APPLE-SA-2013-09-18-2 iOS 7

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2013-09-18-2 iOS 7 iOS 7 is now available and addresses the following: Certificate Trust Policy Available for: iPhone 4 and later, iPod touch 5th generation and later, iPad 2 and later Impact: Root certificates have been updated Description:...

Directory traversal

Directory traversal vulnerability in processImageSave.jsp in DCNM-SAN Server in Cisco Prime Data Center Network Manager DCNM before 6.21 allows remote attackers to write arbitrary files via the chartid parameter, aka Bug IDs CSCue77035 and CSCue77036. NOTE: this can be leveraged to execute...

CVE-2013-5486

Directory traversal vulnerability in processImageSave.jsp in DCNM-SAN Server in Cisco Prime Data Center Network Manager DCNM before 6.21 allows remote attackers to write arbitrary files via the chartid parameter, aka Bug IDs CSCue77035 and CSCue77036. NOTE: this can be leveraged to execute...

CVE-2013-5486

Cisco Prime DCNM DCNM-SAN Server (Cisco Prime DCNM) before 6.2(1) is affected by CVE-2013-5486: a directory traversal in processImageSave.jsp allows remote attackers to write arbitrary files via the chartid parameter, potentially enabling remote code execution through JBoss autodeploy. Affected c...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the oraadmin service page in Cisco MediaSense allow remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug IDs CSCuj23320, CSCuj23324, CSCuj23333, and CSCuj23338...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: A public posting on 20130831 referenced this ID for a specific issue, but that issue had not been assigned this ID by any CNA. Notes: The posting will later have IDs assigned in accordance with CVE content decisions...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: A public posting on 20130831 referenced this ID for a specific issue, but that issue had not been assigned this ID by any CNA. Notes: The posting will later have IDs assigned in accordance with CVE content decisions...

DEBIAN-CVE-2013-2256

OpenStack Compute Nova before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:ispublic property, which allows remote authenticated users to obtain sensitive information flavor properties, boot arbitrary flavors, and possibly have other unspecified impacts by...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the web framework in Cisco Unified MeetingPlace Solution, as used in Unified MeetingPlace Web Conferencing and Unified MeetingPlace, allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCui45209 and CSCui44674...

CVE-2013-5494

Cross-site request forgery CSRF vulnerability in the web framework in Cisco Unified MeetingPlace Solution, as used in Unified MeetingPlace Web Conferencing and Unified MeetingPlace, allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCui45209 and CSCui44674...

CVE-2013-5494

Cisco CVE-2013-5494 concerns a CSRF vulnerability in the Cisco Unified MeetingPlace Solution web framework (used by Unified MeetingPlace Web Conferencing and Unified MeetingPlace). The root cause is insufficient CSRF protections in the web framework code, enabling an unauthenticated, remote attac...

Code injection

Cisco Common Services, as used in Cisco Prime LAN Management Solution LMS, Cisco Security Manager, Cisco Unified Service Monitor, and Cisco Unified Operations Manager, does not properly interact with the ActiveMQ component, which allows remote attackers to cause a denial of service memory...

CVE-2013-5488

Cisco Common Services, as used in Cisco Prime LAN Management Solution LMS, Cisco Security Manager, Cisco Unified Service Monitor, and Cisco Unified Operations Manager, does not properly interact with the ActiveMQ component, which allows remote attackers to cause a denial of service memory...

CVE-2013-5488

Cisco Common Services (used in Cisco Prime LMS, Cisco Security Manager, Cisco Unified Service Monitor, and Cisco Unified Operations Manager) fails to properly interact with ActiveMQ, allowing an unauthenticated remote attacker to cause memory-based DoS by opening multiple concurrent TCP sessions....

CVE-2013-1115

Cisco WebEx ARF/WRF players are affected by CVE-2013-1115 due to a buffer overflow that can lead to remote code execution or memory corruption (DoS) when processing crafted ARF files. Affected components include WebEx ARF/WRF players (T27 LD before SP32 EP16, T27 L10N before SP32_ORION111, and T2...

CVE-2013-3106

CVE-2013-3106 describes multiple XSS vulnerabilities in Open-Xchange AppSuite and Server across several versions: before 6.20.7 rev18, 6.22.0 rev16, 6.22.1 rev19, 7.0.1 rev7, 7.0.2 rev11, and 7.2.0 rev8. The confirmed vectors include (1) embedded VBScript, (2) object/data Base64 content, (3) Cont...

Amazon Linux AMI : kernel (ALAS-2011-26)

IPv6 fragment identification value generation could allow a remote attacker to disrupt a target system's networking, preventing legitimate users from accessing its services. CVE-2011-2699 , Important A signedness issue was found in the Linux kernel's CIFS Common Internet File System implementatio...

Design/Logic Flaw

The Web Administrator Interface on Cisco Wireless LAN Controller WLC devices allows remote authenticated users to cause a denial of service device crash by leveraging membership in the Full Manager managers group, Read Only managers group, or Lobby Ambassador managers group, and sending a request...

CVE-2013-3474

The Web Administrator Interface on Cisco Wireless LAN Controller WLC devices allows remote authenticated users to cause a denial of service device crash by leveraging membership in the Full Manager managers group, Read Only managers group, or Lobby Ambassador managers group, and sending a request...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the guest portal in Cisco Identity Services Engine ISE Software allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug IDs CSCud11139 and CSCug02904...