Cisco WebEx Training Center Email验证绕过音频会议加入漏洞

Bugtraq ID:64281 CVE ID:CVE-2013-6965 Cisco WebEx Training Center是一款互动式培训解决方案，可开展电子教学。 Cisco WebEx Training Center培训中心注册页面存在安全漏洞，允许未验证远程攻击者无需要提供合法Email地址加入培训会议的音频会议。漏洞是由于注册结束之前泄漏了培训会话信息URL，攻击者可收集泄漏URL中的培训会话访问代码和密码，使用这些信息加入受限会议。 0 Cisco WebEx Training Center 厂商补丁： Cisco ----- 用户可参考如下厂商提供的安全公告获得补丁信...

Cisco WebEx Collaboration Partner Access Console Cross-Site Scripting Vulnerability

A vulnerability in the Collaboration Partner Access Console CPAC of Cisco WebEx Business Suite could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this...

Cisco WebEx Meeting Center Mobile Browser Redirection Cross-Site Scripting Vulnerability

A vulnerability in how mobile browsers redirect to the mobile version of Cisco WebEx Meeting Center sites could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack. The vulnerability is due to insufficient validation of user-supplied input. An attacker could...

Cisco WebEx Training Center Training Registration Cross-Site Scripting Vulnerability

A vulnerability in the training center registration page of Cisco WebEx Training Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this...

Cisco WebEx Business Suite Site Access Control Bypass Vulnerability

A vulnerability in the site access control implementation of Cisco WebEx Business Suite could allow an authenticated, remote attacker to inject content from the attacker-controlled WebEx site into another WebEx site. The vulnerability is due to insufficient validation of user-supplied input. An...

Cisco WebEx Sales Center Open Redirect Vulnerability

A vulnerability in Cisco WebEx Sales Center could allow an unauthenticated, remote attacker to cause WebEx Sales Center to issue a redirect to an arbitrary attacker-supplied URL. The vulnerability is due to an open redirect issue in Cisco WebEx Sales Center. An attacker could exploit this...

Cisco WebEx Training Center Cross-Site Request Forgery Vulnerabilities

A vulnerability in the web framework of Cisco WebEx Training Center could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack. The vulnerability is due to insufficient CSRF protections. An attacker could exploit this vulnerability by persuading a user to...

Cisco WebEx Multiple Cross-Site Scripting Vulnerabilities

Multiple vulnerabilities in Cisco WebEx Business Suite could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack. The vulnerabilities are due to insufficient validation of user-supplied input. An attacker could exploit these vulnerabilities by convincing a user ...

Cisco WebEx Training Center Open Redirect Vulnerability

A vulnerability in Cisco WebEx Training Center could allow an unauthenticated, remote attacker to cause the Cisco WebEx Training Center to issue a redirect to an arbitrary attacker-supplied URL. The vulnerability is due to an open redirect issue in Cisco WebEx Training Center. An attacker could...

Cisco WebEx Training Center Registered Attendee Email Enumeration Vulnerability

A vulnerability in the training registration page in Cisco WebEx Training Center could allow an unauthenticated, remote attacker to enumerate email addresses of registered attendees. The vulnerability is due to registration error messages that allow a user to determine that an email address...

Cisco WebEx Training Center Open Redirect Vulnerability

A vulnerability in Cisco WebEx Training Center could allow an unauthenticated, remote attacker to cause the Cisco WebEx Training Center to issue a redirect to an arbitrary attacker-supplied URL. The vulnerability is due to an open redirect issue in Cisco WebEx Training Center. An attacker could...

Cisco WebEx Training Center Training Session Number Disclosure Vulnerability

A vulnerability in Cisco WebEx Training Center could allow an unauthenticated, remote attacker to view the session number for trainings that require host approval before the host approves the attacker as an attendee. The vulnerability is due to inappropriate disclosure of sensitive information in...

Cisco WebEx Training Center Registration ID Exposure Vulnerability

A vulnerability in Cisco WebEx Training Center could allow an unauthenticated, remote attacker to gather the registration ID of other users. The vulnerability is due to inappropriate disclosure of sensitive information to unauthenticated users. An attacker could exploit this vulnerability by...

Threat Outbreak Alert: Fake Payment Notice Email Messages on December 6, 2013

Medium Alert ID: 32069 First Published: 2013 December 9 20:03 GMT Version: 1 Summary Cisco Security has detected significant activity related to Italian-language spam email messages that claim to contain a payment notice for the recipient. The text in the e-mail message attempts to convince the...

Cisco Adaptive Security Appliance Management Connections Denial of Service Vulnerability

A vulnerability in the Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to cause an affected system to become unresponsive to management session requests via SSH, Telnet, HTTP, and HTTPS. The vulnerability is due to a memory leak in the connection...

Cisco IOS XR Software SNMP Denial of Service Vulnerability

A vulnerability in the Simple Network Management Protocol SNMP module of Cisco IOS XR Software could allow an authenticated, remote attacker to cause a reload of the SNMP process on an affected device. The vulnerability is due to improper processing of SNMP requests for certain MIBs. An attacker...

Cisco Wireless LAN Controller Buffer Overread Vulnerability

A vulnerability in the Control and Provisioning of Wireless Access Points CAPWAP protocol of the Cisco Wireless LAN Controller WLC could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to insufficient data packet validation. An attack...

Cisco Wireless LAN Controller Cross-Frame Scripting Vulnerability

A vulnerability in the web interface of the Cisco Wireless LAN Controller WLC could allow an unauthenticated, remote attacker to execute a cross-frame scripting XFS attack. The vulnerability is due to insufficient HTML iframe protection. An attacker could exploit this vulnerability by directing a...

Cisco IOS XE Software AAA DHCP Denial of Service Vulnerability

A vulnerability in a DHCP function that assigns IP addresses to AAA clients on Cisco IOS XE Software could allow an authenticated, remote attacker to cause a reload of the affected device. The vulnerability is due to improper processing of AAA packets that require IP address assignment from a DHC...

Cisco Server Provisioner Web Interface Information Disclosure Vulnerability

A vulnerability in the web interface of Cisco Server Provisioner could allow an unauthenticated, remote attacker to access some pages directly that should require authentication. The vulnerability is due to a failure to enforce access controls for the vulnerable pages. An attacker could exploit...