Tevel Sho

An issue exists in the Online Certificate Status Protocol (OCSP) responder—a protocol used for obtaining the real-time revocation status of digital certificates. The flaw is caused by missing authentication on a function of the OCSP responder, which allows an unauthenticated remote attacker to send a crafted request to an affected device. A successful exploit enables the attacker to trigger an administrative reload of the OCSP responder certificate and key material on demand.

An issue in the REST API allows an authenticated remote attacker with administrative credentials to perform SQL injection attacks against the monitoring database. This occurs because the system fails to sufficiently validate specific parameters before concatenating them into an SQL statement. An attacker can exploit this by sending a crafted request containing SQL statements in the affected parameters to read information from the monitoring database.

An issue in the offline profiler feed service allows an authenticated remote attacker to read arbitrary files from the file system and send requests to internal systems. This occurs because the service uses an XML parser that fails to disable external entity resolution when processing attacker-controlled feed metadata. An attacker with valid administrative credentials can trigger this by uploading a specially crafted offline feed package via the administrative interface.

A flaw in the client provisioning download feature allows an unauthenticated remote attacker to access protected files. The issue stems from insufficient validation of directory traversal character sequences—a technique used to access files and directories outside the intended folder—within a user-supplied path during the processing of provisioning resource requests. An attacker can exploit this by sending a crafted request to the provisioning download service to expose sensitive information.

Insufficient validation of user-supplied input in the certificate import functionality of the web-based management interface allows an authenticated remote attacker with administrative credentials to read arbitrary files from the affected system. This is achieved by sending a crafted request to the management interface, potentially exposing sensitive information.

An issue exists in the endpoint posture status reporting functionality of the guest portal web application. This is caused by insufficient authentication on an internal interface exposed through the guest portal, which allows an unauthenticated remote attacker to submit forged posture status events into the endpoint posture pipeline by sending a crafted request. A successful exploit enables the attacker to manipulate the posture status on the affected system.

An internal service in the affected software lacks proper authentication on the Policy Runtime Repository Table (PRRT) service. This allows an unauthenticated remote attacker to retrieve sensitive configuration information by sending a crafted request to the device.

An issue in an API of Cisco ISE and Cisco ISE-PIC allows an authenticated, remote attacker to read specific files on the underlying operating system. This occurs due to improper restriction of XML external entity (XXE) references, where XXE is a type of attack that occurs when an XML parser improperly processes external entity references within an XML document. An attacker can exploit this by sending a crafted request to the affected device to access files that the underlying process has permission to read.

An authenticated remote attacker with valid administrative credentials can perform SQL or HQL (Hibernate Query Language) injection attacks. This issue stems from insufficient validation of user-supplied input sent to affected APIs before the input is used to construct database queries. By sending a crafted request, an attacker can execute arbitrary queries against the underlying database to view or modify unauthorized data.

An authenticated remote attacker with valid administrative credentials can perform SQL or HQL (Hibernate Query Language) injection attacks. This issue stems from insufficient validation of user-supplied input sent to affected APIs before the input is used to construct database queries. By sending a crafted request, an attacker can execute arbitrary queries against the underlying database to view or modify unauthorized data.

An authenticated remote attacker with valid administrative credentials can perform SQL or HQL (Hibernate Query Language) injection attacks. This issue stems from insufficient validation of user-supplied input sent to affected APIs before the input is used to construct database queries. By sending a crafted request, an attacker can execute arbitrary queries against the underlying database to view or modify unauthorized data.

يؤدي التفسير غير المتسق لطلبات HTTP، المعروف باسم «تهريب طلبات/استجابات HTTP» (HTTP Request/Response Smuggling)، إلى إمكانية الاستيلاء على حساب المسؤول. ويحدث ذلك عندما يختلف الخادم الأمامي والخادم الخلفي حول حدود طلب HTTP، مما قد يسمح للمهاجم بـ«تهريب» طلب إلى الخادم الخلفي.

يؤدي عدم كفاية التحقق من صحة المدخلات التي يقدمها المستخدم إلى تمكين مهاجم بعيد تمت مصادقته ولديه بيانات اعتماد إدارية صالحة من تنفيذ أوامر عشوائية على نظام التشغيل الأساسي للجهاز المتأثر. ويتم ذلك عن طريق إرسال طلب HTTP مُصمم خصيصًا. ويمكن أن يؤدي الاستغلال الناجح إلى منح وصول على مستوى المستخدم إلى نظام التشغيل، والذي يمكن بعد ذلك رفعه إلى امتيازات الجذر. وفي عمليات النشر ذات العقدة الواحدة، قد يؤدي ذلك إلى حالة رفض الخدمة (DoS)، مما يجعل العقدة غير متاحة ويمنع النقاط الطرفية غير المصادق عليها من الوصول إلى الشبكة.