5514 matches found
CVE-2017-12261
A vulnerability in the restricted shell of the Cisco Identity Services Engine ISE that is accessible via SSH could allow an authenticated, local attacker to run arbitrary CLI commands with elevated privileges. The vulnerability is due to incomplete input validation of the user input for CLI...
CVE-2017-12294
Cisco WebEx Meetings Server is affected by CVE-2017-12294, a cross-site scripting (XSS) vulnerability caused by insufficient input validation in certain web-server parameters. An authenticated, remote attacker could lure a user to a crafted link or intercept a request to inject malicious script, ...
CVE-2017-12276
Cisco Prime Collaboration Provisioning (before v12.3) is affected by an authenticated SQL injection in the web framework’s SQL database interface (CVE-2017-12276). Exploitation requires valid user credentials and can lead to disclosure/integrity impact by executing arbitrary SQL queries through c...
CVE-2017-12261
The CVE-2017-12261 issue is a vulnerability in the restricted shell of Cisco Identity Services Engine (ISE) that allows an authenticated, local attacker to run arbitrary CLI commands with elevated privileges due to incomplete input validation of CLI inputs. It affects ISE products released in 1.4...
CVE-2017-12262
Cisco APIC-EM (Application Policy Infrastructure Controller Enterprise Module) 1.x before 1.5 is affected by a firewall configuration flaw. The misconfigured firewall rule allows traffic arriving at the device’s public interface to be forwarded to the internal virtual network, enabling an unauthe...
CVE-2017-12282
CVE-2017-12282 affects Cisco Wireless LAN Controllers (WLC) and relates to the ANQP ingress frame processing. The root cause is incomplete input validation of ANQP query frames, which can be exploited by an unauthenticated, Layer 2 RF-adjacent attacker on an RF-adjacent network to cause the affec...
CVE-2017-12279
CVE-2017-12279 affects Cisco IOS Software for Cisco Aironet Access Points. The issue is in the packet processing code where padding added to egress packets allows an unauthenticated, adjacent attacker to retrieve content from memory, leading to information disclosure. Root cause is insufficient c...
CVE-2017-12273
A vulnerability in 802.11 association request frame processing for the Cisco Aironet 1560, 2800, and 3800 Series Access Points could allow an unauthenticated, Layer 2 radio frequency RF adjacent attacker to cause the Access Point AP to reload, resulting in a denial of service DoS condition. The...
CVE-2017-12273
CVE-2017-12273 is a vulnerability in 802.11 association request frame processing that affects Cisco Aironet 1560, 2800, and 3800 Series APs running Lightweight AP Software or Mobility Express. A unauthenticated, Layer-2 adjacent attacker can send a malformed 802.11 association request to cause th...
CVE-2017-12294
A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the affected system. The vulnerability is due to insufficient input validation of some parameters that are passed to the web server of the...
About the security content of macOS High Sierra 10.13.1, Security Update 2017-001 Sierra, and Security Update 2017-004 El Capitan
About the security content of macOS High Sierra 10.13.1, Security Update 2017-001 Sierra, and Security Update 2017-004 El Capitan This document describes the security content of macOS High Sierra 10.13.1, Security Update 2017-001 Sierra, and Security Update 2017-004 El Capitan. About Apple securi...
About the security content of watchOS 4.1
About the security content of watchOS 4.1 This document describes the security content of watchOS 4.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...
About the security content of iOS 11.1
About the security content of iOS 11.1 This document describes the security content of iOS 11.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recen...
About the security content of iCloud for Windows 7.1
About the security content of iCloud for Windows 7.1 This document describes the security content of iCloud for Windows 7.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or...
About the security content of tvOS 11.1
About the security content of tvOS 11.1 This document describes the security content of tvOS 11.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...
UBUNTU-CVE-2017-5068
Incorrect handling of picture ID in WebRTC in Google Chrome prior to 58.0.3029.96 for Mac, Windows, and Linux allowed a remote attacker to trigger a race condition via a crafted HTML page...
USN-3465-1 irssi vulnerabilities
Brian Carpenter discovered that Irssi incorrectly handled messages with invalid time stamps. A malicious IRC server could use this issue to cause Irssi to crash, resulting in a denial of service. CVE-2017-10965 Brian Carpenter discovered that Irssi incorrectly handled the internal nick list. A...
USN-3465-1: Irssi vulnerabilities
Brian Carpenter discovered that Irssi incorrectly handled messages with invalid time stamps. A malicious IRC server could use this issue to cause Irssi to crash, resulting in a denial of service. CVE-2017-10965 Brian Carpenter discovered that Irssi incorrectly handled the internal nick list. A...
CVE-2015-2878
Multiple cross-site request forgery CSRF vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijack the authentication of administrators for requests that 1 add arbitrary accounts via the name parameter to interface/rest/accounts/json; turn off the 2 Url matching, 3 DNS Inject...
Design/Logic Flaw
The Cisco AMP For Endpoints application allows an authenticated, local attacker to access a static key value stored in the local application software. The vulnerability is due to the use of a static key value stored in the application used to encrypt the connector protection password. An attacker...