cisco-sa-20190215-runc
Cisco PSIRTExploitedVulnCheck KEV listedHIGH2019-02-15
Container Privilege Escalation Vulnerability Affecting Cisco Products: February 2019
CVEs:CVE-2019-5736
Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity). 2 are already weaponised in the wild — see the Exploited section.
The advisories below are ordered by the Vulnetix risk prioritization strategy: exploitation evidence first, scores second. On the interactive page you can switch to three other lenses.
Container Privilege Escalation Vulnerability Affecting Cisco Products: February 2019
CVEs:CVE-2019-5736
Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability
CVEs:CVE-2019-1663
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| CVRFPID-212336 | affected | Cisco | — | — |
| CVRFPID-212341 | affected | Cisco | — | — |
| CVRFPID-212498 | affected | Cisco | — | — |
Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools Update Service Command Injection Vulnerability
CVEs:CVE-2019-1674
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| CVRFPID-97148 | affected | Cisco | — | — |
| CVRFPID-97151 | affected | Cisco | — | — |
| CVRFPID-97163 | affected | Cisco | — | — |
| CVRFPID-97166 | affected | Cisco | — | — |
Cisco Network Convergence System 1000 Series TFTP Directory Traversal Vulnerability
CVEs:CVE-2019-1681
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| CVRFPID-255125 | affected | Cisco | — | — |
Cisco IoT Field Network Director XML External Entity Vulnerability
CVEs:CVE-2019-1698
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| CVRFPID-227605 | affected | Cisco | — | — |
Cisco Aironet Active Sensor Static Credentials Vulnerability
CVEs:CVE-2019-1675
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| CVRFPID-254689 | affected | Cisco | — | — |
Cisco Firepower Threat Defense Software SSL or TLS Denial of Service Vulnerability
CVEs:CVE-2019-1691
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| CVRFPID-220203 | affected | Cisco | — | — |
Cisco HyperFlex Unauthenticated Statistics Retrieval Vulnerability
CVEs:CVE-2019-1666
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| CVRFPID-230814 | affected | Cisco | — | — |
Cisco TelePresence Management Suite Web Services
CVEs:CVE-2019-1660
Cisco TelePresence Conductor, Cisco Expressway Series, and Cisco TelePresence Video Communication Server REST API Server-Side Request Forgery Vulnerability
CVEs:CVE-2019-1679
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| CVRFPID-202683 | affected | Cisco | — | — |
| CVRFPID-203755 | affected | Cisco | — | — |
| CVRFPID-209614 | affected | Cisco | — | — |
Cisco Meeting Server SIP Processing Denial of Service Vulnerability
CVEs:CVE-2019-1676
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| CVRFPID-217166 | affected | Cisco | — | — |
Cisco Prime Collaboration Assurance Software Unauthenticated Access Vulnerability
CVEs:CVE-2019-1662
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| CVRFPID-209582 | affected | Cisco | — | — |
Cisco Web Security Appliance Decryption Policy Bypass Vulnerability
CVEs:CVE-2019-1672
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| CVRFPID-189789 | affected | Cisco | — | — |
Cisco Webex Teams for iOS Arbitrary File Upload Vulnerability
CVEs:CVE-2019-1689
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| CVRFPID-210403 | affected | Cisco | — | — |
Cisco Webex Meetings Online Content Injection Vulnerability
CVEs:CVE-2019-1680
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| CVRFPID-97151 | affected | Cisco | — | — |
Cisco Meeting Server Denial of Service Vulnerability
CVEs:CVE-2019-1678
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| CVRFPID-217166 | affected | Cisco | — | — |
Cisco Unity Connection Reflected Cross-Site Scripting Vulnerability
CVEs:CVE-2019-1685
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| CVRFPID-73608 | affected | Cisco | — | — |
Cisco Unified Intelligence Center Software Cross-Site Scripting Vulnerability
CVEs:CVE-2019-1670
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| CVRFPID-198393 | affected | Cisco | — | — |
| CVRFPID-92631 | affected | Cisco | — | — |
Cisco Firepower Management Center Cross-Site Scripting Vulnerability
CVEs:CVE-2019-1671
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| CVRFPID-212162 | affected | Cisco | — | — |
Cisco TelePresence Management Suite Cross-Site Scripting Vulnerability
CVEs:CVE-2019-1661
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| CVRFPID-191859 | affected | Cisco | — | — |
Cisco HyperFlex Software Command Injection Vulnerability
CVEs:CVE-2018-15380
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| CVRFPID-247050 | affected | Cisco | — | — |
Cisco Hyperflex Stored Cross-Site Scripting Vulnerability
CVEs:CVE-2019-1665
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| CVRFPID-230814 | affected | Cisco | — | — |
Cisco SPA112, SPA525, and SPA5x5 Series IP Phones Certificate Validation Vulnerability
CVEs:CVE-2019-1683
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| CVRFPID-117236 | affected | Cisco | — | — |
| CVRFPID-255654 | affected | Cisco | — | — |
Cisco Prime Infrastructure Certificate Validation Vulnerability
CVEs:CVE-2019-1659
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| CVRFPID-190324 | affected | Cisco | — | — |
Cisco Identity Services Engine Cross-Site Scripting Vulnerability
CVEs:CVE-2019-1673
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| CVRFPID-111903 | affected | Cisco | — | — |
Cisco IP Phone 7800 and 8800 Series Cisco Discovery Protocol and Link Layer Discovery Protocol Denial of Service Vulnerability
CVEs:CVE-2019-1684
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| CVRFPID-205455 | affected | Cisco | — | — |
| CVRFPID-211541 | affected | Cisco | — | — |
| CVRFPID-238624 | affected | Cisco | — | — |
Cisco Firepower 9000 Series Firepower 2-Port 100G Double-Width Network Module Queue Wedge Denial of Service Vulnerability
CVEs:CVE-2019-1700
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| CVRFPID-225888 | affected | Cisco | — | — |
Cisco Webex Meetings for Android Cross-Site Scripting Vulnerability
CVEs:CVE-2019-1677
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| CVRFPID-203919 | affected | Cisco | — | — |
Cisco HyperFlex Software Unauthenticated Root Access Vulnerability
CVEs:CVE-2019-1664
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| CVRFPID-230814 | affected | Cisco | — | — |
Cisco Network Assurance Engine CLI Access with Default Password Vulnerability
CVEs:CVE-2019-1688
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| CVRFPID-255985 | affected | Cisco | — | — |
Cisco HyperFlex Arbitrary Statistics Write Vulnerability
CVEs:CVE-2019-1667
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| CVRFPID-230814 | affected | Cisco | — | — |
Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.