CVE-2025-20353 is a medium severity cross-site scripting (XSS) vulnerability in Cisco Digital Network Architecture Center's web-based management interface. It allows an unauthenticated remote attacker to craft malicious links that, when clicked by a user, execute arbitrary scripts in the context of the affected interface. This can lead to theft of sensitive browser-based information or unauthorized actions within the interface. The vulnerability arises from improper input validation during web page generation. It affects numerous versions of Cisco DNA Center, a widely deployed network management platform. Exploitation requires user interaction but no authentication, increasing risk in environments where users access the interface regularly. No known public exploits exist yet. European organizations using Cisco DNA Center for network management could face confidentiality and integrity risks. Mitigation involves applying vendor patches once available, restricting access to the management interface, and educating users to avoid clicking suspicious links. Countries with large Cisco enterprise deployments and critical infrastructure networks are most at risk.
A vulnerability in the REST API of Cisco Catalyst Center could allow an authenticated, remote attacker to execute arbitrary commands in a restricted container as the root user.
This vulnerability is due to insufficient validation of user-supplied input in REST API request parameters. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to inject arbitrary commands that would then be executed in a restricted container with root privileges. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Observer.
A vulnerability in Cisco Catalyst Center Virtual Appliance could allow an authenticated, remote attacker to elevate privileges to Administrator on an affected system.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted HTTP request to an affected system. A successful exploit could allow the attacker to perform unauthorized modifications to the system, including creating new user accounts or elevating their own privileges on an affected system. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Observer.
CVE-2025-20304 is a medium-severity reflected Cross-Site Scripting (XSS) vulnerability affecting Cisco Identity Services Engine (ISE) software versions 3.1.0 through 3.4 Patch 3. An authenticated attacker with low privileges can inject malicious scripts into the web-based management interface, potentially executing arbitrary code in the context of the victim's browser. Exploitation requires user interaction and valid credentials but can lead to disclosure of sensitive browser-based information and session hijacking. No known exploits are currently in the wild. The vulnerability impacts confidentiality and integrity but not availability. European organizations using Cisco ISE for network access control and policy enforcement should prioritize patching and implement strict input validation and session management controls. Countries with high Cisco ISE deployment and critical infrastructure reliance on network access control are most at risk.
CVE-2025-20305 is a medium-severity vulnerability in Cisco Identity Services Engine (ISE) software affecting versions 3.1.0 through 3.4 Patch 1. It allows an authenticated remote attacker with read-only Administrator privileges to access sensitive information, including passwords normally hidden from such users, due to insufficient granularity in access control on the web management interface. Exploitation does not require user interaction and can be performed remotely. Although the vulnerability does not impact system integrity or availability, it compromises confidentiality by exposing sensitive credentials. No known exploits are currently reported in the wild. European organizations using affected Cisco ISE versions for network access control and policy enforcement should prioritize patching and review administrative privilege assignments to mitigate risk. Countries with significant Cisco enterprise deployments and critical infrastructure reliance on Cisco ISE are at higher risk.
CVE-2025-20289 is a medium-severity reflected Cross-Site Scripting (XSS) vulnerability in Cisco Identity Services Engine (ISE) software's web management interface. It allows an authenticated attacker with low privileges to inject malicious scripts into the interface, potentially executing arbitrary code in the context of the victim's browser session. Exploitation requires user interaction and valid credentials but can lead to disclosure of sensitive browser-based information and session hijacking. The vulnerability affects multiple versions of Cisco ISE from 3.1.0 through 3.4 Patch 2. No known exploits are currently reported in the wild. European organizations using Cisco ISE for network access control and policy enforcement should prioritize patching and implement strict access controls to mitigate risk. Countries with significant Cisco deployments and critical infrastructure reliance on Cisco ISE are most at risk.
CVE-2025-20303 is a medium-severity reflected Cross-site Scripting (XSS) vulnerability in Cisco Identity Services Engine (ISE) web management interface. It allows an authenticated attacker with low privileges to inject malicious scripts that execute in the context of the interface, potentially exposing sensitive browser-based information. Exploitation requires user interaction and low-privileged authentication. The vulnerability affects multiple versions of Cisco ISE from 3.1.0 through 3.4 Patch 3. While no known exploits are reported in the wild, successful attacks could compromise confidentiality and integrity of session data. European organizations using Cisco ISE for network access control and policy enforcement should prioritize patching and implement strict input validation and access controls to mitigate risk. Countries with high Cisco ISE adoption and critical infrastructure reliance on network access control are most at risk.
A vulnerability in the API subsystem of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to obtain sensitive information from an affected system.
This vulnerability is due to improper validation of requests to certain API endpoints. An attacker could exploit this vulnerability by sending a valid request to a specific API endpoint within the affected system. A successful exploit could allow a low-privileged user to view sensitive information on the affected system that should be restricted. To exploit this vulnerability, the attacker must have valid user credentials on the affected system.
A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files.
This vulnerability is due to an insufficient input validation associated to specific UI features. An attacker could exploit this vulnerability by uploading a crafted file to the web UI. A successful exploit could allow the attacker to upload arbitrary files to a vulnerable system and execute them, gaining access to the underlying operating system. To exploit this vulnerability, the attacker must have valid administrative credentials.
A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files.
This vulnerability is due to an insufficient input validation associated to file upload mechanisms. An attacker could exploit this vulnerability by uploading a malicious file to the web UI and executing it. A successful exploit could allow the attacker to execute arbitrary commands on the underlying system and elevate privileges to root. To exploit this vulnerability, the attacker must have valid administrative credentials.
A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to perform a directory traversal and access arbitrary resources.
This vulnerability is due to an insufficient input validation associated to specific UI features. An attacker could exploit this vulnerability by sending a crafted request to the web UI. A successful exploit could allow the attacker to gain read access to arbitrary files on the underlying operating system. To exploit this vulnerability, the attacker must have valid administrative credentials.
A vulnerability in the Contact Center Express (CCX) Editor application of Cisco Unified CCX could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative permissions pertaining to script creation and execution.
This vulnerability is due to improper authentication mechanisms in the communication between the CCX Editor and an affected Unified CCX server. An attacker could exploit this vulnerability by redirecting the authentication flow to a malicious server and tricking the CCX Editor into believing the authentication was successful. A successful exploit could allow the attacker to create and execute arbitrary scripts on the underlying operating system of an affected Unified CCX server, as an internal non-root user account.
A vulnerability in the Java Remote Method Invocation (RMI) process of Cisco Unified CCX could allow an unauthenticated, remote attacker to upload arbitrary files and execute arbitrary commands with root permissions on an affected system.
This vulnerability is due to improper authentication mechanisms that are associated to specific Cisco Unified CCX features. An attacker could exploit this vulnerability by uploading a crafted file to an affected system through the Java RMI process. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root.
A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause Cisco ISE to restart unexpectedly.
This vulnerability is due to a logic error when processing a RADIUS access request for a MAC address that is already a rejected endpoint. An attacker could exploit this vulnerability by sending a specific sequence of multiple crafted RADIUS access request messages to Cisco ISE. A successful exploit could allow the attacker to cause a denial of service (DoS) condition when Cisco ISE restarts.
sveltekit-superforms makes SvelteKit forms a pleasure to use.sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the parseFormData function of formData.js. An attacker can inject string and array properties into Object.prototype, leading to denial of service, type confusion, and potential remote code execution in downstream applications that rely on polluted objects. This vulnerability is fixed in 2.27.4.
Multiple Cisco products are affected by a vulnerability in the Snort 3 HTTP Decoder that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart.
This vulnerability is due to a lack of complete error checking when the MIME fields of the HTTP header are parsed. An attacker could exploit this vulnerability by sending crafted HTTP packets through an established connection to be parsed by Snort 3. A successful exploit could allow the attacker to cause a DoS condition when the Snort 3 Detection Engine unexpectedly restarts.
Multiple Cisco products are affected by a vulnerability in the Snort 3 HTTP Decoder that could allow an unauthenticated, remote attacker to cause the disclosure of possible sensitive data or cause the Snort 3 Detection Engine to crash.
This vulnerability is due to an error in the logic of buffer handling when the MIME fields of the HTTP header are parsed. This can result in a buffer under-read. An attacker could exploit this vulnerability by sending crafted HTTP packets through an established connection that is parsed by Snort 3. A successful exploit could allow the attacker to induce one of two possible outcomes: the unexpected restarting of the Snort 3 Detection Engine, which could cause a denial of service (DoS) condition, or information disclosure of sensitive information in the Snort 3 data stream. Due to the under-read condition, it is possible that sensitive information that is not valid connection data could be returned.
A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 running Cisco SIP Software could allow an unauthenticated, remote attacker to conduct XSS attacks against a user of the web UI.
This vulnerability exists because the web UI of an affected device does not sufficiently validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Note: To exploit this vulnerability, the phone must be registered to Cisco Unified Communications Manager and have Web Access enabled. Web Access is disabled by default.
A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 running Cisco SIP Software could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device.
This vulnerability is due to a buffer overflow when an affected device processes HTTP packets. An attacker could exploit this vulnerability by sending crafted HTTP input to the device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
Note: To exploit this vulnerability, the phone must be registered to Cisco Unified Communications Manager and have Web Access enabled. Web Access is disabled by default.
A vulnerability in the logging component of Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. To exploit this vulnerability, the attacker must have valid administrative credentials.
This vulnerability exists because certain unencrypted credentials are stored when SIP media component logging is enabled. An attacker could exploit this vulnerability by accessing the audit logs on an affected system and obtaining credentials to which they may not normally have access. A successful exploit could allow the attacker to use those credentials to access confidential information, some of which may contain personally identifiable information (PII).
Note: To access the logs that are stored in the Webex Cloud or stored on the device itself, an attacker must have valid administrative credentials.
