CVE-2015-4259

The Integrated Management Controller on Cisco Unified Computing System UCS C servers with software 1.53 and 1.60.16 has a default SSL certificate, which makes it easier for man-in-the-middle attackers to bypass cryptographic protection mechanisms by leveraging knowledge of a private key, aka Bug...

CVE-2015-4234

Cisco NX-OS 6.02 and 6.22 on Nexus devices has an improper OS configuration, which allows local users to obtain root access via unspecified input to the Python interpreter, aka Bug IDs CSCun02887, CSCur00115, and CSCur00127...

Input validation

Cisco NX-OS 6.02 and 6.22 on Nexus devices has an improper OS configuration, which allows local users to obtain root access via unspecified input to the Python interpreter, aka Bug IDs CSCun02887, CSCur00115, and CSCur00127...

CVE-2015-4234

Cisco NX-OS 6.02 and 6.22 on Nexus devices has an improper OS configuration, which allows local users to obtain root access via unspecified input to the Python interpreter, aka Bug IDs CSCun02887, CSCur00115, and CSCur00127...

CVE-2015-4234

Cisco NX-OS on Nexus devices (6.0(2) and 6.2(2)) is affected by a local privilege-escalation flaw in the Python scripting subsystem, allowing a locally authenticated user to obtain root via improper OS configuration and input to the Python interpreter. Exploitation requires local access and authe...

CVE-2015-4237

The CLI parser in Cisco NX-OS 4.12E11, 6.211b, 6.212, 7.20ZZ99.1, 7.20ZZ99.3, and 9.11SV13.1.8 on Nexus devices allows local users to execute arbitrary OS commands via crafted characters in a filename, aka Bug IDs CSCuv08491, CSCuv08443, CSCuv08480, CSCuv08448, CSCuu99291, CSCuv08434, and...

CVE-2015-3722

Application Store in Apple iOS before 8.4 does not ensure the uniqueness of bundle IDs, which allows attackers to cause a denial of service ID collision and launch outage via a crafted universal provisioning profile app...

PT-2015-6320

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 8.4 Description The issue allows attackers to cause a denial of service, specifically an ID collision and launch outage, by utilizing a crafted universal provisioning profile app. This is due to the Application Stor...

Snorby 2.6.2 Cross Site Scripting

-------------------------------------------------------- Snorby 2.6.2 - Stored Cross-site Scripting Vulnerability -------------------------------------------------------- Vendor ------ https://www.snorby.org/ Version ------- 2.6.2 Description ----------- During my research and testing of new IDS...

CVE-2015-3725: Undefined Security Weakness

MobileInstallation in Apple iOS before 8.4 does not ensure the uniqueness of Watch bundle IDs, which allows attackers to cause a denial of service ID collision and Watch launch outage via a crafted universal provisioning profile app...

PT-2015-6125

Name of the Vulnerable Software and Affected Versions PolicyKit aka polkit versions prior to 0.113 Description The issue is related to the polkit backend action pool init function in polkitbackend/polkitbackendactionpool.c, which might allow local users to gain privileges via duplicate action IDs...

Design/Logic Flaw

The HTTP connection-management functionality in Internet Pass-Thru IPT before 2.1.0.2 in IBM WebSphere MQ, when HTTPS is disabled, does not properly generate MQIPT Session IDs, which makes it easier for remote attackers to bypass intended restrictions on MQ message data by predicting an ID value...

PT-2015-4509

Name of the Vulnerable Software and Affected Versions IBM WebSphere MQ Internet Pass-Thru versions prior to 2.1.0.2 Description The issue affects the HTTP connection-management functionality when HTTPS is disabled, leading to improper generation of MQIPT Session IDs. This makes it easier for remo...

CVE-2015-0173: Undefined Security Weakness

The HTTP connection-management functionality in Internet Pass-Thru IPT before 2.1.0.2 in IBM WebSphere MQ, when HTTPS is disabled, does not properly generate MQIPT Session IDs, which makes it easier for remote attackers to bypass intended restrictions on MQ message data by predicting an ID value...

Design/Logic Flaw

The remote-support feature on Cisco Web Security Virtual Appliance WSAv, Email Security Virtual Appliance ESAv, and Security Management Virtual Appliance SMAv devices before 2015-06-25 uses the same default SSH host keys across different customers' installations, which makes it easier for remote...

CVE-2015-4216

The remote-support feature on Cisco Web Security Virtual Appliance WSAv, Email Security Virtual Appliance ESAv, and Security Management Virtual Appliance SMAv devices before 2015-06-25 uses the same default SSH root authorized key across different customers' installations, which makes it easier f...

Improper access control

Cisco Secure Access Control System before 5.40.46.2 and 5.5 before 5.50.46 and Cisco Identity Services Engine 1.04.573 do not properly implement access control for support bundles, which allows remote authenticated users to obtain sensitive information via brute-force attempts to send valid...

Design/Logic Flaw

The web-based user interface in Cisco Jabber through 9.63 and 9.7 through 9.75 on Windows allows remote attackers to obtain sensitive information via a crafted value in a GET request, aka Bug IDs CSCuu65622 and CSCuu70858...

CVE-2015-4219

Cisco Secure Access Control System before 5.40.46.2 and 5.5 before 5.50.46 and Cisco Identity Services Engine 1.04.573 do not properly implement access control for support bundles, which allows remote authenticated users to obtain sensitive information via brute-force attempts to send valid...

CVE-2015-4184

The anti-spam scanner on Cisco Email Security Appliance ESA devices 3.3.1-09, 7.5.1-gpl-022, and 8.5.6-074 allows remote attackers to bypass intended e-mail restrictions via a malformed DNS SPF record, aka Bug IDs CSCuu35853 and CSCuu37733...