18.4.4

DATE	CVE	VULNERABILITY TITLE	RISK
2020-03-19	CVE-2020-3266	OS Command Injection vulnerability in Cisco Sd-Wan Firmware A vulnerability in the CLI of Cisco SD-WAN Solution software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. local low complexity cisco CWE-78	7.8
2020-03-19	CVE-2020-3265	Improper Privilege Management vulnerability in Cisco Sd-Wan Firmware A vulnerability in Cisco SD-WAN Solution software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. local low complexity cisco CWE-269	7.8
2020-03-19	CVE-2020-3264	Classic Buffer Overflow vulnerability in Cisco Sd-Wan Firmware A vulnerability in Cisco SD-WAN Solution software could allow an authenticated, local attacker to cause a buffer overflow on an affected device. local low complexity cisco CWE-120	7.1
2020-03-19	CVE-2019-16012	SQL Injection vulnerability in Cisco Sd-Wan Firmware A vulnerability in the web UI of Cisco SD-WAN Solution vManage software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. network low complexity cisco CWE-89	8.1
2020-03-19	CVE-2019-16010	Cross-site Scripting vulnerability in Cisco Sd-Wan Firmware A vulnerability in the web UI of the Cisco SD-WAN vManage software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the vManage software. network low complexity cisco CWE-79	4.8
2019-11-26	CVE-2019-16002	Cross-Site Request Forgery (CSRF) vulnerability in Cisco Sd-Wan Firmware A vulnerability in the vManage web-based UI (web UI) of the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. network cisco CWE-352	4.3
2019-08-08	CVE-2019-1951	Unspecified vulnerability in Cisco Sd-Wan Firmware A vulnerability in the packet filtering features of Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to bypass L3 and L4 traffic filters. network low complexity cisco	5.0