Vulnerabilities

DATE CVE VULNERABILITY TITLE RISK
2025-05-07 CVE-2023-7303 A vulnerability, which was classified as problematic, was found in q2apro q2apro-on-site-notifications up to 1.4.6.
network
low complexity
CWE-94
3.5
3.5
2025-05-07 CVE-2025-20122 A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, local attacker to gain privileges of the root user on the underlying operating system. This vulnerability is due to insufficient input validation.
local
low complexity
CWE-300
7.8
7.8
2025-05-07 CVE-2025-20137 A vulnerability in the access control list (ACL) programming of Cisco IOS Software that is running on Cisco Catalyst 1000 Switches and Cisco Catalyst 2960L Switches could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to the use of both an IPv4 ACL and a dynamic ACL of IP Source Guard on the same interface, which is an unsupported configuration.
low complexity
CWE-284
4.7
4.7
2025-05-07 CVE-2025-20140 A vulnerability in the Wireless Network Control daemon (wncd) of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, adjacent wireless attacker to cause a denial of service (DoS) condition. This vulnerability is due to improper memory management.
low complexity
CWE-789
7.4
7.4
2025-05-07 CVE-2025-20147 A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to conduct a stored cross-site scripting attack (XSS) on an affected system.  This vulnerability is due to improper sanitization of user input to the web-based management interface.
network
low complexity
CWE-79
5.4
5.4
2025-05-07 CVE-2025-20151 A vulnerability in the implementation of the Simple Network Management Protocol Version 3 (SNMPv3) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to poll an affected device using SNMP, even if the device is configured to deny SNMP traffic from an unauthorized source or the SNMPv3 username is removed from the configuration. This vulnerability exists because of the way that the SNMPv3 configuration is stored in the Cisco IOS Software and Cisco IOS XE Software startup configuration.
network
low complexity
CWE-16
4.3
4.3
2025-05-07 CVE-2025-20154 A vulnerability in the Two-Way Active Measurement Protocol (TWAMP) server feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the affected device to reload, resulting in a denial of service (DoS) condition.
network
low complexity
CWE-20
8.6
8.6
2025-05-07 CVE-2025-20155 A vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, local attacker to write arbitrary files to an affected system. This vulnerability is due to insufficient input validation of the bootstrap file that is read by the system software when a device is first deployed in SD-WAN mode or when an administrator configures SD-Routing on the device.
local
low complexity
CWE-1287
6.0
6.0
2025-05-07 CVE-2025-20157 A vulnerability in certificate validation processing of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an unauthenticated, remote attacker to gain access to sensitive information. This vulnerability is due to improper validation of certificates that are used by the Smart Licensing feature.
network
high complexity
CWE-295
5.9
5.9
2025-05-07 CVE-2025-20162 A vulnerability in the DHCP snooping security feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a full interface queue wedge, which could result in a denial of service (DoS) condition. This vulnerability is due to improper handling of DHCP request packets.
network
low complexity
CWE-400
8.6
8.6