Cisco Mobility Services Engine sshd_config Trust Management Vulnerability

Cisco Mobility Services Engine MSE is a platform Mobility Services Engine that provides Wi-Fi services from Cisco. The platform collects, stores and manages data from wireless clients, Cisco access points and controllers. A security vulnerability exists in the default configuration of sshdconfig ...

Cisco Mobility Services Engine Elevation of Privilege Vulnerability

Cisco Mobility Services Engine MSE is a platform Mobility Services Engine that provides Wi-Fi services from Cisco. The platform collects, stores and manages data from wireless clients, Cisco access points and controllers. A security vulnerability exists in Cisco MSE 8.0.120.7 and prior versions...

Hardcoded credentials

The default configuration of sshdconfig in Cisco Mobility Services Engine MSE through 8.0.120.7 allows logins by the oracle account, which makes it easier for remote attackers to obtain access by entering this account's hardcoded password in an SSH session, aka Bug ID CSCuv40501...

Code injection

Cisco Mobility Services Engine MSE through 8.0.120.7 uses weak permissions for unspecified binary files, which allows local users to obtain root privileges by writing to a file, aka Bug ID CSCuv40504...

Cisco Mobility Services Engine Static Credential Vulnerability

A vulnerability in the Cisco Mobility Services Engine MSE could allow an unauthenticated, remote attacker to log in to the MSE with the default oracle account. This account does not have full administrator privileges. The vulnerability is due to a user account that has a default and static...

Cisco Mobility Services Engine Privilege Escalation Vulnerability

A vulnerability in the installation procedure of the Cisco Mobility Services Engine MSE appliance could allow an authenticated, local attacker to escalate to the root level. The vulnerability is due to incorrect installation and permissions settings on binary files during the MSE physical or...

Cisco Identity Services Engine Access Control Bypass Vulnerability

Cisco Identity Services Engine A centralized policy engine for Cisco TrustSec solutions. A security vulnerability exists in the Cisco Identity Services Engine that allows a remote user to submit a special HTTP request to access arbitrarily customized HTML pages on the target Guest portal system...

CVE-2015-6266

The guest portal in Cisco Identity Services Engine ISE 3300 1.20.899 does not restrict access to uploaded HTML documents, which allows remote attackers to obtain sensitive information from customized documents via a direct request, aka Bug ID CSCuo78045...

CVE-2015-6266

CVE-2015-6266 affects Cisco Identity Services Engine (ISE) guest portal, where the portal does not restrict access to uploaded HTML documents. The underlying issue is lack of access control for customized HTML files, allowing remote attackers to retrieve sensitive information by requesting the fi...

Cisco Identity Services Engine Guest Portal Unauthorized Access Vulnerability

A vulnerability in the Cisco Identity Services Engine ISE guest portal could allow an unauthenticated, remote attacker to view a customized page on the guest portal. The vulnerability is due to lack of access control for the uploaded HTML files. An attacker could exploit this vulnerability by...

Cisco Identity Services Engine Cross-Site Scripting Attack Vulnerability

Cisco Identity Services Engine A centralized policy engine for Cisco TrustSec solutions. A security vulnerability exists in the Cisco Identity Services Engine that could be exploited by a remote attacker to conduct a cross-site scripting attack that could obtain sensitive information about the...

Cross site scripting

The web interface in Cisco Identity Services Engine ISE 1.14.1, 1.3106.146, and 1.3120.135 does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame...

CVE-2015-4266

The web interface in Cisco Identity Services Engine ISE 1.14.1, 1.3106.146, and 1.3120.135 does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame...

Multiple Cross-Site Scripting Vulnerabilities in Cisco Identity Services Engine (CNVD-2015-04709)

Cisco Identity Services Engine A centralized policy engine for Cisco TrustSec solutions. A cross-site scripting vulnerability exists in the Cisco Identity Services Engine, which could be exploited by remote attackers to inject malicious script or HTML code that, when viewed with malicious data,...

Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability

Cisco Identity Services Engine A centralized policy engine for Cisco TrustSec solutions. A cross-site request forgery vulnerability exists in the Cisco Identity Services Engine, which allows remote attackers to construct malicious URIs, trick users into resolving them, and perform malicious actio...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the web framework in Cisco Identity Services Engine ISE 1.20.793, 1.30.876, 1.40.109, 2.00.147, and 2.00.169 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus09940...

Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability

A vulnerability in the web framework of Cisco Identity Services Engine could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against the user of the web interface. The vulnerability is due to insufficient CSRF protections. An attacker could exploit th...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Infra Admin UI in Cisco Identity Services Engine ISE 1.21.198 and 1.30.876 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a 1 GET or 2 POST request, aka Bug ID CSCus16052...

CVE-2015-4268

Cisco Identity Services Engine (ISE) Infra Admin UI is affected by CVE-2015-4268, with XSS vulnerabilities in ISE versions 1.2(1.198) and 1.3(0.876). The root cause is insufficient input validation of certain HTTP GET/POST parameters, enabling remote attackers to inject arbitrary web script or HT...

Cisco Identity Services Engine Cross-Frame Scripting Vulnerability

A vulnerability in the web interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to execute a cross-frame scripting XFS attack. This vulnerability is due to insufficient HTML iframe protection. An attacker could exploit this vulnerability by directing a...