CVE-2015-6374

The web interface in Cisco Firepower Extensible Operating System 1.11.160 on Firepower 9000 devices does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, aka Bug ID...

CVE-2015-6368

CVE-2015-6368 affects Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices. It enables remote attackers to read files by sending crafted HTTP requests (unauthenticated access). Root cause: lack of proper authentication checks when a request to download/view a file is r...

CVE-2015-6370

The Management I/O MIO component in Cisco Firepower Extensible Operating System 1.11.160 on Firepower 9000 devices allows local users to execute arbitrary OS commands as root via crafted CLI input, aka Bug ID CSCux10578...

CVE-2015-6371

CVE-2015-6371 affects Cisco Firepower Extensible Operating System (FSO) 1.1(1.160) on Firepower 9000 devices. The issue arises from lack of input validation in parameters passed to certain user scripts, enabling remote authenticated users to read arbitrary files on the device via crafted script i...

CVE-2015-6370

The CVE-2015-6370 entry describes a local command-injection vulnerability in the Management I/O (MIO) CLI of Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices. The root cause is insufficient sanitization of user-supplied input in the CLI, allowing an authenticated l...

CVE-2015-6369

The CVE-2015-6369 issue affects Cisco Firepower Extensible Operating System on Firepower 9000 devices (1.1(1.160)) via the USB driver. Root cause: insufficient sanitization of USB input parameters that allows a crafted USB device to trigger invalid kernel commands, enabling a local, unauthenticat...

CVE-2015-6374

The CVE-2015-6374 vulnerability affects Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices, where the web interface inadequately restricts IFRAME usage. The root cause is insufficient input sanitization of iframe data in HTTP requests, enabling remote attackers to pe...

CVE-2015-6371

Cisco Firepower Extensible Operating System 1.11.160 on Firepower 9000 devices allows remote authenticated users to read arbitrary files via crafted parameters to unspecified scripts, aka Bug ID CSCux10621...

Cisco Firepower 9000 Series Local Denial of Service Vulnerability

Cisco Firepower 9000 is a set of Cisco Cisco running in the 9000 series of firewall devices in the operating system. A local denial of service vulnerability exists in Cisco Firepower 9000 Series. This vulnerability could be exploited by a local attacker to cause a denial of service...

Cisco Firepower 9000 Cross-Site Request Forgery Vulnerability

Cisco Firepower 9000 is a set of Cisco Cisco running in the 9000 series of firewall devices in the operating system. A cross-site request forgery vulnerability exists in Cisco Firepower 9000. This vulnerability could be exploited by remote attackers to perform unauthorized operations or access...

Cisco Firepower 9000 Series Switches Clickjacking Vulnerability

Cisco Firepower 9000 Series Switches are Cisco 9000 series switch products. A clickjacking vulnerability exists in Cisco Firepower 9000 Series Switches. This vulnerability could be exploited by remote attackers to compromise an affected device and obtain sensitive information...

Cisco Firepower 9000 Series Local Command Injection Vulnerability

Cisco Firepower 9000 is a set of Cisco Cisco running in the 9000 series of firewall devices in the operating system. A local command injection vulnerability exists in the Cisco Firepower 9000 Series. This vulnerability could be exploited by a local attacker to execute arbitrary commands with root...

Multiple Arbitrary File Read Vulnerabilities in Cisco Firepower 9000 Series

Cisco Firepower 9000 is a set of Cisco Cisco running in the 9000 series of firewall devices in the operating system. Multiple arbitrary file read vulnerabilities exist in the Cisco Firepower 9000 Series. This vulnerability could be exploited by an attacker to read arbitrary files on an affected...

Cisco Firepower 9000 Series Switches HTML Injection Vulnerability

Cisco Firepower 9000 Series Switches are Cisco 9000 series switch products. An HTML injection vulnerability exists in Cisco Firepower 9000 Series Switches. This vulnerability allows remote attackers to execute arbitrary HTML or script code in the context of an affected browser to steal cookie-bas...

CVE-2015-6373

Cross-site request forgery CSRF vulnerability in Cisco Firepower Extensible Operating System 1.11.160 on Firepower 9000 devices allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCux10611...

CVE-2015-6372

Cross-site scripting XSS vulnerability in the web-based management interface in Cisco Firepower Extensible Operating System 1.11.160 on Firepower 9000 devices allows remote attackers to inject arbitrary web script or HTML via a crafted value, aka Bug ID CSCux10614...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Cisco Firepower Extensible Operating System 1.11.160 on Firepower 9000 devices allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCux10611...

Cross site scripting

Cross-site scripting XSS vulnerability in the web-based management interface in Cisco Firepower Extensible Operating System 1.11.160 on Firepower 9000 devices allows remote attackers to inject arbitrary web script or HTML via a crafted value, aka Bug ID CSCux10614...

CVE-2015-6372

Cross-site scripting XSS vulnerability in the web-based management interface in Cisco Firepower Extensible Operating System 1.11.160 on Firepower 9000 devices allows remote attackers to inject arbitrary web script or HTML via a crafted value, aka Bug ID CSCux10614...

CVE-2015-6372

CVE-2015-6372 affects Cisco Firepower Extensible Operating System on Firepower 9000 devices (FEO 1.1(1.160)). The web-based management interface is vulnerable to a cross-site scripting (XSS) attack via a crafted value, enabling remote attackers to inject arbitrary script/HTML in the user’s browse...