CVE-2018-0383: Protection Mechanism Failure

A vulnerability in the detection engine of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass a file policy that is configured to block the transfer of files to an affected system via FTP. The vulnerability exists because the affected software incorrectly...

CVE-2018-0384: Protection Mechanism Failure

A vulnerability in the detection engine of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass a URL-based access control policy that is configured to block traffic for an affected system. The vulnerability exists because the affected software incorrectly...

CVE-2018-0333

A vulnerability in the VPN configuration management of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass VPN security due to unintended side effects of dynamic configuration changes that could allow an attacker to bypass configured policies. The vulnerabili...

CVE-2018-0333

A vulnerability in the VPN configuration management of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass VPN security due to unintended side effects of dynamic configuration changes that could allow an attacker to bypass configured policies. The vulnerabili...

CVE-2018-0333: Protection Mechanism Failure

A vulnerability in the VPN configuration management of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass VPN security due to unintended side effects of dynamic configuration changes that could allow an attacker to bypass configured policies. The vulnerabili...

CVE-2017-6735

A vulnerability in the backup and restore functionality of Cisco FireSIGHT System Software could allow an authenticated, local attacker to execute arbitrary code on a targeted system. More Information: CSCvc91092. Known Affected Releases: 6.2.0 6.2.1...

CVE-2017-6735: Improper Input Validation

A vulnerability in the backup and restore functionality of Cisco FireSIGHT System Software could allow an authenticated, local attacker to execute arbitrary code on a targeted system. More Information: CSCvc91092. Known Affected Releases: 6.2.0 6.2.1...

Cisco Firepower Management Center and Cisco FireSIGHT System Software Malicious Software Detection Bypass Vulnerability

A vulnerability in the malicious file detection and blocking features of Cisco Firepower Management Center and Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass malware detection mechanisms on an affected system. The vulnerability is due to the incorrect...

CVE-2016-6417: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Cisco FireSIGHT System Software 4.10.2 through 6.1.0 and Firepower Management Center allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCva21636...

CVE-2016-6420: Exposure of Sensitive Information to an Unauthorized Actor

Cisco FireSIGHT System Software 4.10.3 through 5.4.0 in Firepower Management Center allows remote authenticated users to bypass authorization checks and gain privileges via a crafted HTTP request, aka Bug ID CSCur25467...

PT-2016-6891

Name of the Vulnerable Software and Affected Versions Cisco FireSIGHT System Software versions 4.10.2 through 6.1.0 Firepower Management Center affected versions not specified Description The issue is related to a cross-site request forgery CSRF vulnerability, which allows remote attackers to...

CVE-2016-6395

Cisco Firepower Management Center and FireSIGHT System Software are affected by CVE-2016-6395; the web-based management interface vulnerability allows remote authenticated users to inject arbitrary script or HTML via a crafted URL (XSS) in versions before 6.1. The issue is associated with Bug ID ...

CVE-2016-6394: Undefined Security Weakness

Session fixation vulnerability in Cisco Firepower Management Center and Cisco FireSIGHT System Software through 6.1.0 allows remote attackers to hijack web sessions via a session identifier, aka Bug ID CSCuz80503...

PT-2016-6872

Name of the Vulnerable Software and Affected Versions Cisco Firepower Management Center versions prior to 6.1 Cisco FireSIGHT System Software versions prior to 6.1 Description The issue allows remote attackers to bypass malware detection via crafted fields in HTTP headers when certain malware...

Cisco FireSIGHT System Software Snort Rule Bypass Vulnerability

A vulnerability in Snort rule detection in Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass configured rules that use Snort detection. The vulnerability is due to improper handling of HTTP header parameters. An attacker could exploit this vulnerability by...

PT-2016-4811

Name of the Vulnerable Software and Affected Versions Cisco FireSIGHT System Software versions 5.3.0 through 6.0.1 Description The issue allows remote attackers to bypass Snort rules via crafted parameters in the header of an HTTP packet. Recommendations For versions 5.3.0 through 6.0.1, consider...

CVE-2016-1463: Improper Input Validation

Cisco FireSIGHT System Software 5.3.0, 5.3.1, 5.4.0, 6.0, and 6.0.1 allows remote attackers to bypass Snort rules via crafted parameters in the header of an HTTP packet, aka Bug ID CSCuz20737...

CVE-2016-1345: Improper Input Validation

Cisco FireSIGHT System Software 5.4.0 through 6.0.1 and ASA with FirePOWER Services 5.4.0 through 6.0.0.1 allow remote attackers to bypass malware protection via crafted fields in HTTP headers, aka Bug ID CSCux22726...

PT-2016-4724

Name of the Vulnerable Software and Affected Versions Cisco FireSIGHT System Software versions 5.4.0 through 6.0.1 ASA with FirePOWER Services versions 5.4.0 through 6.0.0.1 Description The issue allows remote attackers to bypass malware protection. This is achieved via crafted fields in HTTP...

Cisco FireSIGHT System Software Multiple Vulnerabilities

A vulnerability in credential authentication for valid and invalid username-password pairs for Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to determine a list of valid usernames for an affected device. A vulnerability in the HTTP web-based management interface ...