Albert Sanchez

**Name of the Vulnerable Software and Affected Versions** Cisco Firepower Management Center (FMC) Software (affected versions not specified) **Description** The issue is related to insufficient validation of user-supplied input by the web-based management interface, allowing an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack. This could enable the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information. In some cases, it may also cause a temporary availability impact to portions of the FMC Dashboard. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco Firepower Management Center (FMC) Software (affected versions not specified) **Description** The issue is related to insufficient entropy in resource names and missing authorization for certain resources in the web-based management interface. This could allow a remote attacker to gain unauthorized access to sensitive information by sending specially crafted HTTPS requests. The attacker could exploit this by enumerating resources on the device, potentially leading to the retrieval of sensitive information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.