Design/Logic Flaw

The upload-dialog implementation in Cisco Identity Services Engine ISE allows remote authenticated users to upload files with an arbitrary file type, and consequently conduct attacks against unspecified other systems, via a crafted file, aka Bug ID CSCui67511...

Design/Logic Flaw

The Sponsor Portal in Cisco Identity Services Engine ISE uses weak permissions for uploaded files, which allows remote attackers to read arbitrary files via a direct request, aka Bug ID CSCui67506...

CVE-2013-5540

The file-upload feature in Cisco Identity Services Engine ISE allows remote authenticated users to cause a denial of service disk consumption and administration-interface outage by uploading many files, aka Bug ID CSCui67519...

CVE-2013-5541

Cross-site scripting XSS vulnerability in the file-upload interface in Cisco Identity Services Engine ISE allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename, aka Bug ID CSCui67495...

CVE-2013-5524

Cross-site scripting XSS vulnerability in the troubleshooting page in Cisco Identity Services Engine ISE 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCug77655...

CVE-2013-5525

SQL injection vulnerability in the web framework in Cisco Identity Services Engine ISE 1.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCug90502...

Sql injection

SQL injection vulnerability in the web framework in Cisco Identity Services Engine ISE 1.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCug90502...

CVE-2013-5525

SQL injection vulnerability in the web framework in Cisco Identity Services Engine ISE 1.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCug90502...

CVE-2013-5504

Cross-site scripting XSS vulnerability in the Mobile Device Management MDM portal in Cisco Identity Services Engine ISE allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui30266...

CVE-2013-3471

The captive portal application in Cisco Identity Services Engine ISE allows remote attackers to discover cleartext usernames and passwords by leveraging unspecified use of hidden form fields in an HTML document, aka Bug ID CSCug02515...

CVE-2013-3471

CVE-2013-3471 concerns Cisco Identity Services Engine (ISE) – captive portal. The issue arises from improper use of hidden HTML form fields in the portal, enabling an attacker to discover cleartext usernames and passwords. The vulnerability can be exploited remotely by unauthenticated or minimall...

Cisco ISE Captive Portal Application Plaintext Credentials Exposure Vulnerability

A vulnerability in the captive portal application of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker or local, authenticated attacker to potentially gain access to the username and password of an authenticated session. The vulnerability is due to improper use of...

Cisco Identity Services Engine Software Administration Panel Cross-Site Scripting Vulnerability

A vulnerability in the search form of the Cisco ISE administration/monitoring panel could allow an unauthenticated, remote attacker to send a malicious script to an unsuspecting user. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by convincing...

Cross site scripting

Cross-site scripting XSS vulnerability in the search form in the administration/monitoring panel on the Cisco Identity Services Engine ISE allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCuh87036...

CVE-2012-3908

Multiple cross-site request forgery CSRF vulnerabilities in the ISE Administrator user interface aka the Apache Tomcat interface on Cisco Identity Services Engine ISE 3300 series appliances before 1.1.0.665 Cumulative Patch 1 allow remote attackers to hijack the authentication of administrators,...