VARIoT IoT vulnerabilities database

An Improper Privilege Management vulnerability in the Windows Installer framework used in the Juniper Networks Juniper Identity Management Service (JIMS) allows an unprivileged user to trigger a repair operation. Running a repair operation, in turn, will trigger a number of file operations in the %TEMP% folder of the user triggering the repair. Some of these operations will be performed from a SYSTEM context (started via the Windows Installer service), including the execution of temporary files. An attacker may be able to provide malicious binaries to the Windows Installer, which will be executed with high privilege, leading to a local privilege escalation. This issue affects Juniper Networks Juniper Identity Management Service (JIMS) versions prior to 1.4.0. (DoS) It may be in a state

An Improper Handling of Unexpected Data Type vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a locally authenticated attacker with low privileges to cause a Denial of Service (DoS). Continued execution of this command might cause a sustained Denial of Service condition. If BGP rib sharding is configured and a certain CLI command is executed the rpd process can crash. During the rpd crash and restart, the routing protocols might be impacted and traffic disruption might be seen due to the loss of routing information. This issue affects: Juniper Networks Junos OS 20.3 versions prior to 20.3R3-S1; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R3; 21.2 versions prior to 21.2R2. Juniper Networks Junos OS Evolved 20.4 versions prior to 20.4R3-EVO; 21.1 versions prior to 21.1R3-EVO; 21.2 versions prior to 21.2R2-EVO. This issue does not affect: Juniper Networks Junos OS versions prior to 20.3R1. Juniper Networks Junos OS Evolved versions prior to 20.3R1-EVO. Juniper Networks Junos..

Authorized users may install a maliciously modified package file when updating the device via the web user interface. The user may inadvertently use a package file obtained from an unauthorized source or a file that was compromised between download and deployment. Red Lion Controls, Inc. of da50n Firmware contains insufficient validation of data authenticity.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. A data forgery issue vulnerability exists in the Red Lion DA50N. No detailed vulnerability details are currently provided

A reflected Cross-site Scripting (XSS) vulnerability in J-Web of Juniper Networks Junos OS allows a network-based authenticated attacker to run malicious scripts reflected off J-Web to the victim's browser in the context of their session within J-Web. This may allow the attacker to gain control of the device or attack other authenticated user sessions. This issue affects: Juniper Networks Junos OS All versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R3-S9; 19.1 versions prior to 19.1R3-S6; 19.2 versions prior to 19.2R3-S3; 19.3 versions prior to 19.3R2-S6, 19.3R3-S3; 19.4 versions prior to 19.4R3-S5; 20.1 versions prior to 20.1R3-S4; 20.2 versions prior to 20.2R3-S2; 20.3 versions prior to 20.3R3; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R1-S1, 21.1R2

There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f. Ruby Exists in an out-of-bounds read vulnerability.Information may be obtained. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: rh-ruby30-ruby security, bug fix, and enhancement update Advisory ID: RHSA-2022:6855-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2022:6855 Issue date: 2022-10-11 CVE Names: CVE-2021-41816 CVE-2021-41817 CVE-2021-41819 CVE-2022-28738 CVE-2022-28739 ==================================================================== 1. Summary: An update for rh-ruby30-ruby is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64le, s390x, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64 3. Description: Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The following packages have been upgraded to a later upstream version: rh-ruby30-ruby (3.0.4). (BZ#2128628) Security Fix(es): * ruby: buffer overflow in CGI.escape_html (CVE-2021-41816) * ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817) * ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819) * Ruby: Double free in Regexp compilation (CVE-2022-28738) * Ruby: Buffer overrun in String-to-Float conversion (CVE-2022-28739) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * rh-ruby30 ruby: User-installed rubygems plugins are not being loaded (BZ#2128629) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2025104 - CVE-2021-41817 ruby: Regular expression denial of service vulnerability of Date parsing methods 2026752 - CVE-2021-41816 ruby: buffer overflow in CGI.escape_html 2026757 - CVE-2021-41819 ruby: Cookie prefix spoofing in CGI::Cookie.parse 2075685 - CVE-2022-28738 Ruby: Double free in Regexp compilation 2075687 - CVE-2022-28739 Ruby: Buffer overrun in String-to-Float conversion 2128628 - rh-ruby30-ruby: Rebase to the latest Ruby 3.0 release [rhscl-3] [rhscl-3.8.z] 2128629 - rh-ruby30 ruby: User-installed rubygems plugins are not being loaded [rhscl-3.8.z] 6. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: rh-ruby30-ruby-3.0.4-149.el7.src.rpm noarch: rh-ruby30-ruby-default-gems-3.0.4-149.el7.noarch.rpm rh-ruby30-ruby-doc-3.0.4-149.el7.noarch.rpm rh-ruby30-rubygem-bundler-2.2.33-149.el7.noarch.rpm rh-ruby30-rubygem-irb-1.3.5-149.el7.noarch.rpm rh-ruby30-rubygem-minitest-5.14.2-149.el7.noarch.rpm rh-ruby30-rubygem-power_assert-1.2.0-149.el7.noarch.rpm rh-ruby30-rubygem-rake-13.0.3-149.el7.noarch.rpm rh-ruby30-rubygem-rbs-1.4.0-149.el7.noarch.rpm rh-ruby30-rubygem-rexml-3.2.5-149.el7.noarch.rpm rh-ruby30-rubygem-rss-0.2.9-149.el7.noarch.rpm rh-ruby30-rubygem-test-unit-3.3.7-149.el7.noarch.rpm rh-ruby30-rubygem-typeprof-0.15.2-149.el7.noarch.rpm rh-ruby30-rubygems-3.2.33-149.el7.noarch.rpm rh-ruby30-rubygems-devel-3.2.33-149.el7.noarch.rpm ppc64le: rh-ruby30-ruby-3.0.4-149.el7.ppc64le.rpm rh-ruby30-ruby-debuginfo-3.0.4-149.el7.ppc64le.rpm rh-ruby30-ruby-devel-3.0.4-149.el7.ppc64le.rpm rh-ruby30-ruby-libs-3.0.4-149.el7.ppc64le.rpm rh-ruby30-rubygem-bigdecimal-3.0.0-149.el7.ppc64le.rpm rh-ruby30-rubygem-io-console-0.5.7-149.el7.ppc64le.rpm rh-ruby30-rubygem-json-2.5.1-149.el7.ppc64le.rpm rh-ruby30-rubygem-psych-3.3.2-149.el7.ppc64le.rpm s390x: rh-ruby30-ruby-3.0.4-149.el7.s390x.rpm rh-ruby30-ruby-debuginfo-3.0.4-149.el7.s390x.rpm rh-ruby30-ruby-devel-3.0.4-149.el7.s390x.rpm rh-ruby30-ruby-libs-3.0.4-149.el7.s390x.rpm rh-ruby30-rubygem-bigdecimal-3.0.0-149.el7.s390x.rpm rh-ruby30-rubygem-io-console-0.5.7-149.el7.s390x.rpm rh-ruby30-rubygem-json-2.5.1-149.el7.s390x.rpm rh-ruby30-rubygem-psych-3.3.2-149.el7.s390x.rpm x86_64: rh-ruby30-ruby-3.0.4-149.el7.x86_64.rpm rh-ruby30-ruby-debuginfo-3.0.4-149.el7.x86_64.rpm rh-ruby30-ruby-devel-3.0.4-149.el7.x86_64.rpm rh-ruby30-ruby-libs-3.0.4-149.el7.x86_64.rpm rh-ruby30-rubygem-bigdecimal-3.0.0-149.el7.x86_64.rpm rh-ruby30-rubygem-io-console-0.5.7-149.el7.x86_64.rpm rh-ruby30-rubygem-json-2.5.1-149.el7.x86_64.rpm rh-ruby30-rubygem-psych-3.3.2-149.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: rh-ruby30-ruby-3.0.4-149.el7.src.rpm noarch: rh-ruby30-ruby-default-gems-3.0.4-149.el7.noarch.rpm rh-ruby30-ruby-doc-3.0.4-149.el7.noarch.rpm rh-ruby30-rubygem-bundler-2.2.33-149.el7.noarch.rpm rh-ruby30-rubygem-irb-1.3.5-149.el7.noarch.rpm rh-ruby30-rubygem-minitest-5.14.2-149.el7.noarch.rpm rh-ruby30-rubygem-power_assert-1.2.0-149.el7.noarch.rpm rh-ruby30-rubygem-rake-13.0.3-149.el7.noarch.rpm rh-ruby30-rubygem-rbs-1.4.0-149.el7.noarch.rpm rh-ruby30-rubygem-rexml-3.2.5-149.el7.noarch.rpm rh-ruby30-rubygem-rss-0.2.9-149.el7.noarch.rpm rh-ruby30-rubygem-test-unit-3.3.7-149.el7.noarch.rpm rh-ruby30-rubygem-typeprof-0.15.2-149.el7.noarch.rpm rh-ruby30-rubygems-3.2.33-149.el7.noarch.rpm rh-ruby30-rubygems-devel-3.2.33-149.el7.noarch.rpm x86_64: rh-ruby30-ruby-3.0.4-149.el7.x86_64.rpm rh-ruby30-ruby-debuginfo-3.0.4-149.el7.x86_64.rpm rh-ruby30-ruby-devel-3.0.4-149.el7.x86_64.rpm rh-ruby30-ruby-libs-3.0.4-149.el7.x86_64.rpm rh-ruby30-rubygem-bigdecimal-3.0.0-149.el7.x86_64.rpm rh-ruby30-rubygem-io-console-0.5.7-149.el7.x86_64.rpm rh-ruby30-rubygem-json-2.5.1-149.el7.x86_64.rpm rh-ruby30-rubygem-psych-3.3.2-149.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-41816 https://access.redhat.com/security/cve/CVE-2021-41817 https://access.redhat.com/security/cve/CVE-2021-41819 https://access.redhat.com/security/cve/CVE-2022-28738 https://access.redhat.com/security/cve/CVE-2022-28739 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBY0Uv1tzjgjWX9erEAQgAKhAAjX8disZOm8gqwL8MxMVbPzYaxXlNCWSn /kI4e6oxz7lzw9tjdOmrdw9qgXVGY4EZAcZtkkDuQZFY6/1OfXWrFsCWInbbr6e/ 7SzF9a2XTyAxOLF1XU8IgyMKJ8TOQfsg/5CTGZpm8rIV+FjsS1u1SwhGXF1J/MWG TA3jlhLlqJusAGbl2xH3sjBc1ljaha3iVXstBxEfQQLJAisJf9xemU6hh45ceT90 TOiJyRh+JqdBHXv/41l+n/4fChH1oGnk6guQPbggPrTCKMvv55VS4x4vUYDMAdXc w6P3De5hutdjiJzOZwvm6PlaHQOAYRlRAbFh21T6p1HhunTBYTRxqh+BK42ygAnP 3AKhsUf/um6cMv2SWmvzEoA8xNDxaR1FKryzilpqgCyJhbf3Cx8xkWn1dyryTNwM d2k2anM9LbgiG05qRIV1QZcndiAZwL4fPTWE0yLd4H5a7kURkIYTwgVr8qAC5yYC 8R58XG7whyp+zvmc+RNUCCGcIEZ9p3Fbw5x6Lz5Y0CvMV0y4R5H+qcqSqPlKeJGI XBCgwpKxML+7bq0eqBmheLp4XYjvbgpMKlFU/ladFg9/a2NcbHiidxtcvHzEPcq8 oEuHjfaXnyTi7KC4PjHnDAaXxjrDsTrSNIBAcdbXA+p2ZE5FXcmRmrY3Qqz1i44j Q10rz6cYwlE=yEyk -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . 8) - aarch64, noarch, ppc64le, s390x, x86_64 3. ========================================================================= Ubuntu Security Notice USN-5462-1 June 06, 2022 ruby2.5, ruby2.7, ruby3.0 vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS - Ubuntu 21.10 - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: Several security issues were fixed in Ruby. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-28738) It was discovered that Ruby incorrectly handled certain inputs. An attacker could possibly use this issue to expose sensitive information. (CVE-2022-28739) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS: libruby3.0 3.0.2-7ubuntu2.1 ruby3.0 3.0.2-7ubuntu2.1 Ubuntu 21.10: libruby2.7 2.7.4-1ubuntu3.2 ruby2.7 2.7.4-1ubuntu3.2 Ubuntu 20.04 LTS: libruby2.7 2.7.0-5ubuntu1.7 ruby2.7 2.7.0-5ubuntu1.7 Ubuntu 18.04 LTS: libruby2.5 2.5.1-1ubuntu1.12 ruby2.5 2.5.1-1ubuntu1.12 In general, a standard system update will make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2022-10-27-6 Additional information for APPLE-SA-2022-10-24-3 macOS Monterey 12.6.1 macOS Monterey 12.6.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT213494. AppleMobileFileIntegrity Available for: macOS Monterey Impact: An app may be able to modify protected parts of the file system Description: This issue was addressed by removing additional entitlements. CVE-2022-42825: Mickey Jin (@patch1t) Audio Available for: macOS Monterey Impact: Parsing a maliciously crafted audio file may lead to disclosure of user information Description: The issue was addressed with improved memory handling. CVE-2022-42798: Anonymous working with Trend Micro Zero Day Initiative Entry added October 27, 2022 Kernel Available for: macOS Monterey Impact: An app may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved state management. CVE-2022-32944: Tim Michaud (@TimGMichaud) of Moveworks.ai Entry added October 27, 2022 Kernel Available for: macOS Monterey Impact: An app may be able to execute arbitrary code with kernel privileges Description: A race condition was addressed with improved locking. CVE-2022-42803: Xinru Chi of Pangu Lab, John Aakerblom (@jaakerblom) Entry added October 27, 2022 Kernel Available for: macOS Monterey Impact: An app may be able to execute arbitrary code with kernel privileges Description: A logic issue was addressed with improved checks. CVE-2022-42801: Ian Beer of Google Project Zero Entry added October 27, 2022 ppp Available for: macOS Monterey Impact: A buffer overflow may result in arbitrary code execution Description: The issue was addressed with improved bounds checks. CVE-2022-32941: an anonymous researcher Entry added October 27, 2022 Ruby Available for: macOS Monterey Impact: A remote user may be able to cause unexpected app termination or arbitrary code execution Description: A memory corruption issue was addressed by updating Ruby to version 2.6.10. CVE-2022-28739 Sandbox Available for: macOS Monterey Impact: An app with root privileges may be able to access private information Description: This issue was addressed with improved data protection. CVE-2022-32862: an anonymous researcher zlib Available for: macOS Monterey Impact: A user may be able to cause unexpected app termination or arbitrary code execution Description: This issue was addressed with improved checks. CVE-2022-37434: Evgeny Legerov CVE-2022-42800: Evgeny Legerov Entry added October 27, 2022 Additional recognition Calendar We would like to acknowledge an anonymous researcher for their assistance. macOS Monterey 12.6.1 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222

nginx njs 0.7.2 is vulnerable to Buffer Overflow. Type confused in Array.prototype.concat() when a slow array appended element is fast array. nginx njs Exists in a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state

A vulnerability in the integrated wireless access point (AP) packet processing of the Cisco 1000 Series Connected Grid Router (CGR1K) could allow an unauthenticated, adjacent attacker to cause a denial of service condition on an affected device. This vulnerability is due to insufficient input validation of received traffic. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to cause the integrated AP to stop processing traffic, resulting in a DoS condition. It may be necessary to manually reload the CGR1K to restore AP operation. Cisco 1000 series Connected Grid Router (CGR1K) There is an input validation vulnerability in.Service operation interruption (DoS) It may be in a state

nginx njs 0.7.2 is affected suffers from Use-after-free in njs_function_frame_alloc() when it try to invoke from a restored frame saved with njs_function_frame_save(). nginx njs Exists in a vulnerability related to the use of freed memory.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

An Improper Update of Reference Count vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to trigger a counter overflow, eventually causing a Denial of Service (DoS). This issue affects Juniper Networks Junos OS Evolved: All versions prior to 20.4R3-S1-EVO; 21.1 versions prior to 21.1R3-EVO; 21.2 versions prior to 21.2R3-EVO; 21.3 versions prior to 21.3R2-EVO. This issue does not affect Juniper Networks Junos OS

An Operation on a Resource after Expiration or Release vulnerability in the Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker with an established BGP session to cause a Denial of Service (DoS). This issue occurs when proxy-generate route-target filtering is enabled, and certain proxy-route add and delete events are happening. This issue affects: Juniper Networks Junos OS All versions prior to 17.3R3-S11; 17.4 versions prior to 17.4R2-S13, 17.4R3-S4; 18.3 versions prior to 18.3R3-S4; 18.4 versions prior to 18.4R1-S8, 18.4R2-S8, 18.4R3-S6; 19.1 versions prior to 19.1R3-S4; 19.2 versions prior to 19.2R1-S6, 19.2R3-S2; 19.3 versions prior to 19.3R2-S6, 19.3R3-S1; 19.4 versions prior to 19.4R1-S4, 19.4R2-S4, 19.4R3; 20.1 versions prior to 20.1R2; 20.2 versions prior to 20.2R2; 20.3 versions prior to 20.3R1-S2, 20.3R2. Juniper Networks Junos OS Evolved All versions prior to 20.1R3-EVO; 20.2 versions prior to 20.2R3-EVO; 20.3 versions prior to 20.3R2-EVO

Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system, install applications without being authenticated, or conduct a cross-site scripting (XSS) attack against a user of the affected software. For more information about these vulnerabilities, see the Details section of this advisory. Cisco IOx A race condition vulnerability exists in the application hosting environment.Information may be tampered with. Cisco Iox is a secure development environment from Cisco (Cisco) that combines Cisco IOS and Linux OS for secure network connection and development of IOT applications. An attacker could exploit this vulnerability by continually attempting to call the upload API, and if the call occurs at the same time as an authorized administrator deploying the application, the attacker could contend for a token and be granted the ability to bypass authentication. Successful exploitation of this vulnerability could allow an attacker to bypass authentication. The following products and releases are affected: Cisco ASR, Cisco Catalyst, IOS by Cisco, IOS XE, Cisco Router

A vulnerability in the authentication functionality of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to bypass authentication controls and log in to the device through the management interface This vulnerability is due to the improper implementation of the password validation algorithm. An attacker could exploit this vulnerability by logging in to an affected device with crafted credentials. A successful exploit could allow the attacker to bypass authentication and log in to the device as an administrator. The attacker could obtain privileges that are the same level as an administrative user but it depends on the crafted credentials. Note: This vulnerability exists because of a non-default device configuration that must be present for it to be exploitable. For details about the vulnerable configuration, see the Vulnerable Products section of this advisory. (DoS) It may be in a state. Cisco Wireless LAN Controller (WLC) is a wireless LAN controller product of Cisco (Cisco). The product provides security policy, intrusion detection and other functions in the wireless local area network

Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system, install applications without being authenticated, or conduct a cross-site scripting (XSS) attack against a user of the affected software. For more information about these vulnerabilities, see the Details section of this advisory. Cisco IOx The application hosting environment includes OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system, install applications without being authenticated, or conduct a cross-site scripting (XSS) attack against a user of the affected software. For more information about these vulnerabilities, see the Details section of this advisory. Cisco IOx A path traversal vulnerability exists in application hosting environments.Information may be obtained. Cisco Iox is a secure development environment from Cisco (Cisco) that combines Cisco IOS and Linux OS for secure network connection and development of IOT applications. An attacker could exploit this vulnerability by sending a crafted command request using the API. Successful exploitation of this vulnerability could allow an attacker to read the contents of any file located on the underlying host's file system. The following products and releases are affected: Cisco ASR, Cisco Catalyst, IOS by Cisco, IOS XE, Cisco Router

A vulnerability in the IPSec decryption routine of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to buffer exhaustion that occurs while traffic on a configured IPsec tunnel is being processed. An attacker could exploit this vulnerability by sending traffic to an affected device that has a maximum transmission unit (MTU) of 1800 bytes or greater. A successful exploit could allow the attacker to cause the device to reload. To exploit this vulnerability, the attacker may need access to the trusted network where the affected device is in order to send specific packets to be processed by the device. All network devices between the attacker and the affected device must support an MTU of 1800 bytes or greater. This access requirement could limit the possibility of a successful exploit. Cisco IOS XE The software contains an input validation vulnerability.Service operation interruption (DoS) It may be in a state. Cisco IOS XE is an operating system developed by Cisco for its network equipment

Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system, install applications without being authenticated, or conduct a cross-site scripting (XSS) attack against a user of the affected software. For more information about these vulnerabilities, see the Details section of this advisory. Cisco IOx A path traversal vulnerability exists in application hosting environments.Information may be obtained. Cisco Iox is a secure development environment from Cisco (Cisco) that combines Cisco IOS and Linux OS for secure network connection and development of IOT applications. An attacker could exploit this vulnerability by sending a crafted command request using the API. Successful exploitation of this vulnerability could allow an attacker to read the contents of any file on the host device's file system. The following products and releases are affected: Cisco ASR, Cisco Catalyst, IOS by Cisco, IOS XE, Cisco Router

Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system, install applications without being authenticated, or conduct a cross-site scripting (XSS) attack against a user of the affected software. For more information about these vulnerabilities, see the Details section of this advisory. Cisco IOx A link interpretation vulnerability exists in application hosting environments.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

A vulnerability in the Application Visibility and Control (AVC-FNF) feature of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless Controllers could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient packet verification for traffic inspected by the AVC feature. An attacker could exploit this vulnerability by sending crafted packets from the wired network to a wireless client, resulting in the crafted packets being processed by the wireless controller. A successful exploit could allow the attacker to cause a crash and reload of the affected device, resulting in a DoS condition. Cisco IOS XE An out-of-bounds write vulnerability exists in the software.Service operation interruption (DoS) It may be in a state. Cisco IOS XE is an operating system developed by Cisco for its network equipment. Cisco IOS XE AVC-FNF has a denial-of-service vulnerability. Attackers can exploit this vulnerability to cause a denial of service

Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system, install applications without being authenticated, or conduct a cross-site scripting (XSS) attack against a user of the affected software. For more information about these vulnerabilities, see the Details section of this advisory. Cisco IOx A path traversal vulnerability exists in application hosting environments.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI API. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges. (DoS) It may be in a state. Cisco IOS XE Software is an operating system of Cisco (Cisco). A single operating system for enterprise wired and wireless access, aggregation, core, and WAN, Cisco IOS XE reduces business and network complexity