Code injection

Cisco Aironet 1800 devices with software 8.1131.0 allow remote attackers to cause a denial of service CPU consumption by improperly establishing many SSHv2 connections, aka Bug ID CSCux13374...

Design/Logic Flaw

Cisco Content Delivery System Manager Software 3.2 on Videoscape Distribution Suite Service Manager allows remote attackers to obtain sensitive information via crafted URLs in REST API requests, aka Bug ID CSCuv86960...

Design/Logic Flaw

Cisco IOS 15.204M and 15.403M lets physical-interface ACLs supersede virtual PPP interface ACLs, which allows remote authenticated users to bypass intended network-traffic restrictions in opportunistic circumstances by using PPP, aka Bug ID CSCur61303...

CVE-2015-6364

Cisco Videoscape Distribution Suite Service Manager REST API Information Disclosure (CVE-2015-6364) affects Cisco Content Delivery System Manager Software 3.2 on Videoscape Distribution Suite Service Manager. The root cause is improper validation of HTTP requests to the REST API, allowing an unau...

CVE-2015-6364

Cisco Content Delivery System Manager Software 3.2 on Videoscape Distribution Suite Service Manager allows remote attackers to obtain sensitive information via crafted URLs in REST API requests, aka Bug ID CSCuv86960...

CVE-2015-6365

Cisco IOS Software CVE-2015-6365 affects IOS releases 15.2(04)M and 15.4(03)M, where physical-interface ACLs can supersede virtual PPP interface ACLs. This allows an authenticated remote user connected to a PPP session to bypass ACLs on virtual PPP interfaces and potentially pass traffic that sho...

Design/Logic Flaw

Cisco IOS 15.204M6 and 15.403S lets physical-interface ACLs supersede tunnel-interface ACLs, which allows remote attackers to bypass intended network-traffic restrictions in opportunistic circumstances by using a tunnel, aka Bug ID CSCur01042...

CVE-2015-6366

CVE-2015-6366 affects Cisco IOS (versions 15.2(04)M6 and 15.4(03)S). The root cause is that physical-interface ACLs can supersede tunnel-interface ACLs, allowing an unauthenticated, remote user connected to a tunnel to bypass traffic restrictions. Impact is described as bypassing intended network...

CVE-2015-6366

Cisco IOS 15.204M6 and 15.403S lets physical-interface ACLs supersede tunnel-interface ACLs, which allows remote attackers to bypass intended network-traffic restrictions in opportunistic circumstances by using a tunnel, aka Bug ID CSCur01042...

CVE-2015-6363

Multiple cross-site scripting XSS vulnerabilities in the web framework in Cisco FireSIGHT Management Center MC 5.4.1.4 and 6.0.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuw88396...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the web framework in Cisco FireSIGHT Management Center MC 5.4.1.4 and 6.0.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuw88396...

CVE-2015-6363

Multiple cross-site scripting XSS vulnerabilities in the web framework in Cisco FireSIGHT Management Center MC 5.4.1.4 and 6.0.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuw88396...

Design/Logic Flaw

The web GUI in Cisco Connected Grid Network Management System CG-NMS 3.00.35 and 3.00.54 allows remote authenticated users to bypass intended access restrictions and modify the configuration by leveraging the Monitor-Only role, aka Bug ID CSCuw42640...

CVE-2015-6362

The web GUI in Cisco Connected Grid Network Management System CG-NMS 3.00.35 and 3.00.54 allows remote authenticated users to bypass intended access restrictions and modify the configuration by leveraging the Monitor-Only role, aka Bug ID CSCuw42640...

CVE-2015-6316

The default configuration of sshdconfig in Cisco Mobility Services Engine MSE through 8.0.120.7 allows logins by the oracle account, which makes it easier for remote attackers to obtain access by entering this account's hardcoded password in an SSH session, aka Bug ID CSCuv40501...

CVE-2015-6298

The admin web interface in Cisco AsyncOS 8.x before 8.0.8-113, 8.1.x and 8.5.x before 8.5.3-051, 8.6.x and 8.7.x before 8.7.0-171-LD, and 8.8.x before 8.8.0-085 on Web Security Appliance WSA devices allows remote authenticated users to obtain root privileges via crafted certificate-generation...

Design/Logic Flaw

The proxy-cache implementation in Cisco AsyncOS 8.0.x before 8.0.7-151, 8.1.x and 8.5.x before 8.5.2-004, 8.6.x and 8.7.x before 8.7.0-171-LD, and 8.8.x before 8.8.0-085 on Web Security Appliance WSA devices allows remote attackers to cause a denial of service memory consumption via multiple prox...

CVE-2015-6298

The admin web interface in Cisco AsyncOS 8.x before 8.0.8-113, 8.1.x and 8.5.x before 8.5.3-051, 8.6.x and 8.7.x before 8.7.0-171-LD, and 8.8.x before 8.8.0-085 on Web Security Appliance WSA devices allows remote authenticated users to obtain root privileges via crafted certificate-generation...

CVE-2015-6316

The default configuration of sshdconfig in Cisco Mobility Services Engine MSE through 8.0.120.7 allows logins by the oracle account, which makes it easier for remote attackers to obtain access by entering this account's hardcoded password in an SSH session, aka Bug ID CSCuv40501...

CVE-2015-6298

The CVE-2015-6298 issue concerns Cisco AsyncOS for Web Security Appliance (WSA) and Cisco Web Security Appliance admin web interface. Affected AsyncOS versions include 8.x before 8.0.8-113, 8.1.x and 8.5.x before 8.5.3-051, 8.6.x and 8.7.x before 8.7.0-171-LD, and 8.8.x before 8.8.0-085. The root...