firmware
CVE-2021-1327 (published 2021-02-04)
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: cisco
Affected products: rv016_multi-wan_vpn_router, rv016_multi-wan_vpn_router_firmware, rv042_dual_wan_vpn_router, rv042_dual_wan_vpn_router_firmware, rv042g_dual_gigabit_wan_vpn_router, rv042g_dual_gigabit_wan_vpn_router_firmware, rv082_dual_wan_vpn_router, rv082_dual_wan_vpn_router_firmware, rv320_dual_gigabit_wan_vpn_router, rv320_dual_gigabit_wan_vpn_router_firmware, rv325_dual_gigabit_wan_vpn_router, rv325_dual_gigabit_wan_vpn_router_firmware
CVE-2021-1328 (published 2021-02-04)
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: cisco
Affected products: rv016_multi-wan_vpn_router, rv016_multi-wan_vpn_router_firmware, rv042_dual_wan_vpn_router, rv042_dual_wan_vpn_router_firmware, rv042g_dual_gigabit_wan_vpn_router, rv042g_dual_gigabit_wan_vpn_router_firmware, rv082_dual_wan_vpn_router, rv082_dual_wan_vpn_router_firmware, rv320_dual_gigabit_wan_vpn_router, rv320_dual_gigabit_wan_vpn_router_firmware, rv325_dual_gigabit_wan_vpn_router, rv325_dual_gigabit_wan_vpn_router_firmware
CVE-2021-1329 (published 2021-02-04)
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: cisco
Affected products: rv016_multi-wan_vpn_router, rv016_multi-wan_vpn_router_firmware, rv042_dual_wan_vpn_router, rv042_dual_wan_vpn_router_firmware, rv042g_dual_gigabit_wan_vpn_router, rv042g_dual_gigabit_wan_vpn_router_firmware, rv082_dual_wan_vpn_router, rv082_dual_wan_vpn_router_firmware, rv320_dual_gigabit_wan_vpn_router, rv320_dual_gigabit_wan_vpn_router_firmware, rv325_dual_gigabit_wan_vpn_router, rv325_dual_gigabit_wan_vpn_router_firmware
CVE-2021-1330 (published 2021-02-04)
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: cisco
Affected products: rv016_multi-wan_vpn_router, rv016_multi-wan_vpn_router_firmware, rv042_dual_wan_vpn_router, rv042_dual_wan_vpn_router_firmware, rv042g_dual_gigabit_wan_vpn_router, rv042g_dual_gigabit_wan_vpn_router_firmware, rv082_dual_wan_vpn_router, rv082_dual_wan_vpn_router_firmware, rv320_dual_gigabit_wan_vpn_router, rv320_dual_gigabit_wan_vpn_router_firmware, rv325_dual_gigabit_wan_vpn_router, rv325_dual_gigabit_wan_vpn_router_firmware
CVE-2021-1331 (published 2021-02-04)
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: cisco
Affected products: rv016_multi-wan_vpn_router, rv016_multi-wan_vpn_router_firmware, rv042_dual_wan_vpn_router, rv042_dual_wan_vpn_router_firmware, rv042g_dual_gigabit_wan_vpn_router, rv042g_dual_gigabit_wan_vpn_router_firmware, rv082_dual_wan_vpn_router, rv082_dual_wan_vpn_router_firmware, rv320_dual_gigabit_wan_vpn_router, rv320_dual_gigabit_wan_vpn_router_firmware, rv325_dual_gigabit_wan_vpn_router, rv325_dual_gigabit_wan_vpn_router_firmware
CVE-2021-1332 (published 2021-02-04)
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: cisco
Affected products: rv016_multi-wan_vpn_router, rv016_multi-wan_vpn_router_firmware, rv042_dual_wan_vpn_router, rv042_dual_wan_vpn_router_firmware, rv042g_dual_gigabit_wan_vpn_router, rv042g_dual_gigabit_wan_vpn_router_firmware, rv082_dual_wan_vpn_router, rv082_dual_wan_vpn_router_firmware, rv320_dual_gigabit_wan_vpn_router, rv320_dual_gigabit_wan_vpn_router_firmware, rv325_dual_gigabit_wan_vpn_router, rv325_dual_gigabit_wan_vpn_router_firmware
CVE-2021-1333 (published 2021-02-04)
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: cisco
Affected products: rv016_multi-wan_vpn_router, rv016_multi-wan_vpn_router_firmware, rv042_dual_wan_vpn_router, rv042_dual_wan_vpn_router_firmware, rv042g_dual_gigabit_wan_vpn_router, rv042g_dual_gigabit_wan_vpn_router_firmware, rv082_dual_wan_vpn_router, rv082_dual_wan_vpn_router_firmware, rv320_dual_gigabit_wan_vpn_router, rv320_dual_gigabit_wan_vpn_router_firmware, rv325_dual_gigabit_wan_vpn_router, rv325_dual_gigabit_wan_vpn_router_firmware
CVE-2021-1334 (published 2021-02-04)
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: cisco
Affected products: rv016_multi-wan_vpn_router, rv016_multi-wan_vpn_router_firmware, rv042_dual_wan_vpn_router, rv042_dual_wan_vpn_router_firmware, rv042g_dual_gigabit_wan_vpn_router, rv042g_dual_gigabit_wan_vpn_router_firmware, rv082_dual_wan_vpn_router, rv082_dual_wan_vpn_router_firmware, rv320_dual_gigabit_wan_vpn_router, rv320_dual_gigabit_wan_vpn_router_firmware, rv325_dual_gigabit_wan_vpn_router, rv325_dual_gigabit_wan_vpn_router_firmware
CVE-2021-1335 (published 2021-02-04)
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: cisco
Affected products: rv016_multi-wan_vpn_router, rv016_multi-wan_vpn_router_firmware, rv042_dual_wan_vpn_router, rv042_dual_wan_vpn_router_firmware, rv042g_dual_gigabit_wan_vpn_router, rv042g_dual_gigabit_wan_vpn_router_firmware, rv082_dual_wan_vpn_router, rv082_dual_wan_vpn_router_firmware, rv320_dual_gigabit_wan_vpn_router, rv320_dual_gigabit_wan_vpn_router_firmware, rv325_dual_gigabit_wan_vpn_router, rv325_dual_gigabit_wan_vpn_router_firmware
CVE-2021-1336 (published 2021-02-04)
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: cisco
Affected products: rv016_multi-wan_vpn_router, rv016_multi-wan_vpn_router_firmware, rv042_dual_wan_vpn_router, rv042_dual_wan_vpn_router_firmware, rv042g_dual_gigabit_wan_vpn_router, rv042g_dual_gigabit_wan_vpn_router_firmware, rv082_dual_wan_vpn_router, rv082_dual_wan_vpn_router_firmware, rv320_dual_gigabit_wan_vpn_router, rv320_dual_gigabit_wan_vpn_router_firmware, rv325_dual_gigabit_wan_vpn_router, rv325_dual_gigabit_wan_vpn_router_firmware
CVE-2021-1337 (published 2021-02-04)
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: cisco
Affected products: rv016_multi-wan_vpn_router, rv016_multi-wan_vpn_router_firmware, rv042_dual_wan_vpn_router, rv042_dual_wan_vpn_router_firmware, rv042g_dual_gigabit_wan_vpn_router, rv042g_dual_gigabit_wan_vpn_router_firmware, rv082_dual_wan_vpn_router, rv082_dual_wan_vpn_router_firmware, rv320_dual_gigabit_wan_vpn_router, rv320_dual_gigabit_wan_vpn_router_firmware, rv325_dual_gigabit_wan_vpn_router, rv325_dual_gigabit_wan_vpn_router_firmware
CVE-2021-1338 (published 2021-02-04)
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: cisco
Affected products: rv016_multi-wan_vpn_router, rv016_multi-wan_vpn_router_firmware, rv042_dual_wan_vpn_router, rv042_dual_wan_vpn_router_firmware, rv042g_dual_gigabit_wan_vpn_router, rv042g_dual_gigabit_wan_vpn_router_firmware, rv082_dual_wan_vpn_router, rv082_dual_wan_vpn_router_firmware, rv320_dual_gigabit_wan_vpn_router, rv320_dual_gigabit_wan_vpn_router_firmware, rv325_dual_gigabit_wan_vpn_router, rv325_dual_gigabit_wan_vpn_router_firmware
CVE-2021-1339 (published 2021-02-04)
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: cisco
Affected products: rv016_multi-wan_vpn_router, rv016_multi-wan_vpn_router_firmware, rv042_dual_wan_vpn_router, rv042_dual_wan_vpn_router_firmware, rv042g_dual_gigabit_wan_vpn_router, rv042g_dual_gigabit_wan_vpn_router_firmware, rv082_dual_wan_vpn_router, rv082_dual_wan_vpn_router_firmware, rv320_dual_gigabit_wan_vpn_router, rv320_dual_gigabit_wan_vpn_router_firmware, rv325_dual_gigabit_wan_vpn_router, rv325_dual_gigabit_wan_vpn_router_firmware
CVE-2021-1340 (published 2021-02-04)
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: cisco
Affected products: rv016_multi-wan_vpn_router, rv016_multi-wan_vpn_router_firmware, rv042_dual_wan_vpn_router, rv042_dual_wan_vpn_router_firmware, rv042g_dual_gigabit_wan_vpn_router, rv042g_dual_gigabit_wan_vpn_router_firmware, rv082_dual_wan_vpn_router, rv082_dual_wan_vpn_router_firmware, rv320_dual_gigabit_wan_vpn_router, rv320_dual_gigabit_wan_vpn_router_firmware, rv325_dual_gigabit_wan_vpn_router, rv325_dual_gigabit_wan_vpn_router_firmware
CVE-2021-1341 (published 2021-02-04)
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: cisco
Affected products: rv016_multi-wan_vpn_router, rv016_multi-wan_vpn_router_firmware, rv042_dual_wan_vpn_router, rv042_dual_wan_vpn_router_firmware, rv042g_dual_gigabit_wan_vpn_router, rv042g_dual_gigabit_wan_vpn_router_firmware, rv082_dual_wan_vpn_router, rv082_dual_wan_vpn_router_firmware, rv320_dual_gigabit_wan_vpn_router, rv320_dual_gigabit_wan_vpn_router_firmware, rv325_dual_gigabit_wan_vpn_router, rv325_dual_gigabit_wan_vpn_router_firmware
CVE-2021-1342 (published 2021-02-04)
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: cisco
Affected products: rv016_multi-wan_vpn_router, rv016_multi-wan_vpn_router_firmware, rv042_dual_wan_vpn_router, rv042_dual_wan_vpn_router_firmware, rv042g_dual_gigabit_wan_vpn_router, rv042g_dual_gigabit_wan_vpn_router_firmware, rv082_dual_wan_vpn_router, rv082_dual_wan_vpn_router_firmware, rv320_dual_gigabit_wan_vpn_router, rv320_dual_gigabit_wan_vpn_router_firmware, rv325_dual_gigabit_wan_vpn_router, rv325_dual_gigabit_wan_vpn_router_firmware
CVE-2021-1343 (published 2021-02-04)
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: cisco
Affected products: rv016_multi-wan_vpn_router, rv016_multi-wan_vpn_router_firmware, rv042_dual_wan_vpn_router, rv042_dual_wan_vpn_router_firmware, rv042g_dual_gigabit_wan_vpn_router, rv042g_dual_gigabit_wan_vpn_router_firmware, rv082_dual_wan_vpn_router, rv082_dual_wan_vpn_router_firmware, rv320_dual_gigabit_wan_vpn_router, rv320_dual_gigabit_wan_vpn_router_firmware, rv325_dual_gigabit_wan_vpn_router, rv325_dual_gigabit_wan_vpn_router_firmware
CVE-2021-1344 (published 2021-02-04)
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: cisco
Affected products: rv016_multi-wan_vpn_router, rv016_multi-wan_vpn_router_firmware, rv042_dual_wan_vpn_router, rv042_dual_wan_vpn_router_firmware, rv042g_dual_gigabit_wan_vpn_router, rv042g_dual_gigabit_wan_vpn_router_firmware, rv082_dual_wan_vpn_router, rv082_dual_wan_vpn_router_firmware, rv320_dual_gigabit_wan_vpn_router, rv320_dual_gigabit_wan_vpn_router_firmware, rv325_dual_gigabit_wan_vpn_router, rv325_dual_gigabit_wan_vpn_router_firmware
CVE-2021-1345 (published 2021-02-04)
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: cisco
Affected products: rv016_multi-wan_vpn_router, rv016_multi-wan_vpn_router_firmware, rv042_dual_wan_vpn_router, rv042_dual_wan_vpn_router_firmware, rv042g_dual_gigabit_wan_vpn_router, rv042g_dual_gigabit_wan_vpn_router_firmware, rv082_dual_wan_vpn_router, rv082_dual_wan_vpn_router_firmware, rv320_dual_gigabit_wan_vpn_router, rv320_dual_gigabit_wan_vpn_router_firmware, rv325_dual_gigabit_wan_vpn_router, rv325_dual_gigabit_wan_vpn_router_firmware
CVE-2021-1346 (published 2021-02-04)
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: cisco
Affected products: rv016_multi-wan_vpn_router, rv016_multi-wan_vpn_router_firmware, rv042_dual_wan_vpn_router, rv042_dual_wan_vpn_router_firmware, rv042g_dual_gigabit_wan_vpn_router, rv042g_dual_gigabit_wan_vpn_router_firmware, rv082_dual_wan_vpn_router, rv082_dual_wan_vpn_router_firmware, rv320_dual_gigabit_wan_vpn_router, rv320_dual_gigabit_wan_vpn_router_firmware, rv325_dual_gigabit_wan_vpn_router, rv325_dual_gigabit_wan_vpn_router_firmware
CVE-2021-1347 (published 2021-02-04)
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: cisco
Affected products: rv016_multi-wan_vpn_router, rv016_multi-wan_vpn_router_firmware, rv042_dual_wan_vpn_router, rv042_dual_wan_vpn_router_firmware, rv042g_dual_gigabit_wan_vpn_router, rv042g_dual_gigabit_wan_vpn_router_firmware, rv082_dual_wan_vpn_router, rv082_dual_wan_vpn_router_firmware, rv320_dual_gigabit_wan_vpn_router, rv320_dual_gigabit_wan_vpn_router_firmware, rv325_dual_gigabit_wan_vpn_router, rv325_dual_gigabit_wan_vpn_router_firmware
CVE-2021-1348 (published 2021-02-04)
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: cisco
Affected products: rv016_multi-wan_vpn_router, rv016_multi-wan_vpn_router_firmware, rv042_dual_wan_vpn_router, rv042_dual_wan_vpn_router_firmware, rv042g_dual_gigabit_wan_vpn_router, rv042g_dual_gigabit_wan_vpn_router_firmware, rv082_dual_wan_vpn_router, rv082_dual_wan_vpn_router_firmware, rv320_dual_gigabit_wan_vpn_router, rv320_dual_gigabit_wan_vpn_router_firmware, rv325_dual_gigabit_wan_vpn_router, rv325_dual_gigabit_wan_vpn_router_firmware
CVE-2021-1349 (published 2021-01-20)
A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct Cypher query language injection attacks on an affected system. The vulnerability is due to insufficient input validation by the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to the interface of an affected system. A successful exploit could allow the attacker to obtain sensitive information.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-943
Affected vendors: cisco
Affected products: sd-wan_vmanage
CVE-2021-1350 (published 2021-01-20)
A vulnerability in the web UI of Cisco Umbrella could allow an unauthenticated, remote attacker to negatively affect the performance of this service. The vulnerability exists due to insufficient rate limiting controls in the web UI. An attacker could exploit this vulnerability by sending crafted HTTPS packets at a high and sustained rate. A successful exploit could allow the attacker to negatively affect the performance of the web UI. Cisco has addressed this vulnerability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Weakness: CWE-770
Affected vendors: cisco
Affected products: umbrella
CVE-2021-1351 (published 2021-02-17)
A vulnerability in the web-based interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface of the affected service. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface of the affected service. An attacker could exploit this vulnerability by persuading a user of the interface to click a maliciously crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-80
Affected vendors: cisco
Affected products: webex_meetings
CVE-2021-1352 (published 2021-03-24)
A vulnerability in the DECnet Phase IV and DECnet/OSI protocol processing of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation of DECnet traffic that is received by an affected device. An attacker could exploit this vulnerability by sending DECnet traffic to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-823
Affected vendors: cisco
Affected products: ios_xe
CVE-2021-1353 (published 2021-01-20)
A vulnerability in the IPv4 protocol handling of Cisco StarOS could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a memory leak that occurs during packet processing. An attacker could exploit this vulnerability by sending a series of crafted IPv4 packets through an affected device. A successful exploit could allow the attacker to exhaust the available memory and cause an unexpected restart of the npusim process, leading to a DoS condition on the affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
Weakness: CWE-401
Affected vendors: cisco
Affected products: asr_5000, asr_5500, asr_5700, staros, virtualized_packet_core-single_instance
CVE-2021-1354 (published 2021-02-04)
A vulnerability in the certificate registration process of Cisco Unified Computing System (UCS) Central Software could allow an authenticated, adjacent attacker to register a rogue Cisco Unified Computing System Manager (UCSM). This vulnerability is due to improper certificate validation. An attacker could exploit this vulnerability by sending a crafted HTTP request to the registration API. A successful exploit could allow the attacker to register a rogue Cisco UCSM and gain access to Cisco UCS Central Software data and Cisco UCSM inventory data.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-295
Affected vendors: cisco
Affected products: unified_computing_system_central_software
CVE-2021-1355 (published 2021-01-20)
Multiple vulnerabilities in Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P) could allow an attacker to conduct path traversal attacks and SQL injection attacks on an affected system. One of the SQL injection vulnerabilities that affects Unified CM IM&amp;P also affects Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) and could allow an attacker to conduct SQL injection attacks on an affected system. For more information about these vulnerabilities, see the Details section of this advisory.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-35
Affected vendors: cisco
Affected products: unified_communications_manager, unified_communications_manager_im_and_presence_service
CVE-2021-1356 (published 2021-03-24)
Multiple vulnerabilities in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to cause the web UI software to become unresponsive and consume vty line instances, resulting in a denial of service (DoS) condition. These vulnerabilities are due to insufficient error handling in the web UI. An attacker could exploit these vulnerabilities by sending crafted HTTP packets to an affected device. A successful exploit could allow the attacker to cause the web UI software to become unresponsive and consume all available vty lines, preventing new session establishment and resulting in a DoS condition. Manual intervention would be required to regain web UI and vty session functionality. Note: These vulnerabilities do not affect the console connection.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Weakness: CWE-20
Affected vendors: cisco
Affected products: ios_xe
CVE-2021-1357 (published 2021-01-20)
Multiple vulnerabilities in Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P) could allow an attacker to conduct path traversal attacks and SQL injection attacks on an affected system. One of the SQL injection vulnerabilities that affects Unified CM IM&amp;P also affects Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) and could allow an attacker to conduct SQL injection attacks on an affected system. For more information about these vulnerabilities, see the Details section of this advisory.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-35
Affected vendors: cisco
Affected products: unified_communications_manager, unified_communications_manager_im_and_presence_service
CVE-2021-1358 (published 2021-05-22)
A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to redirect a user to an undesired web page. This vulnerability is due to improper input validation of the URL parameters in an HTTP request that is sent to an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to cause the interface to redirect the user to a specific, malicious URL. This type of vulnerability is known as an open redirect and is used in phishing attacks that get users to unknowingly visit malicious sites.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-601
Affected vendors: cisco
Affected products: finesse
CVE-2021-1359 (published 2021-07-08)
A vulnerability in the configuration management of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to perform command injection and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied XML input for the web interface. An attacker could exploit this vulnerability by uploading crafted XML configuration files that contain scripting code to a vulnerable device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root. An attacker would need a valid user account with the rights to upload configuration files to exploit this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-112
Affected vendors: cisco
Affected products: asyncos, web_security_appliance
CVE-2021-1360 (published 2021-01-13)
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. The vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device. Cisco has not released software updates that address these vulnerabilities.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: cisco
Affected products: rv110w, rv110w_firmware, rv130, rv130_firmware, rv130w, rv130w_firmware, rv215w, rv215w_firmware
CVE-2021-1361 (published 2021-02-24)
A vulnerability in the implementation of an internal file management service for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode that are running Cisco NX-OS Software could allow an unauthenticated, remote attacker to create, delete, or overwrite arbitrary files with root privileges on the device. This vulnerability exists because TCP port 9075 is incorrectly configured to listen and respond to external connection requests. An attacker could exploit this vulnerability by sending crafted TCP packets to an IP address that is configured on a local interface on TCP port 9075. A successful exploit could allow the attacker to create, delete, or overwrite arbitrary files, including sensitive files that are related to the device configuration. For example, the attacker could add a user account without the device administrator knowing.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-552
Affected vendors: cisco
Affected products: nexus_3000, nexus_3100, nexus_3100-z, nexus_3100v, nexus_3200, nexus_3400, nexus_3500, nexus_3600, nexus_9000v, nexus_92160yc-x, nexus_92300yc, nexus_92304qc, nexus_92348gc-x, nexus_9236c, nexus_9272q, nexus_93108tc-ex, nexus_93108tc-ex-24, nexus_93108tc-fx, nexus_93108tc-fx-24, nexus_93120tx, nexus_93128tx, nexus_9316d-gx, nexus_93180lc-ex, nexus_93180yc-ex, nexus_93180yc-ex-24
CVE-2021-1362 (published 2021-04-08)
A vulnerability in the SOAP API endpoint of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM &amp; Presence Service, Cisco Unity Connection, and Cisco Prime License Manager could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper sanitization of user-supplied input. An attacker could exploit this vulnerability by sending a SOAP API request with crafted parameters to an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges on the underlying Linux operating system of the affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: cisco
Affected products: prime_license_manager, unified_communications_manager, unified_communications_manager_im_\&_presence_service, unity_connection
CVE-2021-1363 (published 2021-05-06)
Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager IM &amp; Presence Service could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. These vulnerabilities are due to improper validation of user-submitted parameters. An attacker could exploit these vulnerabilities by authenticating to the application and sending malicious requests to an affected system. A successful exploit could allow the attacker to obtain data or modify data that is stored in the underlying database.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-89
Affected vendors: cisco
Affected products: unified_communications_manager_im_and_presence_service
CVE-2021-1364 (published 2021-01-20)
Multiple vulnerabilities in Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P) could allow an attacker to conduct path traversal attacks and SQL injection attacks on an affected system. One of the SQL injection vulnerabilities that affects Unified CM IM&amp;P also affects Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) and could allow an attacker to conduct SQL injection attacks on an affected system. For more information about these vulnerabilities, see the Details section of this advisory.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-35
Affected vendors: cisco
Affected products: unified_communications_manager, unified_communications_manager_im_and_presence_service