PT-2013-5611

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE versions 1.0 through 1.1.0 before 1.1.0.665-5 Cisco Identity Services Engine ISE version 1.1.1 before 1.1.1.268-7 Cisco Identity Services Engine ISE version 1.1.2 before 1.1.2.145-10 Cisco Identity Services...

PT-2013-5612

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE versions 1.x before 1.1.1 Description The issue allows remote attackers to bypass authentication and read sensitive data, including support-bundle configuration and credentials, by crafting a session on TCP...

Multiple Vulnerabilities in Cisco Identity Services Engine

Cisco Identity Services Engine ISE contains the following vulnerabilities: Cisco ISE Authenticated Arbitrary Command Execution Vulnerability Cisco ISE Support Information Download Authentication Bypass Vulnerability These vulnerabilities are independent of each other; a release that is affected b...

Cisco Identity Services Engine Untrusted File Upload Vulnerability

A vulnerability in the file upload dialog of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to upload potentially malicious files. The vulnerability is due to insufficient filtering and validation of uploaded files. An attacker could exploit this vulnerability by...

Cisco Identity Services Engine Sponsor Portal File Access Vulnerability

A vulnerability in the Sponsor Portal of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to access files uploaded to the Sponsor Portal. The vulnerability is due to insufficient file permissions. An attacker could exploit this vulnerability by accessing the URL...

Cisco Identity Services Engine File Space Denial of Service Vulnerability

A vulnerability in the file upload management of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to upload multiple files to a specific location of the filesystem and exhaust disk space. The vulnerability is due to insufficient management of filesystem free space...

Cisco Identity Services Engine Upload Filename Validation Vulnerability

A vulnerability in the file upload filename parsing routine of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to upload a file with a malicious filename. The vulnerability is due to insufficient validation of uploaded filenames. An attacker could exploit this...

CVE-2013-5540

The file-upload feature in Cisco Identity Services Engine ISE allows remote authenticated users to cause a denial of service disk consumption and administration-interface outage by uploading many files, aka Bug ID CSCui67519...

CVE-2013-5538

The Sponsor Portal in Cisco Identity Services Engine ISE uses weak permissions for uploaded files, which allows remote attackers to read arbitrary files via a direct request, aka Bug ID CSCui67506...

CVE-2013-5541

Cross-site scripting XSS vulnerability in the file-upload interface in Cisco Identity Services Engine ISE allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename, aka Bug ID CSCui67495...

CVE-2013-5539

The upload-dialog implementation in Cisco Identity Services Engine ISE allows remote authenticated users to upload files with an arbitrary file type, and consequently conduct attacks against unspecified other systems, via a crafted file, aka Bug ID CSCui67511...

Cross site scripting

Cross-site scripting XSS vulnerability in the file-upload interface in Cisco Identity Services Engine ISE allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename, aka Bug ID CSCui67495...

Unrestricted file upload

The file-upload feature in Cisco Identity Services Engine ISE allows remote authenticated users to cause a denial of service disk consumption and administration-interface outage by uploading many files, aka Bug ID CSCui67519...

CVE-2013-5538

The Sponsor Portal in Cisco Identity Services Engine ISE uses weak permissions for uploaded files, which allows remote attackers to read arbitrary files via a direct request, aka Bug ID CSCui67506...

CVE-2013-5539

The upload-dialog implementation in Cisco Identity Services Engine ISE allows remote authenticated users to upload files with an arbitrary file type, and consequently conduct attacks against unspecified other systems, via a crafted file, aka Bug ID CSCui67511...

CVE-2013-5538

CVE-2013-5538 affects Cisco Identity Services Engine (ISE) Sponsor Portal. The root cause is weak permissions on uploaded Sponsor Portal files, enabling an unauthenticated remote attacker to read arbitrary files via a direct URL. The Cisco advisory notes that updates are not available to fix this...

CVE-2013-5539

The CVE-2013-5539 entry concerns Cisco Identity Services Engine (ISE). The vulnerability is located in the upload-dialog component, where remote authenticated users can upload files of arbitrary types due to insufficient validation/filtering. This could enable attackers to plant files that may be...

PT-2013-5619

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Description The Sponsor Portal in Cisco Identity Services Engine ISE has a weakness in permissions for uploaded files. This weakness allows remote attackers to read arbitrary...

PT-2013-5622

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Description A cross-site scripting XSS issue exists in the file-upload interface, allowing remote authenticated users to inject arbitrary web script or HTML via a crafted...

CVE-2013-5539: Improper Input Validation

The upload-dialog implementation in Cisco Identity Services Engine ISE allows remote authenticated users to upload files with an arbitrary file type, and consequently conduct attacks against unspecified other systems, via a crafted file, aka Bug ID CSCui67511...