CVE-2016-1342

The device login page in Cisco FirePOWER Management Center 5.3 through 6.0.0.1 allows remote attackers to obtain potentially sensitive software-version information by reading help files, aka Bug ID CSCuy36654...

Information disclosure

The device login page in Cisco FirePOWER Management Center 5.3 through 6.0.0.1 allows remote attackers to obtain potentially sensitive software-version information by reading help files, aka Bug ID CSCuy36654...

Design/Logic Flaw

The Device Manager GUI in Cisco Application Control Engine ACE 4710 A5 before A53.1 allows remote authenticated users to bypass intended RBAC restrictions and execute arbitrary CLI commands with admin privileges via an unspecified parameter in a POST request, aka Bug ID CSCul84801...

CVE-2016-1297

The Cisco ACE 4710 Application Control Engine Device Manager GUI is affected (A5 before A5(3.1/3.0)) by a remote command injection vulnerability via insufficient validation of HTTP POST input, allowing an authenticated attacker to bypass RBAC and execute arbitrary CLI commands with admin privileg...

CVE-2016-1342

Cisco FirePOWER Management Center (FMC) versions 5.3–6.0.0.1 are affected by an information-disclosure vulnerability where the device login page reveals potentially sensitive software-version information by reading help HTML files. The root cause is verbose output returned from HTML file retrieva...

CVE-2016-1335

The SSH implementation in Cisco StarOS before 19.3.M0.62771 and 20.x before 20.0.M0.62768 on ASR 5000 devices mishandles a multi-user public-key authentication configuration, which allows remote authenticated users to gain privileges by establishing a connection from an endpoint that was previous...

Authentication flaw

The SSH implementation in Cisco StarOS before 19.3.M0.62771 and 20.x before 20.0.M0.62768 on ASR 5000 devices mishandles a multi-user public-key authentication configuration, which allows remote authenticated users to gain privileges by establishing a connection from an endpoint that was previous...

CVE-2016-1335

The SSH implementation in Cisco StarOS before 19.3.M0.62771 and 20.x before 20.0.M0.62768 on ASR 5000 devices mishandles a multi-user public-key authentication configuration, which allows remote authenticated users to gain privileges by establishing a connection from an endpoint that was previous...

Umbraco SSRF / Cross Site Request Forgery / Cross Site Scripting

image: Vulnerable Umbraco Recently I got an assignment where I had to work on the Umbraco application - a free Open Source Content Management System built on the ASP.NET platform and is used by more than 2,25,000 websites. While performing the security testing of this application, I discovered...

CVE-2016-1334

Cisco Small Business 500 Wireless Access Point devices with firmware 1.0.4.4 allow remote attackers to set the system time via a crafted POST request, aka Bug ID CSCuy01457...

CVE-2016-1333

Cisco IOS 15.53M and 15.61T0a on Cisco 1000 Connected Grid routers allows remote authenticated users to cause a denial of service device reload via an SNMP request for unspecified BRIDGE MIB OIDs, aka Bug ID CSCux89878...

Design/Logic Flaw

Cisco Small Business 500 Wireless Access Point devices with firmware 1.0.4.4 allow remote attackers to set the system time via a crafted POST request, aka Bug ID CSCuy01457...

CVE-2016-1330

Cisco IOS 15.24E on Industrial Ethernet 2000 devices allows remote attackers to cause a denial of service device reload via crafted Cisco Discovery Protocol CDP packets, aka Bug ID CSCuy27746...

CVE-2016-1321

Cisco Universal Small Cell devices with firmware R2.12 through R3.5 contain an image-decryption key in flash memory, which allows remote attackers to bypass a certain certificate-validation feature and obtain sensitive firmware-image and IP address data via a request to an unspecified Cisco serve...

Design/Logic Flaw

Cisco Universal Small Cell devices with firmware R2.12 through R3.5 contain an image-decryption key in flash memory, which allows remote attackers to bypass a certain certificate-validation feature and obtain sensitive firmware-image and IP address data via a request to an unspecified Cisco serve...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Cisco Emergency Responder 11.50.99833.5 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuy10766...

CVE-2016-1331

CVE-2016-1331 concerns multiple XSS vulnerabilities in Cisco Emergency Responder 11.5(0.99833.5). The issue affects the web interface/web framework code, where insufficient input validation in some parameters allows remote attackers to inject arbitrary web script or HTML. Impact is remote script ...

CVE-2016-1323

The REST interface in Cisco Spark 2015-06 allows remote authenticated users to obtain sensitive information via a request for an unspecified file, aka Bug ID CSCuv84048...

CVE-2016-1320

The CLI in Cisco Prime Collaboration 9.0 and 11.0 allows local users to execute arbitrary OS commands as root by leveraging administrator privileges, aka Bug ID CSCux69286...

Design/Logic Flaw

The REST interface in Cisco Spark 2015-06 allows remote attackers to cause a denial of service resource outage by accessing an administrative page, aka Bug ID CSCuv84125...