Tevel Sho

An issue exists in the Online Certificate Status Protocol (OCSP) responder—a protocol used for obtaining the real-time revocation status of digital certificates. The flaw is caused by missing authentication on a function of the OCSP responder, which allows an unauthenticated remote attacker to send a crafted request to an affected device. A successful exploit enables the attacker to trigger an administrative reload of the OCSP responder certificate and key material on demand.

An issue in the REST API allows an authenticated remote attacker with administrative credentials to perform SQL injection attacks against the monitoring database. This occurs because the system fails to sufficiently validate specific parameters before concatenating them into an SQL statement. An attacker can exploit this by sending a crafted request containing SQL statements in the affected parameters to read information from the monitoring database.

An issue in the offline profiler feed service allows an authenticated remote attacker to read arbitrary files from the file system and send requests to internal systems. This occurs because the service uses an XML parser that fails to disable external entity resolution when processing attacker-controlled feed metadata. An attacker with valid administrative credentials can trigger this by uploading a specially crafted offline feed package via the administrative interface.

A flaw in the client provisioning download feature allows an unauthenticated remote attacker to access protected files. The issue stems from insufficient validation of directory traversal character sequences—a technique used to access files and directories outside the intended folder—within a user-supplied path during the processing of provisioning resource requests. An attacker can exploit this by sending a crafted request to the provisioning download service to expose sensitive information.

Insufficient validation of user-supplied input in the certificate import functionality of the web-based management interface allows an authenticated remote attacker with administrative credentials to read arbitrary files from the affected system. This is achieved by sending a crafted request to the management interface, potentially exposing sensitive information.

An issue exists in the endpoint posture status reporting functionality of the guest portal web application. This is caused by insufficient authentication on an internal interface exposed through the guest portal, which allows an unauthenticated remote attacker to submit forged posture status events into the endpoint posture pipeline by sending a crafted request. A successful exploit enables the attacker to manipulate the posture status on the affected system.

An internal service in the affected software lacks proper authentication on the Policy Runtime Repository Table (PRRT) service. This allows an unauthenticated remote attacker to retrieve sensitive configuration information by sending a crafted request to the device.

An issue in an API of Cisco ISE and Cisco ISE-PIC allows an authenticated, remote attacker to read specific files on the underlying operating system. This occurs due to improper restriction of XML external entity (XXE) references, where XXE is a type of attack that occurs when an XML parser improperly processes external entity references within an XML document. An attacker can exploit this by sending a crafted request to the affected device to access files that the underlying process has permission to read.

An authenticated remote attacker with valid administrative credentials can perform SQL or HQL (Hibernate Query Language) injection attacks. This issue stems from insufficient validation of user-supplied input sent to affected APIs before the input is used to construct database queries. By sending a crafted request, an attacker can execute arbitrary queries against the underlying database to view or modify unauthorized data.

An authenticated remote attacker with valid administrative credentials can perform SQL or HQL (Hibernate Query Language) injection attacks. This issue stems from insufficient validation of user-supplied input sent to affected APIs before the input is used to construct database queries. By sending a crafted request, an attacker can execute arbitrary queries against the underlying database to view or modify unauthorized data.

An authenticated remote attacker with valid administrative credentials can perform SQL or HQL (Hibernate Query Language) injection attacks. This issue stems from insufficient validation of user-supplied input sent to affected APIs before the input is used to construct database queries. By sending a crafted request, an attacker can execute arbitrary queries against the underlying database to view or modify unauthorized data.

Inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, allows for admin account takeover. This occurs when a front-end server and a back-end server disagree on the boundaries of an HTTP request, potentially allowing an attacker to "smuggle" a request to the back-end.

Insufficient validation of user-supplied input allows an authenticated remote attacker with valid administrative credentials to execute arbitrary commands on the underlying operating system of an affected device. This is achieved by sending a crafted HTTP request. A successful exploit can grant user-level access to the operating system, which can then be elevated to root privileges. In single-node deployments, this may lead to a denial of service (DoS) condition, rendering the node unavailable and preventing unauthenticated endpoints from accessing the network.