Cisco IOS AAA Login DoS (cisco-sa-20160928-aaados)

According to its self-reported version, Cisco IOS is affected by a denial of service DoS vulnerability in the Authentication, Authorization, and Accounting AAA service for remote Secure Shell Host SSH connection. An unauthenticated, remote attacker can exploit this, by attempting to authenticate ...

Cisco IOS Software Integrated Services Module for VPN DoS (cisco-sa-20180328-dos)

According to its self-reported version, Cisco IOS Software is affected by a vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN ISM-VPN due to insufficient handling of VPN traffic by the affected device. An unauthenticated, remote attacker can exploit this by sendin...

Cisco IOS XE Software Zone-Based Firewall IP Fragmentation DoS (cisco-sa-20180328-fwip)

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability in the Zone-Based Firewall due to the way fragmented packets in the firewall code. An unauthenticated, remote attacker can exploit this by sending fragmented IP Version 4 or IP Version 6 packets through a...

Cisco IOS XE Software Autonomic Networking Infrastructure Certificate Revocation (cisco-sa-20170726-anicrl)

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability in the Autonomic Networking feature because the affected software does not transfer certificate revocation lists CRLs across Autonomic Control Plane ACP channels. An unauthenticated, remote attacker can...

Cisco IOS Autonomic Control Plane Channel Information Disclosure (cisco-sa-20170726-aniacp)

According to its self-reported version, Cisco IOS is affected by an information disclosure vulnerability in the Autonomic Networking feature due to unknown reasons. An unauthenticated, adjacent attacker can exploit this by capturing and replaying Autonomic Control Plane ACP packets that are...

Cisco TelePresence Endpoint Software Privilege Escalation Vulnerability

According to its self-reported version, the Cisco TelePresence Codec TC and Collaboration Endpoint CE Cisco TelePresence Software is affected by software privilege escalation vulnerability. An authenticated, remote attacker to escalate privileges to an unrestricted user of the restricted shell. T...

Cisco Web Security Appliance Unauthorized Device Reset Vulnerability

According to its self-reported version, Cisco Web Security Appliance WSA is affected by the following vulnerability: - A vulnerability in the web management interface of Cisco AsyncOS Software for Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to perform an...

Cisco IOS XE Software NAT DoS (cisco-sa-20160928-esp-nat)

According to its self-reported version, Cisco IOS XE Software is affected by a denial of service DoS vulnerability in the implementation of Network Address Translation NAT functionality due to improper handling of malformed ICMP packets by the affected software. An unauthenticated, remote attacke...

Cisco IOS XE Software Smart Install Memory Leak (cisco-sa-20160928-smi)

According to its self-reported version, Cisco IOS XE Software is affected by a denial of service DoS vulnerability in the Smart Install client feature due to incorrect handling of image list parameters. An unauthenticated, remote attacker can exploit this, by sending crafted Smart Install packets...

Cisco IOS Smart Install Memory Leak (cisco-sa-20160928-smi)

According to its self-reported version, Cisco IOS is affected by a denial of service DoS vulnerability in the Smart Install client feature due to incorrect handling of image list parameters. An unauthenticated, remote attacker can exploit this, by sending crafted Smart Install packets to TCP port...

Cisco IOS H.323 Message Validation DoS (cisco-sa-20160928-h323)

According to its self-reported version, Cisco IOS Software is affected by a vulnerability in the H.323 subsystem due to a failure to properly validate certain fields in an H.323 protocol suite message. An unauthenticated, remote attacker may exploit this, by sending a malicious message, causing a...

Cisco IOS XE Software H.323 Message Validation DoS (cisco-sa-20160928-h323)

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability in the H.323 subsystem due to a failure to properly validate certain fields in an H.323 protocol suite message. An unauthenticated, remote attacker may exploit this, by sending a malicious message, causin...

Cisco Unity Connection Web Framework XSS (cisco-sa-20191002-cuc-xss)

A cross-site scripting XSS vulnerability exists due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this, by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user's browser session...

Cisco Unified Communications Manager SQLi (cisco-sa-20191002-cuc-inject)

According to its self-reported version, Cisco Unified Communications Manager is affected by an SQL injection vulnerability. This is due to improper validation of user-supplied input. An authenticated, remote attacker can exploit this by sending crafted requests with malicious SQL statements to...

Cisco Unified Communications Manager Security Bypass Vulnerability (cisco-sa-20191002-ucm-secbypass)

According to its self-reported version, Cisco Unified Communications Manager is affected by a vulnerability that allows an unauthenticated, remote attacker to bypass security restrictions. This is due to improper handling of malformed HTTP methods. An attacker can exploit this vulnerability by...

Cisco Adaptive Security Appliance Software SIP Inspection DoS (cisco-sa-20191002-asa-ftd-sip-dos)

A denial of service DoS vulnerability exists in the Session Initiation Protocol SIP inspection module of Cisco Adaptive Security Appliance ASA due to improper parsing of SIP messages. An unauthenticated, remote attacker can exploit this issue by sending a malicious SIP packet to an affected devic...

Cisco Firepower Management Center Software Stored Cross-Site Scripting (XSS) Vulnerability (cisco-sa-20191016-fpwr-xss)

According to its self-reported version, Cisco Firepower Management Center is prior to 6.5.0. It is, therefore, affected by a cross-site scripting XSS vulnerability due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this,...

Cisco Wireless LAN Controller Path Traversal Vulnerability

According to its self-reported version, Cisco Wireless LAN Controller WLC is affected by a directory traversal vulnerability due to improper sanitization of user-supplied input in command-line parameters that describe file names. An authenticated, local attacker can exploit this to view system...

Cisco Finesse Information Disclosure (cisco-sa-20180718-finesse)

According to its self-reported version, Cisco Finesse Software is affected by an information disclosure vulnerability. The vulnerability in the web-based management interface could allow an unauthenticated, remote attacker to retrieve a cleartext password from an affected system. Please see the...

Cisco IOS Software IP Service Level Agreement Denial of Service Vulnerability

According to its self-reported version, Cisco IOS Software is affected by a vulnerability in the processing of IP Service Level Agreement SLA packets by Cisco IOS Software and Cisco IOS software, which could allow an unauthenticated, remote attacker to cause an interface wedge and an eventual...