Cisco Identity Services Engine Software vulnerabilities

49 CVEs affecting Cisco Identity Services Engine Software, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-15282, published 2019-10-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-6323, published 2016-01-15. Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days. The Admin portal in Cisco Identity Services Engine (ISE) 1.1.x, 1.2.0 before patch 17, 1.2.1 before patch 8, 1.3 before patch 5, and 1.4 before patch 4 allows remote attackers to obtain…
CVE-2015-0757, published 2015-05-29. Medium severity, CVSS 5.0. EPSS: 2.5% chance of exploitation in the next 30 days. The web framework in Cisco Identity Services Engine (ISE) 1.2(1.901) and 1.3(0.722) does not properly implement session handlers, which allows remote attackers to obtain sensitive information by…
CVE-2013-5530, published 2013-10-25. High severity, CVSS 9.0. EPSS: 2.3% chance of exploitation in the next 30 days. The web framework in Cisco Identity Services Engine (ISE) 1.0 and 1.1.0 before 1.1.0.665-5, 1.1.1 before 1.1.1.268-7, 1.1.2 before 1.1.2.145-10, 1.1.3 before 1.1.3.124-7, 1.1.4 before 1.1.4.218-7,…
CVE-2011-3290, published 2011-09-21. High severity, CVSS 10.0. EPSS: 2.3% chance of exploitation in the next 30 days. Cisco Identity Services Engine (ISE) before 1.0.4.MR2 has default Oracle database credentials, which allows remote attackers to modify settings or perform unspecified other administrative actions via…
CVE-2014-3276, published 2014-05-26. Medium severity, CVSS 4.0. EPSS: 2.2% chance of exploitation in the next 30 days. Cisco Identity Services Engine (ISE) 1.2(.1 patch 2) and earlier does not properly handle deadlock conditions during reception of crafted RADIUS accounting packets from multiple NAS devices, which…
CVE-2015-4182, published 2015-06-12. Medium severity, CVSS 5.5. EPSS: 2.1% chance of exploitation in the next 30 days. The administrative web interface in Cisco Identity Services Engine (ISE) before 1.3 allows remote authenticated users to bypass intended access restrictions, and obtain sensitive information or…
CVE-2015-4219, published 2015-06-24. Medium severity, CVSS 4.0. EPSS: 2% chance of exploitation in the next 30 days. Cisco Secure Access Control System before 5.4(0.46.2) and 5.5 before 5.5(0.46) and Cisco Identity Services Engine 1.0(4.573) do not properly implement access control for support bundles, which allows…
CVE-2017-12316, published 2017-11-16. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. A vulnerability in the Guest Portal login page of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to perform multiple login attempts in excess of the configured…
CVE-2016-1402, published 2016-05-21. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. The Active Directory (AD) integration component in Cisco Identity Service Engine (ISE) before 1.2.0.899 patch 7, when AD group-membership authorization is enabled, allows remote attackers to cause a…
CVE-2016-9214, published 2016-12-14. Medium severity, CVSS 6.1. EPSS: 1.8% chance of exploitation in the next 30 days. Cisco Identity Services Engine (ISE) contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface…

Latest

CVE-2019-15282, published 2019-10-16. Medium severity, CVSS 5.3. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an unauthenticated, remote attacker read tcpdump files generated on an affected…
CVE-2019-15281, published 2019-10-16. Medium severity, CVSS 4.8. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS)…
CVE-2018-15463, published 2019-01-15. Medium severity, CVSS 6.1. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack…
CVE-2018-15440, published 2019-01-15. Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack…
CVE-2018-0413, published 2018-08-01. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and…
CVE-2018-0339, published 2018-06-07. Medium severity, CVSS 6.1. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a…
CVE-2018-0327, published 2018-05-17. Medium severity, CVSS 6.1. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability in the web framework of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web…
CVE-2018-0289, published 2018-05-17. Medium severity, CVSS 6.1. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability in the logs component of Cisco Identity Services Engine could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability is due to improper…
CVE-2017-3835, published 2017-02-22. High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days. A vulnerability in the sponsor portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access notices owned by other users, because of SQL Injection. More…