Sql injection

A SQL Injection vulnerability in the web framework of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to execute unauthorized Structured Query Language SQL queries. The vulnerability is due to a failure to validate user-supplied input that is used in SQL queries. An...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Jabber for Windows, Mac, Android, and iOS could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is du...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due to...

CVE-2017-12349

Multiple vulnerabilities in the web-based management interface of Cisco UCS Central Software could allow a remote attacker to conduct a cross-site scripting XSS attack against a user of the affected interface or hijack a valid session ID from a user of the affected interface. Cisco Bug IDs:...

CVE-2017-12365

CVE-2017-12365 affects Cisco WebEx Event Center. A design flaw allows an authenticated, remote attacker to query the Event Center site and view both listed and unlisted meetings, enabling potential attendance of meetings not accessible to them. Root cause is a information-disclosure design weakne...

CVE-2017-12366

Cisco WebEx Meeting Center is affected by CVE-2017-12366 through insufficient input validation of parameters sent to the web server, enabling an unauthenticated, remote attacker to perform cross-site scripting (XSS). Exploitation requires convincing a user to follow a malicious link or intercepti...

CVE-2017-12340

CVE-2017-12340 affects Cisco NX-OS System Software on Cisco MDS Multilayer Director Switches, Nexus 7000, and Nexus 7700 series. The flaw is due to insufficient sanitization of user-supplied parameters in the Python scripting sandbox, enabling an authenticated, local attacker to escape the sandbo...

CVE-2017-12358

Cisco Jabber’s web-based management interface (Windows, Mac, Android, iOS) contains an XSS vulnerability due to insufficient input validation. An authenticated, remote attacker could entice a user to click a malicious link, potentially executing arbitrary script code in the interface or accessing...

CVE-2017-12360

CVE-2017-12360 is a vulnerability in Cisco WebEx Network Recording Player for WebEx Recording Format (WRF) files. The issue allows a remote attacker to cause a denial-of-service by convincing a user to open a malicious WRF file (delivered via email or URL), causing the affected WebEx Player to cr...

CVE-2017-12331

CVE-2017-12331 affects Cisco NX-OS System Software on Multilayer Director Switches, Nexus 7000/7700 Series, and UCS Manager. Root cause: insufficient NX-OS signature verification for software patches. An authenticated, local attacker with valid administrator credentials could bypass signature ver...

CVE-2017-12338

A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to read the contents of arbitrary files. The vulnerability is due to insufficient input validation for a specific CLI command. An attacker could exploit this vulnerability by issuing a crafted...

CVE-2017-12368

A "Cisco WebEx Network Recording Player Remote Code Execution Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced Recording Format ARF and WebEx Recording Format WRF files. A remote attacker could exploit this by providing a user with a malicious ARF or WRF file via email o...

CVE-2017-12354

A vulnerability in the web-based interface of Cisco Secure Access Control System ACS could allow an unauthenticated, remote attacker to view sensitive information on an affected system. The vulnerability exists because the affected software does not sufficiently protect system software version...

CVE-2017-12332

A vulnerability in Cisco NX-OS System Software patch installation could allow an authenticated, local attacker to write a file to arbitrary locations. The vulnerability is due to insufficient restrictions in the patch installation process. An attacker could exploit this vulnerability by installin...

CVE-2017-12339

A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient input validation of command arguments to the CLI parser. An attacker could exploit this vulnerability by injecting...

CVE-2017-12357

The CVE-2017-12357 issue affects Cisco Unified Communications Manager (CUCM) web-based administration interface. The vulnerability stems from improper validation of user-supplied input in the web UI, enabling an authenticated, remote attacker to persuade a user to click a crafted link and trigger...

CVE-2017-12372

CVE-2017-12372 is a Cisco WebEx Network Recording Player remote code execution vulnerability in ARF/WRF playback. The flaw allows a remote attacker to cause the affected WebEx players to crash and, in the worst case, execute arbitrary code on the user’s system when a malicious ARF or WRF file is ...

CVE-2017-12341

A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to perform a command injection attack. An attacker would need valid administrator credentials to perform this exploit. The vulnerability is due to insufficient input validation during the...

CVE-2017-12335

The CVE-2017-12335 issue is a Cisco NX-OS System Software CLI command-injection vulnerability caused by insufficient input validation. It affects multiple Nexus/NX-OS platforms (e.g., Multilayer Director Switches, Nexus 2000/3000/5000/5500/5600/6000/7000/9000 series, Nexus 9500 R, and UCS Manager...

CVE-2017-12363

CVE-2017-12363 affects Cisco WebEx Meeting Server. The vulnerability allows an unauthenticated, remote attacker to modify the welcome message of a meeting due to insufficient security settings on meetings. Connected documents confirm the impact is via modification of meeting welcome messages and ...