Cross site scripting

Multiple vulnerabilities in the web-based management interface of Cisco UCS Central Software could allow a remote attacker to conduct a cross-site scripting XSS attack against a user of the affected interface or hijack a valid session ID from a user of the affected interface. Cisco Bug IDs:...

CVE-2017-12358

A vulnerability in the web-based management interface of Cisco Jabber for Windows, Mac, Android, and iOS could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface. The vulnerability is due to insufficient...

CVE-2017-12349

Multiple vulnerabilities in the web-based management interface of Cisco UCS Central Software could allow a remote attacker to conduct a cross-site scripting XSS attack against a user of the affected interface or hijack a valid session ID from a user of the affected interface. Cisco Bug IDs:...

CVE-2017-12357

A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due to...

CVE-2017-12348

Cisco UCS Central Software web-based management interface contains cross-site scripting (XSS) vulnerabilities (CVE-2017-12348) that could allow a remote attacker to execute script in the user’s browser or hijack a session ID. Root cause: inadequate validation of user-submitted input in the web in...

CVE-2017-12358

Cisco Jabber’s web-based management interface (Windows, Mac, Android, iOS) contains an XSS vulnerability due to insufficient input validation. An authenticated, remote attacker could entice a user to click a malicious link, potentially executing arbitrary script code in the interface or accessing...

CVE-2017-12354

The CVE-2017-12354 issue affects Cisco Secure Access Control System (ACS) web-based interface, where an unauthenticated, remote attacker can view sensitive system software version information. Root cause: the software does not adequately protect version information in responses to HTTP requests. ...

CVE-2017-12356

A vulnerability in the web-based management interface of Cisco Jabber for Windows, Mac, Android, and iOS could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is du...

CVE-2017-12356

CVE-2017-12356 affects Cisco Jabber web-based management interfaces across Windows, Mac, Android and iOS. The issue stems from insufficient input validation in the web UI, enabling an unauthenticated, remote attacker to entice a user to click a crafted link and execute arbitrary script in the int...

CVE-2017-12354

A vulnerability in the web-based interface of Cisco Secure Access Control System ACS could allow an unauthenticated, remote attacker to view sensitive information on an affected system. The vulnerability exists because the affected software does not sufficiently protect system software version...

CVE-2017-12357

The CVE-2017-12357 issue affects Cisco Unified Communications Manager (CUCM) web-based administration interface. The vulnerability stems from improper validation of user-supplied input in the web UI, enabling an authenticated, remote attacker to persuade a user to click a crafted link and trigger...

CVE-2017-12356: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of Cisco Jabber for Windows, Mac, Android, and iOS could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is du...

CVE-2017-12348: Improper Neutralization of Input During Web Page Generation

Multiple vulnerabilities in the web-based management interface of Cisco UCS Central Software could allow a remote attacker to conduct a cross-site scripting XSS attack against a user of the affected interface or hijack a valid session ID from a user of the affected interface. Cisco Bug IDs:...

PT-2017-12522

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager affected versions not specified Description A vulnerability in the web-based management interface could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of...

CVE-2017-12358: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of Cisco Jabber for Windows, Mac, Android, and iOS could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface. The vulnerability is due to insufficient...

CVE-2017-12349: Improper Neutralization of Input During Web Page Generation

Multiple vulnerabilities in the web-based management interface of Cisco UCS Central Software could allow a remote attacker to conduct a cross-site scripting XSS attack against a user of the affected interface or hijack a valid session ID from a user of the affected interface. Cisco Bug IDs:...

PT-2017-12519

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control System ACS affected versions not specified Description A vulnerability in the web-based interface could allow an unauthenticated, remote attacker to view sensitive information on an affected system. The issue exists...

PT-2017-12513

Name of the Vulnerable Software and Affected Versions Cisco UCS Central Software affected versions not specified Description The issue affects the web-based management interface, allowing a remote attacker to conduct a cross-site scripting XSS attack against a user or hijack a valid session ID fr...

PT-2017-12523

Name of the Vulnerable Software and Affected Versions Cisco Jabber for Windows, Mac, Android, and iOS affected versions not specified Description The issue is related to insufficient validation of user-supplied input by the web-based management interface, which could allow an authenticated, remot...

ZKTeco ZKTime Web 2.0.1.12280 Cross Site Request Forgery

Introduction Vendor: ZKTeco Affected Product: ZKTime Web - 2.0.1.12280 Fixed in: Vendor Website: https://www.zkteco.com/product/ZKTimeWeb2.0435.html Vulnerability Type: Cross Site Request Forgery Remote Exploitable: Yes CVE: CVE-2017-17056 2. Product description ZKTime Web 2.0 is a cutting edge...