Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Cisco Emergency Responder 10.51a allow remote attackers to inject arbitrary web script or HTML via unspecified fields, aka Bug ID CSCuv25547...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Cisco Emergency Responder 10.51 and 10.51a allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuv26501...

Hardcoded credentials

Cisco Prime Collaboration Assurance before 11.0 has a hardcoded cmuser account, which allows remote attackers to obtain access by establishing an SSH session and leveraging knowledge of this account's password, aka Bug ID CSCus62707...

CVE-2015-6405

CVE-2015-6405 is a CSRF vulnerability in Cisco Emergency Responder (web framework) affecting version 10.5(1) and 10.5(1a). The issue arises from insufficient CSRF protection, allowing an unauthenticated, remote attacker to perform actions with a user’s privileges by tricking them into visiting a ...

CVE-2015-6413

Cisco TelePresence Video Communication Server VCS Expressway X8.6 allows remote authenticated users to bypass intended read-only restrictions and upload Tandberg Linux Package TLP files by visiting an administrative page, aka Bug ID CSCuw55651...

CVE-2015-6407

Cisco Emergency Responder 10.53.10000.9 allows remote attackers to upload files to arbitrary locations via a crafted parameter, aka Bug ID CSCuv25501...

CVE-2015-6418

The random-number generator on Cisco Small Business RV routers 4.x and SA500 security appliances 2.2.07 does not have sufficient entropy, which makes it easier for remote attackers to determine a TLS key pair via unspecified computations upon handshake key-exchange data, aka Bug ID CSCus15224...

CVE-2015-6361

The administrative web interface on Cisco DPC3939 XB3 devices with firmware 121109aCMCST allows remote authenticated users to execute arbitrary commands via unspecified fields, aka Bug ID CSCuw86170...

CVE-2015-6389

Cisco Prime Collaboration Assurance before 11.0 has a hardcoded cmuser account, which allows remote attackers to obtain access by establishing an SSH session and leveraging knowledge of this account's password, aka Bug ID CSCus62707...

CVE-2015-6407

Cisco Emergency Responder 10.5(3.10000.9) is affected by a Web Framework Arbitrary File Upload vulnerability. The issue stems from insufficient parameter validation in the CER web framework, allowing unauthenticated remote attackers to upload arbitrary files to arbitrary locations on the device v...

CVE-2015-6405

Cross-site request forgery CSRF vulnerability in Cisco Emergency Responder 10.51 and 10.51a allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuv26501...

CVE-2015-6406

CVE-2015-6406 describes a directory traversal vulnerability in Cisco Emergency Responder’s Tools menu. Affected software is Cisco Emergency Responder 10.5(1.10000.5). The root cause is improper sanitization of user-supplied input that forms a filename, allowing authenticated, remote attackers to ...

CVE-2015-6400

Cisco Emergency Responder Web Framework Cross-Site Scripting Vulnerability (CVE-2015-6400) affects Cisco Emergency Responder 10.5(1a). The issue is a stored XSS flaw caused by insufficient validation on input fields in the web framework, allowing an unauthenticated, remote attacker to inject and ...

CVE-2015-6361

CVE-2015-6361 affects Cisco DPC3939 (XB3) with firmware 121109aCMCST, where the web-based administrative interface allows authenticated remote command execution due to improper input validation in unspecified fields. The issue is documented by Cisco as a command-injection vulnerability in the XB3...

Code injection

Cisco Unified Computing System UCS 2.23fA on Fabric Interconnect 6200 devices allows remote attackers to cause a denial of service CPU consumption or device outage via a SYN flood on the SSH port during the booting process, aka Bug ID CSCuu81757...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Cisco Unity Connection 11.50.98 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCux24578...

CVE-2015-6415

Cisco Unified Computing System UCS 2.23fA on Fabric Interconnect 6200 devices allows remote attackers to cause a denial of service CPU consumption or device outage via a SYN flood on the SSH port during the booting process, aka Bug ID CSCuu81757...

CVE-2015-6417

Cisco Videoscape Distribution Suite Service Manager VDS-SM 3.4.0 and earlier does not always use RBAC for backend database access, which allows remote authenticated users to read or write to database entries via 1 the GUI or 2 a crafted HTTP request, aka Bug ID CSCuv87025...

CVE-2015-6395

Cisco Prime Service Catalog 10.0, 10.0R2, 10.1, and 11.0 does not properly restrict access to web pages, which allows remote attackers to modify the configuration via a direct request, aka Bug ID CSCuw48188...

CVE-2015-6395

CVE-2015-6395 affects Cisco Prime Service Catalog web interface (versions 10.0, 10.0R2, 10.1, 11.0). The vulnerability arises from insufficient access controls on web pages, allowing remote attackers to modify configuration via a direct URL request. Exploitation could enable unauthenticated, remo...