CVE-2015-4282

Cisco Mobility Services Engine MSE through 8.0.120.7 uses weak permissions for unspecified binary files, which allows local users to obtain root privileges by writing to a file, aka Bug ID CSCuv40504...

Code injection

Cisco AsyncOS 8.x before 8.0.8-113, 8.1.x and 8.5.x before 8.5.3-051, 8.6.x and 8.7.x before 8.7.0-171-LD, and 8.8.x before 8.8.0-085 on Web Security Appliance WSA devices allows remote attackers to cause a denial of service memory consumption via multiple file-range requests, aka Bug ID CSCur391...

CVE-2015-6291

Cisco AsyncOS before 8.5.7-043, 9.x before 9.1.1-023, and 9.5.x and 9.6.x before 9.6.0-046 on Email Security Appliance ESA devices mishandles malformed fields during body-contains, attachment-contains, every-attachment-contains, attachment-binary-contains, dictionary-match, and...

CVE-2015-6291

CVE-2015-6291 affects Cisco AsyncOS on Email Security Appliance (ESA) devices. Root cause: improper input validation when filtering attachments (body-contains, attachment-contains, every-attachment-contains, attachment-binary-contains, dictionary-match, and attachment-dictionary-match), which can...

CVE-2015-6293

Cisco Web Security Appliance (WSA) AsyncOS is affected by CVE-2015-6293 due to a flaw in the file-range request handling. The issue allows unauthenticated remote attackers to cause memory exhaustion and denial of service by opening multiple connections that request file ranges. Affected versions ...

CVE-2015-6356

Cross-site scripting XSS vulnerability in the WeChat page in Cisco Social Miner 10.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCuw60212...

CVE-2015-6355

CVE-2015-6355 affects Cisco UCS Blade Server web interface 2.2(5b)A; the vulnerability allows an unauthenticated remote attacker to obtain potentially sensitive software version information by visiting an unspecified URL. It is an information-disclosure issue (Bug CSCuw87226). Cisco’s advisory no...

CVE-2015-6356

Cross-site scripting XSS vulnerability in the WeChat page in Cisco Social Miner 10.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCuw60212...

CVE-2015-6356

Cisco Social Miner 10.0(1) is affected by a Cross-Site Scripting (XSS) vulnerability in the WeChat page due to insufficient input validation. The issue allows remote attackers to inject arbitrary scripts via unspecified vectors. The CVE entry references Bug ID CSCuw60212. According to Cisco’s adv...

CVE-2015-6354

Multiple cross-site scripting XSS vulnerabilities in Cisco FireSight Management Center MC 5.4.1.3 and 6.0 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuv73338...

CVE-2015-6353

Multiple cross-site scripting XSS vulnerabilities in Cisco FireSight Management Center MC 5.3.1.5 and 5.4.x through 5.4.1.3 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuu28922...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Cisco FireSight Management Center MC 5.3.1.5 and 5.4.x through 5.4.1.3 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuu28922...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Cisco FireSight Management Center MC 5.4.1.3 and 6.0 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuv73338...

CVE-2015-6354

Multiple cross-site scripting XSS vulnerabilities in Cisco FireSight Management Center MC 5.4.1.3 and 6.0 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuv73338...

CVE-2015-6352

Cisco Unified Communications Domain Manager before 10.61 provides different error messages for pathname access attempts depending on whether the pathname exists, which allows remote attackers to map a filesystem via a series of requests, aka Bug ID CSCut67891...

Sql injection

SQL injection vulnerability in the web framework in Cisco Prime Service Catalog 11.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuw50843...

Design/Logic Flaw

The web-based GUI in Cisco Adaptive Security Appliance ASA CX Context-Aware Security 9.34.1.11 allows remote authenticated users to bypass intended access restrictions and obtain sensitive user information via an unspecified HTTP request, aka Bug ID CSCuv74105...

Code injection

Cisco Unified Communications Domain Manager before 10.61 provides different error messages for pathname access attempts depending on whether the pathname exists, which allows remote attackers to map a filesystem via a series of requests, aka Bug ID CSCut67891...

Code injection

Cisco ASR 5500 System Architecture Evolution SAE Gateway devices with software 19.1.0.61559 and 19.2.0 allow remote attackers to cause a denial of service BGP process restart via a crafted header in a BGP packet, aka Bug ID CSCuw65781...

CVE-2015-6352

Cisco Unified Communications Domain Manager (UCD) before version 10.6(1) is affected by an information-disclosure vulnerability where error messages for pathname access differ depending on whether the path exists. This enables remote attackers to map the filesystem by issuing a sequence of reques...