Cisco FireSIGHT System Software Convert Timing Channel Information Disclosure Vulnerability

Cisco FireSIGHT System Software is the United States Cisco Cisco company's set of management center software, which supports the centralized management of the use of FirePOWER Services Cisco ASA and Cisco FirePOWER network security appliances network security and operational functions of the...

CVE-2016-1356

CVE-2016-1356 affects Cisco FireSIGHT System Software 6.1.0, where credential verification does not use a constant-time algorithm. This timing variability enables remote attackers to enumerate valid usernames via measurement of responses, as described in Cisco’s FireSIGHT advisory (cisco-sa-20160...

CVE-2016-1355

Cross-site scripting XSS vulnerability in the Device Management UI in the management interface in Cisco FireSIGHT System Software 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a crafted value, aka Bug ID CSCuy41687...

CVE-2016-1355

Summary: CVE-2016-1355 is an XSS vulnerability in the Device Management UI of Cisco FireSIGHT System Software 6.1.0. The root cause is insufficient input validation in the HTTP web-based management interface, enabling a remote attacker to inject arbitrary web script or HTML via a crafted value. T...

PT-2016-4727

Name of the Vulnerable Software and Affected Versions Cisco FireSIGHT System Software version 6.1.0 Description A cross-site scripting XSS issue exists in the Device Management UI of the management interface, allowing remote attackers to inject arbitrary web script or HTML via a crafted value...

CVE-2016-1356: Improper Authentication

Cisco FireSIGHT System Software 6.1.0 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to enumerate valid usernames by measuring timing differences, aka Bug ID CSCuy41615...

PT-2016-4728

Name of the Vulnerable Software and Affected Versions Cisco FireSIGHT System Software version 6.1.0 Description The issue allows remote attackers to enumerate valid usernames by measuring timing differences due to the lack of a constant-time algorithm for verifying credentials. Recommendations Fo...

CVE-2016-1355: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Device Management UI in the management interface in Cisco FireSIGHT System Software 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a crafted value, aka Bug ID CSCuy41687...

Cisco FireSIGHT System Software Convert Timing Channel Vulnerability

A vulnerability in credential authentication for valid and invalid username-password pairs for Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to determine a list of valid usernames for an affected device. The vulnerability is due to implementation details of how...

CVE-2016-1293

Multiple cross-site scripting XSS vulnerabilities in the Management Center in Cisco FireSIGHT System Software 6.0.0 and 6.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCux40414...

PT-2016-4687

Name of the Vulnerable Software and Affected Versions Cisco FireSIGHT System Software version 6.0.1 Description A cross-site scripting XSS issue exists in the Management Center of Cisco FireSIGHT System Software, allowing remote attackers to inject arbitrary web script or HTML via a crafted cooki...

CVE-2016-1294: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Management Center in Cisco FireSIGHT System Software 6.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted cookie, aka Bug ID CSCuw89094...

PT-2016-4686

Name of the Vulnerable Software and Affected Versions Cisco FireSIGHT System Software versions 6.0.0 through 6.0.1 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the Management Center of Cisco FireSIGHT System Software. These vulnerabilities allow remote...

CVE-2016-1293: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Management Center in Cisco FireSIGHT System Software 6.0.0 and 6.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCux40414...

Cisco FirePOWER 7000 and Cisco FirePOWER 8000 Series Inspection Engine Stall Vulnerability

A vulnerability in FireSIGHT System Software for Cisco FirePOWER 7000 Series and Cisco FirePOWER 8000 Series devices could allow an unauthenticated, adjacent attacker to cause the inspection engine to stop processing packets. Depending on the affected system configuration, this may cause traffic...

CVE-2015-4270

CVE-2015-4270 concerns Cisco FireSIGHT System Software 5.3.1.5 and 6.0.0, where multiple cross-site scripting (XSS) vulnerabilities exist due to insufficient validation of user-supplied input. A remote attacker could inject arbitrary script via a crafted URL, potentially compromising sessions or ...

CVE-2015-4270: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Cisco FireSIGHT System Software 5.3.1.5 and 6.0.0 allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug IDs CSCuv22557, CSCuv22583, CSCuv22632, CSCuv22641, CSCuv22650, CSCuv22662, CSCuv22697, and CSCuv22702...

CVE-2015-4242

Cross-site request forgery CSRF vulnerability in Cisco FireSIGHT System Software 5.4.1.2 and 6.0.0 in FireSIGHT Management Center allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu94721...

PT-2015-6478

Name of the Vulnerable Software and Affected Versions Cisco FireSIGHT System Software versions 5.4.1.2 through 6.0.0 Description A cross-site request forgery issue allows remote attackers to hijack the authentication of arbitrary users. Recommendations For versions 5.4.1.2 through 6.0.0, update t...

CVE-2015-4242: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Cisco FireSIGHT System Software 5.4.1.2 and 6.0.0 in FireSIGHT Management Center allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu94721...