IS
Product
Identity Services Engine Software
50
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 4Medium 11Low 0
Watch
Add Identity Services Engine Software to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2015-6323 | 9.8 | Jan 15 | The Admin portal in Cisco Identity Services Engine (ISE) 1.1.x, 1.2.0 before patch 17, 1.2.1 before patch 8, 1.3 before patch 5, and 1.4 before patch 4 allows remote attackers to… Affected: 1.1.1; 1.1.1; 1.1.1; 1.1.1; 1.1.1; 1.1.1; +34 more |
| CVE-2018-0413 | 8.8 | Aug 1 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request… Affected: 2.0(0.901); 2.1(0.188); 2.2(0.231); 2.4(0.183) |
| CVE-2017-3835 | 8.8 | Feb 22 | A vulnerability in the sponsor portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access notices owned by other users, because of SQL… Affected: 1.4(0.908) |
| CVE-2017-12316 | 7.5 | Nov 16 | A vulnerability in the Guest Portal login page of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to perform multiple login attempts in excess… Affected: 2.1(0.229) |
| CVE-2016-1402 | 7.5 | May 21 | The Active Directory (AD) integration component in Cisco Identity Service Engine (ISE) before 1.2.0.899 patch 7, when AD group-membership authorization is enabled, allows remote… Affected: 1.2.0.899; 1.2.0.899; 1.2.0.899; 1.2.0.899; 1.2.0.899; 1.2.0.899 |
| CVE-2024-20469 | 6.7 | Sep 4 | Cisco Identity Services Engine Command Injection Vulnerability Affected: 3.2.0; 3.2.0p1; 3.2.0p2; 3.2.0p3; 3.2.0p4; 3.2.0p5; +5 more |
| CVE-2015-6317 | 6.5 | Jan 23 | Cisco Identity Services Engine (ISE) before 2.0 allows remote authenticated users to bypass intended web-resource access restrictions via a direct request, aka Bug ID CSCuu45926 Affected: 1.0.4.573; 1.0_base; 1.0_mr_base; 1.1.1; 1.1.1; 1.1.1; +34 more |
| CVE-2018-15463 | 6.1 | Jan 15 | Cisco Identity Services Engine Multiple Cross-Site Scripting Vulnerabilities Affected: 2.4(0.357) |
| CVE-2018-15440 | 6.1 | Jan 15 | Cisco Identity Services Engine Multiple Cross-Site Scripting Vulnerabilities Affected: 2.4(0.357) |
| CVE-2018-0339 | 6.1 | Jun 7 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site scripting… Affected: 2.3(0.298); 2.4(0.126) |
| CVE-2018-0327 | 6.1 | May 17 | A vulnerability in the web framework of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against… Affected: 2.1(0.905) |
| CVE-2018-0289 | 6.1 | May 17 | A vulnerability in the logs component of Cisco Identity Services Engine could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks Affected: 2.3(0.298); 2.4(0.223) |
| CVE-2016-9214 | 6.1 | Dec 14 | Cisco Identity Services Engine (ISE) contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user… Affected: 2.0(1.130) |
| CVE-2016-1485 | 6.1 | Aug 22 | Cross-site scripting (XSS) vulnerability in Cisco Identity Services Engine 1.3(0.876) allows remote attackers to inject arbitrary web script or HTML via crafted parameters, aka… Affected: 1.3(0.876) |
| CVE-2019-15282 | 5.3 | Oct 16 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an unauthenticated, remote attacker read tcpdump files generated… Affected: before 2.4\(0.357\); 2.4(0.357); 2.4(0.357); 2.4(0.357); 2.4(0.357); 2.4(0.357); +5 more |
| CVE-2019-15281 | 4.8 | Oct 16 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to conduct a stored cross-site… Affected: before 2.4\(0.357\); 2.4(0.357); 2.4(0.357); 2.4(0.357); 2.4(0.357); 2.4(0.357); +5 more |
| CVE-2015-6266 | – | Aug 28 | The guest portal in Cisco Identity Services Engine (ISE) 3300 1.2(0.899) does not restrict access to uploaded HTML documents, which allows remote attackers to obtain sensitive… Affected: 1.2(0.899) |
| CVE-2015-4266 | – | Jul 16 | The web interface in Cisco Identity Services Engine (ISE) 1.1(4.1), 1.3(106.146), and 1.3(120.135) does not properly restrict use of IFRAME elements, which makes it easier for… Affected: 1.1(4.1); 1.3(106.146); 1.3(120.135) |
| CVE-2015-4267 | – | Jul 15 | Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2(0.793), 1.3(0.876), 1.4(0.109), 2.0(0.147), and 2.0(0.169) allows… Affected: 1.2(0.793); 1.3(0.876); 1.4(0.181); 1.4(0.876); 2.0(0.147); 2.0(0.169) |
| CVE-2015-4268 | – | Jul 14 | Multiple cross-site scripting (XSS) vulnerabilities in the Infra Admin UI in Cisco Identity Services Engine (ISE) 1.2(1.198) and 1.3(0.876) allow remote attackers to inject… Affected: 1.2(1.198); 1.3(0.876) |
| CVE-2015-4219 | – | Jun 24 | Cisco Secure Access Control System before 5.4(0.46.2) and 5.5 before 5.5(0.46) and Cisco Identity Services Engine 1.0(4.573) do not properly implement access control for support… Affected: 1.0.4.573 |
| CVE-2015-4182 | – | Jun 12 | The administrative web interface in Cisco Identity Services Engine (ISE) before 1.3 allows remote authenticated users to bypass intended access restrictions, and obtain sensitive… Affected: 1.0.4.573; 1.0_base; 1.1; 1.2; 1.2(0.747); 1.2(0.899); +3 more |
| CVE-2015-0757 | – | May 29 | The web framework in Cisco Identity Services Engine (ISE) 1.2(1.901) and 1.3(0.722) does not properly implement session handlers, which allows remote attackers to obtain sensitive… Affected: 1.2(1.901); 1.3(0.722) |
| CVE-2014-8022 | – | Jan 15 | Multiple cross-site scripting (XSS) vulnerabilities in Cisco Identity Services Engine allow remote attackers to inject arbitrary web script or HTML via input to unspecified web… Affected: All versions, or not specified |
| CVE-2014-8017 | – | Dec 22 | The periodic-backup feature in Cisco Identity Services Engine (ISE) allows remote attackers to discover backup-encryption passwords via a crafted request that triggers inclusion… Affected: All versions, or not specified |
| CVE-2014-8015 | – | Dec 22 | The Sponsor Portal in Cisco Identity Services Engine (ISE) allows remote authenticated users to obtain access to an arbitrary sponsor's guest account via a modified HTTP request,… Affected: All versions, or not specified |
| CVE-2014-3276 | – | May 26 | Cisco Identity Services Engine (ISE) 1.2(.1 patch 2) and earlier does not properly handle deadlock conditions during reception of crafted RADIUS accounting packets from multiple… Affected: through 1.2; 1.0; 1.1 |
| CVE-2014-3275 | – | May 26 | SQL injection vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2(.1 patch 2) and earlier allows remote authenticated users to execute arbitrary SQL… Affected: through 1.2; 1.0; 1.1 |
| CVE-2014-0681 | – | Jan 29 | Cross-site scripting (XSS) vulnerability in Cisco Identity Services Engine (ISE) 1.2 patch 2 and earlier allows remote attackers to inject arbitrary web script or HTML via a… Affected: through 1.2 |
| CVE-2014-0665 | – | Jan 15 | The RBAC implementation in Cisco Identity Services Engine (ISE) Software does not properly verify privileges for support-bundle downloads, which allows remote authenticated users… Affected: All versions, or not specified |
| CVE-2013-5531 | – | Oct 25 | Cisco Identity Services Engine (ISE) 1.x before 1.1.1 allows remote attackers to bypass authentication, and read support-bundle configuration and credentials data, via a crafted… Affected: 1.0; 1.1 |
| CVE-2013-5530 | – | Oct 25 | The web framework in Cisco Identity Services Engine (ISE) 1.0 and 1.1.0 before 1.1.0.665-5, 1.1.1 before 1.1.1.268-7, 1.1.2 before 1.1.2.145-10, 1.1.3 before 1.1.3.124-7, 1.1.4… Affected: 1.0; 1.1; 1.1.1; 1.1.2; 1.1.3; 1.1.4; +1 more |
| CVE-2013-5521 | – | Oct 25 | Cisco Identity Services Engine does not properly restrict the creation of guest accounts, which allows remote attackers to cause a denial of service (exhaustion of the account… Affected: All versions, or not specified |
| CVE-2013-5541 | – | Oct 16 | Cross-site scripting (XSS) vulnerability in the file-upload interface in Cisco Identity Services Engine (ISE) allows remote authenticated users to inject arbitrary web script or… Affected: All versions, or not specified |
| CVE-2013-5540 | – | Oct 16 | The file-upload feature in Cisco Identity Services Engine (ISE) allows remote authenticated users to cause a denial of service (disk consumption and administration-interface… Affected: All versions, or not specified |
| CVE-2013-5539 | – | Oct 16 | The upload-dialog implementation in Cisco Identity Services Engine (ISE) allows remote authenticated users to upload files with an arbitrary file type, and consequently conduct… Affected: All versions, or not specified |
| CVE-2013-5538 | – | Oct 16 | The Sponsor Portal in Cisco Identity Services Engine (ISE) uses weak permissions for uploaded files, which allows remote attackers to read arbitrary files via a direct request,… Affected: All versions, or not specified |
| CVE-2013-5525 | – | Oct 10 | SQL injection vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via… Affected: through 1.2; 1.0; 1.1 |
| CVE-2013-5524 | – | Oct 10 | Cross-site scripting (XSS) vulnerability in the troubleshooting page in Cisco Identity Services Engine (ISE) 1.2 and earlier allows remote attackers to inject arbitrary web script… Affected: through 1.2; 1.0; 1.1 |
| CVE-2013-5523 | – | Oct 10 | The Sponsor Portal in Cisco Identity Services Engine (ISE) 1.2 and earlier does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct… Affected: through 1.2; 1.0; 1.1 |
| CVE-2013-5505 | – | Sep 30 | Cross-site scripting (XSS) vulnerability in an administration page in Cisco Identity Services Engine (ISE) allows remote attackers to inject arbitrary web script or HTML via an… Affected: All versions, or not specified |
| CVE-2013-5504 | – | Sep 30 | Cross-site scripting (XSS) vulnerability in the Mobile Device Management (MDM) portal in Cisco Identity Services Engine (ISE) allows remote attackers to inject arbitrary web… Affected: All versions, or not specified |
| CVE-2012-5744 | – | Aug 30 | Multiple cross-site scripting (XSS) vulnerabilities in the guest portal in Cisco Identity Services Engine (ISE) Software allow remote attackers to inject arbitrary web script or… Affected: All versions, or not specified |
| CVE-2013-3471 | – | Aug 29 | The captive portal application in Cisco Identity Services Engine (ISE) allows remote attackers to discover cleartext usernames and passwords by leveraging unspecified use of… Affected: All versions, or not specified |
| CVE-2013-3420 | – | Jul 18 | Cross-site request forgery (CSRF) vulnerability in the web framework on the Cisco Identity Services Engine (ISE) allows remote attackers to hijack the authentication of arbitrary… Affected: All versions, or not specified |
| CVE-2013-3413 | – | Jul 4 | Cross-site scripting (XSS) vulnerability in the search form in the administration/monitoring panel on the Cisco Identity Services Engine (ISE) allows remote attackers to inject… Affected: All versions, or not specified |
| CVE-2013-1196 | – | Apr 29 | The command-line interface in Cisco Secure Access Control System (ACS), Identity Services Engine Software, Context Directory Agent, Application Networking Manager (ANM), Prime… Affected: All versions, or not specified |
| CVE-2013-1125 | – | Feb 19 | The command-line interface in Cisco Identity Services Engine Software, Secure Access Control System (ACS), Application Networking Manager (ANM), Prime LAN Management Solution… Affected: All versions, or not specified |
| CVE-2012-3908 | – | Sep 16 | Multiple cross-site request forgery (CSRF) vulnerabilities in the ISE Administrator user interface (aka the Apache Tomcat interface) on Cisco Identity Services Engine (ISE) 3300… Affected: 1.0; 1.0.4; 1.0mr; 1.1; 1.1.1 |
| CVE-2011-3290 | – | Sep 21 | Cisco Identity Services Engine (ISE) before 1.0.4.MR2 has default Oracle database credentials, which allows remote attackers to modify settings or perform unspecified other… Affected: through 1.0.4; 1.0; 1.0mr |
Showing 50