39 casos · pág. 1/2
On October 21, the PHP Foundation released a Critical PHP Security release fixing two critical remote code execution vulnerabilities, collectively referred to as PHP2shell. Cisco published an advisory on how these flaws affect its products and rated the security impact Critical. The excerpt does not list which Cisco products are affected,…
Cisco disclosed CVE-2026-76445, a medium-severity vulnerability in the Snort 3 Detection Engine that affects multiple Cisco products. An unauthenticated, remote attacker can send a crafted, fragmented UDP datagram containing GPRS Tunneling Protocol (GTP) extension headers. This makes the detection engine enter an infinite loop and restart…
Cisco disclosed a high-impact local privilege escalation vulnerability, CVE-2026-76462, in the Secure Firewall Posture module of Cisco Secure Client. The flaw is in the interprocess communication (IPC) channel and stems from insufficient validation of user-supplied input. An authenticated local attacker can send crafted IPC messages to a …
Cisco disclosed CVE-2026-20221, a vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine that affects multiple Cisco products. An unauthenticated, remote attacker can send a crafted GRE payload through an affected device to trigger an unexpected restart of the engine. Dependin…
Cisco disclosed CVE-2026-76524, a high-severity vulnerability in the control channel socket implementation of Open Source Snort 3. An authenticated local attacker with low privileges could execute arbitrary commands as the Snort 3 process user. A successful exploit also allows reading and writing Snort 3 process memory. Cisco has released…
Cisco published a security hardening release for its Unified Communications portfolio on October 21, 2026. It covers Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Unified CM IM&P, Unified CM SME and Cisco Unity Connection. The vulnerabilities were found during an intern…
Cisco disclosed a critical vulnerability, CVE-2026-76466, in the database service of Cisco Expressway Series (Expressway-C and Expressway-E). An unauthenticated remote attacker with network access could execute arbitrary operating system commands as root. The flaw stems from the use of persistent cookies and insufficient client certificat…
Cisco published a security hardening release for the Cisco Expressway Series (Expressway-C core and Expressway-E edge devices) addressing multiple vulnerabilities found during an internal security review. Cisco states the flaws were discovered in internal testing and are not known to be actively exploited. The issues are grouped by CWE cl…
Cisco disclosed CVE-2026-20218, a stack buffer overflow in the Snort 3 Visual Basic for Applications (VBA) Decompression Engine that affects multiple Cisco products. An unauthenticated, remote attacker can send crafted VBA data to a targeted device, causing the Snort 3 Detection Engine to restart unexpectedly and producing a denial of ser…
Cisco's Open Source Snort 3 engineering team released software hardening updates for multiple vulnerabilities found during an internal security review, as part of Cisco's October 21, 2026 advisory bundle. The issues are grouped by Common Weakness Enumeration class, with one CVE ID per group. CVE-2026-20043 covers out-of-bounds writes (CWE…
Cisco disclosed CVE-2026-76487, an improper access control vulnerability in Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME). An unauthenticated, remote attacker could send a crafted HTTP request to an affected device and bypass access controls. A successful exploit could give th…
Cisco published an advisory covering multiple vulnerabilities in the Snort 3 Detection Engine that affect several Cisco products. An unauthenticated, remote attacker could force the engine to restart unexpectedly, causing a denial of service (DoS). Cisco rates the Security Impact Rating as Medium and has released software updates. No work…
Cisco disclosed CVE-2026-20011, a medium-severity vulnerability in the Snort 3 SMTP MIME Decoder affecting multiple Cisco products. An unauthenticated, remote attacker can cause the Snort 3 Detection Engine to restart, producing a denial-of-service condition. Cisco has released software updates, and no workarounds exist. The advisory is p…
Cisco disclosed CVE-2026-76505, a High-rated vulnerability in the IPv4 packet processing of Cisco IOS XR Software on Cisco ASR 9000 and 9900 Series routers and ASR 9902/9903 Compact High-Performance Routers. An unauthenticated, remote attacker can send crafted IPv4 packets that trigger network processor (NP) errors, resetting or shutting …
Cisco disclosed CVE-2026-76435, an information disclosure vulnerability in Cisco Expressway Series (Expressway-C and Expressway-E). An unauthenticated, remote attacker can obtain sensitive information from an affected device. Cisco rates the Security Impact as Medium. Software updates are available, there are no workarounds, and the artic…
Cisco disclosed CVE-2026-20327, a blind SQL injection vulnerability in the web-based management interface of Cisco Unified Intelligence Center. An authenticated, local attacker could send a crafted request and read the contents of the device's internal database. Cisco rates the Security Impact as Medium. Software updates are available and…
Cisco published a September 2026 hardening release for Cisco Secure Firewall ASA, Secure Firewall Threat Defense (FTD) and Secure Firewall Management Center (FMC) software. It addresses multiple vulnerabilities found during an internal security review. Cisco rates the advisory Critical and states that two of the issues are known to be act…
Cisco disclosed CVE-2026-20154, a high-severity vulnerability in the system rate-limiting process for syslog message 419002 in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. An unauthenticated, remote attacker can cause high CPU utilization on an affected device, r…
Cisco updated its advisory for CVE-2024-20260, a denial-of-service vulnerability in the VPN and management web servers of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. The original version covered only the ASAv and FTDv virtual models, but Cisco later found that a…
Cisco has disclosed multiple vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) that could let a remote attacker access or manipulate data, obtain sensitive information, or cause a reload of certificate and key material on an affected device. The advisory (cisco-sa-ise-multiauth-bypa…
