CVE-2013-5540: Undefined Security Weakness

The file-upload feature in Cisco Identity Services Engine ISE allows remote authenticated users to cause a denial of service disk consumption and administration-interface outage by uploading many files, aka Bug ID CSCui67519...

CVE-2013-5541: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the file-upload interface in Cisco Identity Services Engine ISE allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename, aka Bug ID CSCui67495...

CVE-2013-5538: Undefined Security Weakness

The Sponsor Portal in Cisco Identity Services Engine ISE uses weak permissions for uploaded files, which allows remote attackers to read arbitrary files via a direct request, aka Bug ID CSCui67506...

PT-2013-5620

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Description The issue concerns the upload-dialog implementation, allowing remote authenticated users to upload files of arbitrary types. This could potentially be used to condu...

PT-2013-5621

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Description The issue concerns the file-upload feature, which allows remote authenticated users to cause a denial of service. This can lead to disk consumption and an...

CVE-2013-5523

The Sponsor Portal in Cisco Identity Services Engine ISE 1.2 and earlier does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting XFS"...

Cross site scripting

The Sponsor Portal in Cisco Identity Services Engine ISE 1.2 and earlier does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting XFS"...

CVE-2013-5523

The Sponsor Portal in Cisco Identity Services Engine ISE 1.2 and earlier does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting XFS"...

CVE-2013-5524

Cross-site scripting XSS vulnerability in the troubleshooting page in Cisco Identity Services Engine ISE 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCug77655...

PT-2013-5605

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE versions 1.2 and earlier Description A cross-site scripting XSS issue exists in the troubleshooting page, allowing remote attackers to inject arbitrary web script or HTML via an unspecified parameter...

PT-2013-5606

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE versions 1.2 and earlier Description A SQL injection issue in the web framework of Cisco Identity Services Engine ISE allows remote authenticated users to execute arbitrary SQL commands. Recommendations For...

CVE-2013-5524: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the troubleshooting page in Cisco Identity Services Engine ISE 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCug77655...

CVE-2013-5525: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the web framework in Cisco Identity Services Engine ISE 1.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCug90502...

CVE-2013-5523: Improper Input Validation

The Sponsor Portal in Cisco Identity Services Engine ISE 1.2 and earlier does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting XFS"...

PT-2013-5604

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE versions 1.2 and earlier Description The issue is related to a "cross-frame scripting XFS" problem, where the Sponsor Portal in Cisco Identity Services Engine ISE does not properly restrict the use of IFRAME...

Cisco Identity Services Engine Troubleshooting Interface Cross-Site Scripting Vulnerability

A vulnerability in the troubleshooting page of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of the affected system. The vulnerability is due to insufficient input validation of...

Cisco Identity Services Engine Blind SQL Injection Vulnerability

A vulnerability in the web framework of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to impact the integrity and availability of the affected system by executing arbitrary SQL queries. The vulnerability is due to a failure to validate user-supplied input used i...

Cisco Identity Services Engine Administration Interface Cross-Site Scripting Vulnerability

A vulnerability in an administration page of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of the affected system. The vulnerability is due to insufficient input validation of a...

CVE-2013-5505

Cross-site scripting XSS vulnerability in an administration page in Cisco Identity Services Engine ISE allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui30275...

CVE-2013-5504

Cross-site scripting XSS vulnerability in the Mobile Device Management MDM portal in Cisco Identity Services Engine ISE allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui30266...