Hi,
from my understanding, the platform is not relevant for ISE application related SAs.
If there is a vulnerability in Windows, Linux or a database application, it doesn't matter if it runs on a VM or not. If there is a vulnerability in the CIMC or BIOS of the ISE (UCS part of the system), it's another thing.
Regarding the other complains:
>> Although it states that the BUG is fixed, but there is no mention of specific version or patch in which the BUG is fixed.
This was and is currently most always the case with the bug toolkit. The product, fixed and affected information is typically useless, UNLESS the specific release you are interested in is listed there.
Missing or inaccurate information is unfortunately a default in the bug toolkit. Sorry :)
Some of the issues are marked as fixed, because these are fixed in the Cisco code repository, but NOT in a published release.
If you want detailed information whether you are affected by a bug or SA, my advise is to open a TAC case!
