Categories
NVD NVD Nist GOV

NVD – CVE-2021-1525

CVE-2021-1525 Detail

Awaiting Analysis


This vulnerability is currently awaiting analysis.

Description

A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to redirect users to a malicious file. This vulnerability is due to improper validation of URL paths in the application interface. An attacker could exploit this vulnerability by persuading a user to follow a specially crafted URL that is designed to cause Cisco Webex Meetings to include a remote file in the web UI. A successful exploit could allow the attacker to cause the application to offer a remote file to a user, which could allow the attacker to conduct further phishing or spoofing attacks.

Severity

CVSS 3.x Severity and Metrics:

CVSS 2.0 Severity and Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Weakness Enumeration

CWE-ID CWE Name Source
CWE-601 URL Redirection to Untrusted Site (‘Open Redirect’) Cisco Systems, Inc.  

Change History

0 change records found show changes

Quick Info

CVE Dictionary Entry:
CVE-2021-1525
NVD Published Date:
06/04/2021
NVD Last Modified:
06/04/2021
Source:
Cisco Systems, Inc.

Categories
NVD NVD Nist GOV

NVD – CVE-2021-1526

CVE-2021-1526 Detail

Awaiting Analysis


This vulnerability is currently awaiting analysis.

Description

A vulnerability in Cisco Webex Player for Windows and MacOS could allow an attacker to execute arbitrary code on an affected system. This vulnerability is due to insufficient validation of values in Webex recording files that are in Webex Recording Format (WRF). An attacker could exploit this vulnerability by sending a user a malicious WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.

Severity

CVSS 3.x Severity and Metrics:

CVSS 2.0 Severity and Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Weakness Enumeration

CWE-ID CWE Name Source
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer Cisco Systems, Inc.  

Change History

0 change records found show changes

Quick Info

CVE Dictionary Entry:
CVE-2021-1526
NVD Published Date:
06/04/2021
NVD Last Modified:
06/04/2021
Source:
Cisco Systems, Inc.

Categories
NVD NVD Nist GOV

NVD – CVE-2021-1527

CVE-2021-1527 Detail

Awaiting Analysis


This vulnerability is currently awaiting analysis.

Description

A vulnerability in Cisco Webex Player for Windows and MacOS could allow an attacker to cause the affected software to terminate or to gain access to memory state information that is related to the vulnerable application. The vulnerability is due to insufficient validation of values in Webex recording files that are stored in Webex Recording Format (WRF). An attacker could exploit this vulnerability by sending a malicious WRF file to a user as a link or email attachment and then persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to crash the affected software and view memory state information.

Severity

CVSS 3.x Severity and Metrics:

CVSS 2.0 Severity and Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Weakness Enumeration

CWE-ID CWE Name Source
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer Cisco Systems, Inc.  

Change History

0 change records found show changes

Quick Info

CVE Dictionary Entry:
CVE-2021-1527
NVD Published Date:
06/04/2021
NVD Last Modified:
06/04/2021
Source:
Cisco Systems, Inc.

Categories
NVD NVD Nist GOV

NVD – CVE-2021-1528

CVE-2021-1528 Detail

Awaiting Analysis


This vulnerability is currently awaiting analysis.

Description

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges on an affected system. This vulnerability exists because the affected software does not properly restrict access to privileged processes. An attacker could exploit this vulnerability by invoking a privileged process in the affected system. A successful exploit could allow the attacker to perform actions with the privileges of the root user.

Severity

CVSS 3.x Severity and Metrics:

CVSS 2.0 Severity and Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Weakness Enumeration

CWE-ID CWE Name Source
CWE-250 Execution with Unnecessary Privileges Cisco Systems, Inc.  

Change History

0 change records found show changes

Quick Info

CVE Dictionary Entry:
CVE-2021-1528
NVD Published Date:
06/04/2021
NVD Last Modified:
06/04/2021
Source:
Cisco Systems, Inc.

Categories
NVD NVD Nist GOV

NVD – CVE-2021-1536

CVE-2021-1536 Detail

Awaiting Analysis


This vulnerability is currently awaiting analysis.

Description

A vulnerability in Cisco Webex Meetings Desktop App for Windows, Cisco Webex Meetings Server, Cisco Webex Network Recording Player for Windows, and Cisco Webex Teams for Windows could allow an authenticated, local attacker to perform a DLL injection attack on an affected device. To exploit this vulnerability, the attacker must have valid credentials on the Windows system. This vulnerability is due to incorrect handling of directory paths at run time. An attacker could exploit this vulnerability by inserting a configuration file in a specific path in the system, which can cause a malicious DLL file to be loaded when the application starts. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of another user account.

Severity

CVSS 3.x Severity and Metrics:

CVSS 2.0 Severity and Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Weakness Enumeration

CWE-ID CWE Name Source
CWE-427 Uncontrolled Search Path Element Cisco Systems, Inc.  

Change History

0 change records found show changes

Quick Info

CVE Dictionary Entry:
CVE-2021-1536
NVD Published Date:
06/04/2021
NVD Last Modified:
06/04/2021
Source:
Cisco Systems, Inc.

Categories
NVD NVD Nist GOV

NVD – CVE-2021-1537

CVE-2021-1537 Detail

Awaiting Analysis


This vulnerability is currently awaiting analysis.

Description

A vulnerability in the installer software of Cisco ThousandEyes Recorder could allow an unauthenticated, local attacker to access sensitive information that is contained in the ThousandEyes Recorder installer software. This vulnerability exists because sensitive information is included in the application installer. An attacker could exploit this vulnerability by downloading the installer and extracting its contents. A successful exploit could allow the attacker to access sensitive information that is included in the application installer.

Severity

CVSS 3.x Severity and Metrics:

CVSS 2.0 Severity and Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Weakness Enumeration

CWE-ID CWE Name Source
CWE-522 Insufficiently Protected Credentials Cisco Systems, Inc.  

Change History

0 change records found show changes

Quick Info

CVE Dictionary Entry:
CVE-2021-1537
NVD Published Date:
06/04/2021
NVD Last Modified:
06/04/2021
Source:
Cisco Systems, Inc.

Categories
NVD NVD Nist GOV

NVD – CVE-2021-1538

CVE-2021-1538 Detail

Awaiting Analysis


This vulnerability is currently awaiting analysis.

Description

A vulnerability in the configuration dashboard of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to execute arbitrary code. This vulnerability is due to insufficient sanitization of configuration entries. An attacker could exploit this vulnerability by logging in as a super admin and entering crafted input to configuration options on the CSPC configuration dashboard. A successful exploit could allow the attacker to execute remote code as root.

Severity

CVSS 3.x Severity and Metrics:

CVSS 2.0 Severity and Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Weakness Enumeration

CWE-ID CWE Name Source
CWE-78 Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) Cisco Systems, Inc.  

Change History

0 change records found show changes

Quick Info

CVE Dictionary Entry:
CVE-2021-1538
NVD Published Date:
06/04/2021
NVD Last Modified:
06/04/2021
Source:
Cisco Systems, Inc.

Categories
NVD NVD Nist GOV

NVD – CVE-2021-1539

CVE-2021-1539 Detail

Awaiting Analysis


This vulnerability is currently awaiting analysis.

Description

Multiple vulnerabilities in the authorization process of Cisco ASR 5000 Series Software (StarOS) could allow an authenticated, remote attacker to bypass authorization and execute a subset of CLI commands on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

Severity

CVSS 3.x Severity and Metrics:

CVSS 2.0 Severity and Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Weakness Enumeration

CWE-ID CWE Name Source
CWE-863 Incorrect Authorization Cisco Systems, Inc.  

Change History

0 change records found show changes

Quick Info

CVE Dictionary Entry:
CVE-2021-1539
NVD Published Date:
06/04/2021
NVD Last Modified:
06/04/2021
Source:
Cisco Systems, Inc.

Categories
NVD NVD Nist GOV

NVD – CVE-2021-1540

CVE-2021-1540 Detail

Awaiting Analysis


This vulnerability is currently awaiting analysis.

Description

Multiple vulnerabilities in the authorization process of Cisco ASR 5000 Series Software (StarOS) could allow an authenticated, remote attacker to bypass authorization and execute a subset of CLI commands on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

Severity

CVSS 3.x Severity and Metrics:

CVSS 2.0 Severity and Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Weakness Enumeration

CWE-ID CWE Name Source
CWE-863 Incorrect Authorization Cisco Systems, Inc.  

Change History

0 change records found show changes

Quick Info

CVE Dictionary Entry:
CVE-2021-1540
NVD Published Date:
06/04/2021
NVD Last Modified:
06/04/2021
Source:
Cisco Systems, Inc.

Categories
NVD NVD Nist GOV

NVD – CVE-2021-1544

CVE-2021-1544 Detail

Awaiting Analysis


This vulnerability is currently awaiting analysis.

Description

A vulnerability in logging mechanisms of Cisco Webex Meetings client software could allow an authenticated, local attacker to gain access to sensitive information. This vulnerability is due to unsafe logging of application actions. An attacker could exploit this vulnerability by logging onto the local system and accessing files containing the logged details. A successful exploit could allow the attacker to gain access to sensitive information, including meeting data and recorded meeting transcriptions.

Severity

CVSS 3.x Severity and Metrics:

CVSS 2.0 Severity and Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Weakness Enumeration

CWE-ID CWE Name Source
CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere Cisco Systems, Inc.  

Change History

0 change records found show changes

Quick Info

CVE Dictionary Entry:
CVE-2021-1544
NVD Published Date:
06/04/2021
NVD Last Modified:
06/04/2021
Source:
Cisco Systems, Inc.