CVE-2016-1449

Cisco WebEx Meetings Server 2.6 is affected by CVE-2016-1449: a reflected XSS caused by insufficient validation of user-supplied input, exploitable via a crafted URL to inject arbitrary script in a user’s context. Cisco’s advisory (Cisco Security Advisory cisco-sa-20160714-wms3) notes that softwa...

CVE-2016-1451

Cisco Meeting Server (formerly Acano Conferencing Server) is affected by a cross-site scripting (XSS) vulnerability in its web-based management interface for version 1.7 through 1.9 (Bug ID CSCva19922). The root cause is improper input validation of certain HTTP parameters, enabling an attacker t...

CVE-2016-1426

Cisco IOS XR 5.x through 5.2.5 on NCS 6000 devices allows remote attackers to cause a denial of service timer consumption and Route Processor reload via crafted SSH traffic, aka Bug ID CSCux76819...

CVE-2016-1450

Cisco WebEx Meetings Server 2.6 allows remote authenticated users to conduct command-injection attacks via vectors related to an upload's file type, aka Bug ID CSCuy92715...

CVE-2016-1426

Cisco IOS XR 5.x–5.2.5 on NCS 6000 devices is affected by a denial of service vulnerability (CVE-2016-1426) due to improper management of system timer resources. A remote, unauthenticated attacker can trigger timer/resource exhaustion by establishing multiple SSH connections (and related manageme...

CVE-2016-1446

Cisco WebEx Meetings Server 2.6 contains a SQL injection vulnerability exploitable by remote, authenticated users to execute arbitrary SQL commands via unspecified vectors (Bug CSCuy83200). Root cause is lack of input validation in SQL queries. Cisco has released software updates addressing the i...

CVE-2016-1449

Cross-site scripting XSS vulnerability in Cisco WebEx Meetings Server 2.6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuy92711...

CVE-2016-1447

Cross-site scripting XSS vulnerability in the administrator interface in Cisco WebEx Meetings Server 2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCuy83194...

CVE-2016-1447

Cisco WebEx Meetings Server 2.6 is affected by a reflected XSS in the administrator interface (Bug ID CSCuy83194). The issue stems from insufficient input sanitization, allowing an unauthenticated, remote attacker to craft a URL that injects arbitrary script/HTML in an administrator session. Expl...

CVE-2016-1456

CVE-2016-1456 affects Cisco IOS XR 6.x through 6.0.1. A local attacker can exploit a flaw in the CLI/container input validation to run arbitrary OS commands with elevated/root privileges via a crafted input to a command in a specific container. The issue is a privilege-escalation vulnerability in...

CVE-2016-1456

The CLI in Cisco IOS XR 6.x through 6.0.1 allows local users to execute arbitrary OS commands in a privileged context by leveraging unspecified container access, aka Bug ID CSCuz62721...

CVE-2016-1442

The administrative web interface in Cisco Prime Infrastructure PI before 3.1.1 allows remote authenticated users to execute arbitrary commands via crafted field values, aka Bug ID CSCuy96280...

Authentication flaw

The Mobile and Remote Access MRA component in Cisco TelePresence Video Communication Server VCS X8.1 through X8.7 and Expressway X8.1 through X8.6 mishandles certificates, which allows remote attackers to bypass authentication via an arbitrary trusted certificate, aka Bug ID CSCuz64601...

CVE-2016-1442

The administrative web interface in Cisco Prime Infrastructure PI before 3.1.1 allows remote authenticated users to execute arbitrary commands via crafted field values, aka Bug ID CSCuy96280...

CVE-2016-1442

CVE-2016-1442 affects Cisco Prime Infrastructure (PI) administrative web interface prior to version 3.1.1. The issue allows remote authenticated users to execute arbitrary commands via crafted field values (Bug CSCuy96280). Severity is high (NVD CVSSv3 base score 8.8; CVSSv2 9.0). Exploitation de...

CVE-2016-1337

Cisco EPC3928 devices allow remote attackers to obtain sensitive configuration and credential information by making requests during the early part of the boot process, related to a "Boot Information Disclosure" issue, aka Bug ID CSCux17178...

Buffer overflow

Buffer overflow in the web-based management interface on Cisco RV110W devices with firmware through 1.2.1.4, RV130W devices with firmware through 1.0.2.7, and RV215W devices with firmware through 1.3.0.7 allows remote authenticated users to cause a denial of service device reload via a crafted HT...

Design/Logic Flaw

goform/Docsissystem on Cisco EPC3928 devices allows remote attackers to cause a denial of service device crash via a long LanguageSelect parameter, related to a "Gateway HTTP Corruption Denial of Service" issue, aka Bug ID CSCuy28100...

Design/Logic Flaw

goform/WClientMACList on Cisco EPC3928 devices allows remote attackers to cause a denial of service device crash via a long hsortWireless parameter, related to a "Gateway Client List Denial of Service" issue, aka Bug ID CSCux24948...

Information disclosure

Cisco EPC3928 devices allow remote attackers to obtain sensitive configuration and credential information by making requests during the early part of the boot process, related to a "Boot Information Disclosure" issue, aka Bug ID CSCux17178...