Cisco Identity Services Engine Software vulnerabilities
54 known vulnerabilities in Cisco Identity Services Engine Software from Cisco. 54 are rated high or critical, and 3 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 10.0 Critical severity
Cisco Identity Services Engine Incorrect Use of Privileged APIs Exploited
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vuln
- 7.6 High severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation of certain parameters that are concatenated directly into
- 7.2 High severity
Cisco Identity Services Engine Software: Relative Path Traversal
A vulnerability in the REST API of Cisco ISE could allow an authenticated, remote attacker to upload or copy arbitrary files on an affected device. This vulnerability is due to insufficient validation in file operations. An attacker could exploit this vulnerab
- 8.6 High severity
Cisco Identity Services Engine Software: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability in the RADIUS feature of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of certain RADIUS r
- 7.1 High severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability in Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected device. To exploit this vulnerability, the attacker must have at least low-privileged administrative credentials. This vulnerability is d
- 9.1 Critical severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements in Data Query Logic
A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks. This vulnerability is due to insufficient validation of user-supplied input in REST API calls. An attacker could exploit this vulne
- 7.5 High severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability in Cisco ISE could allow an unauthenticated, remote attacker to conduct SQL injection attacks on an affected device. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sendin
- 10.0 Critical severity
Cisco Identity Services Engine Software: Authentication Bypass by Spoofing
A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected device. This vulnerability is due to the REST API web service being exposed with insufficient authorizat
- 9.1 Critical severity
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco…
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), engineering teams have conducted a comprehensive internal security review. This review
- 9.1 Critical severity
Cisco Identity Services Engine Software: Deserialization of Untrusted Data
A vulnerability in Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid high-privileged administrative creden
- 9.1 Critical severity
Cisco Identity Services Engine Software: Incorrect Resource Transfer Between Spheres
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), engineering teams have conducted a comprehensive internal security review. This review
- 10.0 Critical severity
Cisco Identity Services Engine Software: Improper Access Control
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams have conducted a comprehensive internal security review. This review
- 9.1 Critical severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements used in a Command
A vulnerability in Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid high-privileged administrative creden
- 10.0 Critical severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements in Output Used by a Downstream Component
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), engineering teams have conducted a comprehensive internal security review. This review
- 9.9 Critical severity
Cisco Identity Services Engine Software: Deserialization of Untrusted Data
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at le
- 9.1 Critical severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements used in an OS Command
A vulnerability in the REST API of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have
- 9.1 Critical severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements used in an OS Command
A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attac
- 9.9 Critical severity
Cisco Identity Services Engine Software: Insufficiently Protected Credentials
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams have conducted a comprehensive internal security review. This review
- 7.5 High severity
Cisco Identity Services Engine Software: Improper Authorization
A vulnerability in Cisco ISE and ISE-PIC could allow an unauthenticated, remote attacker to view sensitive information on an affected device. This vulnerability is due to improper authorization checks when a resource is accessed. An attacker could exploit this
- 9.1 Critical severity
Cisco Identity Services Engine Software: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid administrative credential
- 9.9 Critical severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements used in a Command
A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least Read On
- 9.9 Critical severity
Cisco Identity Services Engine Software: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least Read On
- 9.9 Critical severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements used in a Command
A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid administrative cred
- 7.5 High severity
Cisco Identity Services Engine Software: Incorrect Comparison
A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause Cisco ISE to restart unexpectedly. This vulnerability is due to a
- 10.0 Critical severity
Cisco Identity Services Engine Injection Exploited
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerabi
- 7.2 High severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system as root. This vulnerability is due to insufficient validation of user-supplied input. An
- 7.2 High severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system as root. This vulnerability is due to insufficient validation of user-supplied input. An
- 10.0 Critical severity
Cisco Identity Services Engine Software: Improper Privilege Management
A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device and then execute those files on the underlying operating system as root. This vulnerability is due
- 10.0 Critical severity
Cisco Identity Services Engine Injection Exploited
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerabi
- 9.8 Critical severity
Cisco Identity Services Engine Software: Use of Hard-coded Password
A vulnerability in Amazon Web Services (AWS), Microsoft Azure, and Oracle Cloud Infrastructure (OCI) cloud deployments of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to access sensitive data, execute limited administrat
- 7.2 High severity
Cisco Identity Services Engine Software: Unrestricted Upload of File with Dangerous Type
A vulnerability in the API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker with administrative privileges to upload files to an affected device. This vulnerability is due
- 8.6 High severity
Cisco Identity Services Engine Software: Out-of-bounds Read
A vulnerability in the RADIUS message processing feature of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling
- 7.2 High severity
Cisco Identity Services Engine Software: Missing Authorization
A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker with valid read-only credentials to obtain sensitive information, change node configurations, and restart the node. This vulnerability is due to a lack of authorization in a s
- 7.2 High severity
Cisco Identity Services Engine Software: Deserialization of Untrusted Data
A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands as the root user on an affected device. This vulnerability is due to insecure deserialization of user-supplied Java byte streams by the affected
- 7.2 High severity
Cisco Identity Services Engine Software: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to upload files to arbitrary locations on the underlying operating system of an affected device. To exploit this vulnerability, an attacker would need valid Super Admin
- 8.8 High severity
Cisco Identity Services Engine Software: Cross-Site Request Forgery
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. This vulner
- 8.1 High severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements used in an SQL Command
Multiple vulnerabilities in the REST API of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct blind SQL injection attacks. These vulnerabilities are due to insufficient validation of user-supplied input in REST API c
- 7.2 High severity
Cisco Identity Services Engine Software: Unrestricted Upload of File with Dangerous Type
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to upload arbitrary files to an affected device. To exploit this vulnerability, an attacker would need at least valid Po
- 8.8 High severity
Cisco Identity Services Engine Software: Cross-Site Request Forgery
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. This vulner
- 8.8 High severity
Cisco Identity Services Engine Software: Improper Protection of Alternate Path
A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to upload malicious files to the web root of the application. This vulnerability is due to insufficient file input validation.