Code injection

The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial of service via crafted fields in SRTP packets, aka Bug ID CSCux00686...

CVE-2016-1362

CVE-2016-1362 affects Cisco AireOS on Wireless LAN Controllers (WLC) running 4.1–7.4.120.0, 7.5.x, and 7.6.100.0. The vulnerability arises from the web-based management interface’s handling of unsupported URLs, allowing an unauthenticated remote attacker to trigger a device reload (DoS) via a cra...

CVE-2016-1363

Buffer overflow in the redirection functionality in Cisco Wireless LAN Controller WLC Software 7.2 through 7.4 before 7.4.140.0MD and 7.5 through 8.0 before 8.0.115.0ED allows remote attackers to execute arbitrary code via a crafted HTTP request, aka Bug ID CSCus25617...

CVE-2015-6360

The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial of service via crafted fields in SRTP packets, aka Bug ID CSCux00686...

CVE-2015-6360

CVE-2015-6360 affects libsrtp/libSRTP, with several advisories noting that the encryption-processing feature allows remote DoS via crafted SRTP packets. The root cause in the reports is improper handling of CSRC count and extension header length in RTP headers, leading to vulnerable RTP processin...

CVE-2016-1384

The NTP implementation in Cisco IOS 15.1 and 15.5 and IOS XE 3.2 through 3.17 allows remote attackers to modify the system time via crafted packets, aka Bug ID CSCux46898...

CVE-2016-1384

The NTP implementation in Cisco IOS 15.1 and 15.5 and IOS XE 3.2 through 3.17 allows remote attackers to modify the system time via crafted packets, aka Bug ID CSCux46898...

Multiple Cisco Products libSRTP Denial of Service Vulnerability

Cisco released version 1.5.3 of the Secure Real-Time Transport Protocol SRTP library libSRTP, which addresses a denial of service DoS vulnerability. Multiple Cisco products incorporate a vulnerable version of the libSRTP library. The vulnerability is in the encryption processing subsystem of...

CVE-2016-1340

Heap-based buffer overflow in Cisco Unified Computing System UCS Platform Emulator 2.52TS4, 3.02cA, and 3.02cTS9 allows local users to gain privileges via crafted libclimeta.so filename arguments, aka Bug ID CSCux68837...

CVE-2016-1339

Cisco Unified Computing System UCS Platform Emulator 2.52TS4, 3.02cA, and 3.02cTS9 allows local users to gain privileges via crafted arguments on a ucspe-copy command line, aka Bug ID CSCux68832...

Heap overflow

Heap-based buffer overflow in Cisco Unified Computing System UCS Platform Emulator 2.52TS4, 3.02cA, and 3.02cTS9 allows local users to gain privileges via crafted libclimeta.so filename arguments, aka Bug ID CSCux68837...

Command injection

Cisco Unified Computing System UCS Platform Emulator 2.52TS4, 3.02cA, and 3.02cTS9 allows local users to gain privileges via crafted arguments on a ucspe-copy command line, aka Bug ID CSCux68832...

CVE-2016-1339

Cisco Unified Computing System UCS Platform Emulator 2.52TS4, 3.02cA, and 3.02cTS9 allows local users to gain privileges via crafted arguments on a ucspe-copy command line, aka Bug ID CSCux68832...

Cisco TelePresence Server Malformed STUN Packet Processing DoS (cisco-sa-20160406-cts2)

According to its self-reported version, the Cisco TelePresence Server running on the remote host is affected by a denial of service vulnerability due to improper processing of malformed Session Traversal Utilities for NAT STUN packets. An unauthenticated, remote attacker can exploit this, via...

Input validation

Cisco Unified Computing System UCS Central Software 1.31b and earlier allows remote attackers to execute arbitrary OS commands via a crafted HTTP request, aka Bug ID CSCuv33856...

Design/Logic Flaw

Cisco IOS before 15.22E1 on Catalyst switches allows remote attackers to obtain potentially sensitive software-version information via a request to the Network Mobility Services Protocol NMSP port, aka Bug ID CSCum62591...

CVE-2016-1378

Cisco Catalyst Switches running Cisco IOS prior to 15.2(2)E1 are affected by CVE-2016-1378, a remote information-disclosure vulnerability in the Network Mobility Services Protocol (NMSP) that allows unauthenticated attackers to obtain the device software version via the NMSP port. The issue stems...

CVE-2016-1378

Cisco IOS before 15.22E1 on Catalyst switches allows remote attackers to obtain potentially sensitive software-version information via a request to the Network Mobility Services Protocol NMSP port, aka Bug ID CSCum62591...

CVE-2016-1352

Cisco Unified Computing System UCS Central Software 1.31b and earlier allows remote attackers to execute arbitrary OS commands via a crafted HTTP request, aka Bug ID CSCuv33856...

CVE-2016-1377

Cross-site scripting XSS vulnerability in Cisco Unity Connection through 11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCus21776...