CVE-2015-6426

Cisco Prime Network Services Controller 3.0 allows local users to bypass intended access restrictions and execute arbitrary commands via additional parameters to an unspecified command, aka Bug ID CSCus99427...

Design/Logic Flaw

Cisco FireSIGHT Management Center allows remote attackers to bypass the HTTP attack detection feature and avoid triggering Snort IDS rules via an SSL session that is mishandled after decryption, aka Bug ID CSCux53437...

Command injection

Cisco Prime Network Services Controller 3.0 allows local users to bypass intended access restrictions and execute arbitrary commands via additional parameters to an unspecified command, aka Bug ID CSCus99427...

CVE-2015-6426

Cisco Prime Network Services Controller 3.0 is affected by CVE-2015-6426. A local attacker can bypass access restrictions and execute arbitrary commands by supplying extra parameters to an unspecified local command due to insufficient validation of local commands (Bug CSCus99427). The issue can b...

CVE-2015-6427

Cisco FireSIGHT Management Center allows remote attackers to bypass the HTTP attack detection feature and avoid triggering Snort IDS rules via an SSL session that is mishandled after decryption, aka Bug ID CSCux53437...

CVE-2015-6426

Cisco Prime Network Services Controller 3.0 allows local users to bypass intended access restrictions and execute arbitrary commands via additional parameters to an unspecified command, aka Bug ID CSCus99427...

CVE-2015-6427

CVE-2015-6427 describes a vulnerability in Cisco FireSIGHT Management Center where the HTTP attack detection of decrypted SSL traffic can be bypassed. The issue stems from improper handling of SSL-decrypted sessions, allowing an unauthenticated, remote attacker to bypass HTTP attack detection rul...

CVE-2015-6425

The WebApplications Identity Management subsystem in Cisco Unified Communications Manager 10.50.98000.88 allows remote attackers to cause a denial of service subsystem outage via invalid session tokens, aka Bug ID CSCul83786...

CVE-2015-6411

Cisco FirePOWER Management Center 5.4.1.3, 6.0.0, and 6.0.1 provides verbose responses to requests for help files, which allows remote attackers to obtain potentially sensitive version information by reading an unspecified field, aka Bug ID CSCux37061...

CVE-2015-6403

The TFTP implementation on Cisco Small Business SPA30x, SPA50x, SPA51x phones 7.5.7 improperly validates firmware-image file integrity, which allows local users to load a Trojan horse image by leveraging shell access, aka Bug ID CSCut67400...

Code injection

The Neighbor Discovery ND protocol implementation in the IPv6 stack in Cisco IOS 15.33S0.1 on ASR devices mishandles internal tables, which allows remote attackers to cause a denial of service memory consumption or device crash via a flood of crafted ND messages, aka Bug ID CSCup28217...

Design/Logic Flaw

Cisco FirePOWER Management Center 5.4.1.3, 6.0.0, and 6.0.1 provides verbose responses to requests for help files, which allows remote attackers to obtain potentially sensitive version information by reading an unspecified field, aka Bug ID CSCux37061...

Design/Logic Flaw

The Supervisor 1.0.0.0 and 1.0.0.1 in Cisco Integrated Management Controller IMC before 2.09 allows remote authenticated users to cause a denial of service IP interface outage via crafted parameters in an HTTP request, aka Bug ID CSCuv38286...

Code injection

Cisco Hosted Collaboration Mediation Fulfillment 10.63 does not use RBAC, which allows remote authenticated users to obtain sensitive credential information by leveraging admin access and making SOAP API requests, aka Bug ID CSCuw84374...

Cross site scripting

Cisco Unified Communications Manager UCM 8.0 through 8.6 allows remote attackers to bypass an XSS protection mechanism via a crafted parameter, aka Bug ID CSCuu15266...

CVE-2015-6411

Cisco FirePOWER Management Center is affected by CVE-2015-6411. Versions 5.4.1.3, 6.0.0, and 6.0.1 disclose potentially sensitive software version information via verbose responses when help files are requested, enabling an unauthenticated, remote attacker to read the disclosed field. The root ca...

CVE-2015-6403

The CVE-2015-6403 issue affects Cisco Small Business SPA30x, SPA50x, and SPA51x IP Phones (firmware 7.5.7). The root cause is inadequate file integrity checks during firmware image validation in the TFTP implementation, enabling a local attacker with shell access to load a Trojan horse image onto...

CVE-2015-6411

Cisco FirePOWER Management Center 5.4.1.3, 6.0.0, and 6.0.1 provides verbose responses to requests for help files, which allows remote attackers to obtain potentially sensitive version information by reading an unspecified field, aka Bug ID CSCux37061...

CVE-2015-4206

Cisco UCM 8.0–8.6 contains a Cross‑Site Scripting filter bypass (CVE-2015-4206). A crafted URL parameter allows remote, unauthenticated attackers to bypass the XSS protection in the web management interface and potentially execute code in a user’s browser. The Cisco advisory (cisco-sa-20151214-uc...

CVE-2015-6404

The CVE-2015-6404 entry concerns Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) 10.6(3), where lack of RBAC in the SOAP API allows an authenticated admin user to retrieve sensitive credentials and other restricted data. Root cause: missing RBAC in the HCM-F SOAP interface. Impact: infor...