CVE-2014-8017: Exposure of Sensitive Information to an Unauthorized Actor

The periodic-backup feature in Cisco Identity Services Engine ISE allows remote attackers to discover backup-encryption passwords via a crafted request that triggers inclusion of a password in a reply, aka Bug ID CSCur41673...

CVE-2014-8015: Undefined Security Weakness

The Sponsor Portal in Cisco Identity Services Engine ISE allows remote authenticated users to obtain access to an arbitrary sponsor's guest account via a modified HTTP request, aka Bug ID CSCur64400...

PT-2014-8384

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Description The issue allows remote authenticated users to obtain access to an arbitrary sponsor's guest account via a modified HTTP request. Recommendations At the moment, the...

CVE-2014-3275

SQL injection vulnerability in the web framework in Cisco Identity Services Engine ISE 1.2.1 patch 2 and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCul21337...

Design/Logic Flaw

Cisco Identity Services Engine ISE 1.2.1 patch 2 and earlier does not properly handle deadlock conditions during reception of crafted RADIUS accounting packets from multiple NAS devices, which allows remote authenticated users to cause a denial of service RADIUS outage by sourcing these packets...

CVE-2014-3275

SQL injection vulnerability in the web framework in Cisco Identity Services Engine ISE 1.2.1 patch 2 and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCul21337...

CVE-2014-3275: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the web framework in Cisco Identity Services Engine ISE 1.2.1 patch 2 and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCul21337...

PT-2014-5171

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE versions 1.2.1 patch 2 and earlier Description The issue allows remote authenticated users to execute arbitrary SQL commands via a crafted URL. Recommendations For Cisco Identity Services Engine ISE versions...

PT-2014-5172

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE version 1.2.1 patch 2 and earlier Description The issue arises from improper handling of deadlock conditions during the reception of crafted RADIUS accounting packets from multiple NAS devices. This allows...

CVE-2014-3276: Undefined Security Weakness

Cisco Identity Services Engine ISE 1.2.1 patch 2 and earlier does not properly handle deadlock conditions during reception of crafted RADIUS accounting packets from multiple NAS devices, which allows remote authenticated users to cause a denial of service RADIUS outage by sourcing these packets...

Cisco Identity Services Engine Blind SQL Injection Vulnerability

A vulnerability in the web framework of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to impact the integrity and availability of the affected system by executing arbitrary SQL queries. The vulnerability is due to a failure to validate user-supplied input in SQL...

Cisco Identity Services Engine RADIUS Service Denial of Service Vulnerability

A vulnerability in Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to cause the affected system to stop processing Remote Authentication Dial-In User Service RADIUS packets. The vulnerability is due to improper implementation of deadlock code when the system...

CVE-2014-0680

Cross-site scripting XSS vulnerability in the HTTP control interface in the NAC Web Agent component in Cisco Identity Services Engine ISE allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCui15038...

CVE-2014-0681

Cross-site scripting XSS vulnerability in Cisco Identity Services Engine ISE 1.2 patch 2 and earlier allows remote attackers to inject arbitrary web script or HTML via a report containing a crafted URL that is not properly handled during generation of report-output pages, aka Bug ID CSCui15064...

Cross site scripting

Cross-site scripting XSS vulnerability in Cisco Identity Services Engine ISE 1.2 patch 2 and earlier allows remote attackers to inject arbitrary web script or HTML via a report containing a crafted URL that is not properly handled during generation of report-output pages, aka Bug ID CSCui15064...

Cross site scripting

Cross-site scripting XSS vulnerability in the HTTP control interface in the NAC Web Agent component in Cisco Identity Services Engine ISE allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCui15038...

Cisco Identity Services Engine HTTP Control Interface for NAC Web Agent Cross-Site Scripting Vulnerability

A vulnerability in the HTTP control interface for NAC Web Agent of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to execute a cross-site scripting XSS attack. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerabili...

CVE-2014-0680

Cross-site scripting XSS vulnerability in the HTTP control interface in the NAC Web Agent component in Cisco Identity Services Engine ISE allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCui15038...

CVE-2014-0680

Cisco Identity Services Engine (ISE) NAC Web Agent’s HTTP control interface is affected by a Cross-Site Scripting (XSS) vulnerability. The issue arises from insufficient input validation, allowing remote attackers to inject arbitrary scripts via a crafted URL. Exploitation could cause a user to e...

CVE-2014-0681

Cisco Identity Services Engine (ISE) 1.2 patch 2 and earlier is affected by a cross-site scripting (XSS) vulnerability in the report output pages. The root cause is insufficient input validation when generating reports, allowing an unauthenticated, remote attacker to inject arbitrary web script o...