CVE-2015-4301

Cisco Nexus 9000 Series NX-OS (Nexus 9000 devices, 11.1(1c)) is affected by CVE-2015-4301. The issue allows a remote authenticated attacker to cause a denial of service (device hang) by copying large files to the device filesystem, via Bug CSCuu77225. Exploitation requires valid credentials and t...

CVE-2015-6255

Cross-site scripting XSS vulnerability in Cisco Unified Web and E-Mail Interaction Manager 9.02 allows remote attackers to inject arbitrary web script or HTML via a crafted chat message, aka Bug ID CSCuo89051...

CVE-2015-4301

Cisco NX-OS on Nexus 9000 devices 11.11c allows remote authenticated users to cause a denial of service device hang via large files that are copied to a device's filesystem, aka Bug ID CSCuu77225...

CVE-2015-4308

CVE-2015-4308 affects Cisco Edge Bluebird OS 1.2 on Edge 340 devices, where the webGUI configuration-export feature allows remote authenticated users to view sensitive information due to insufficient input validation. The advisory and NVD entry describe a user-authenticated exposure that can disc...

CVE-2015-4299

Cisco's advisory for CVE-2015-4299 states that Cisco Unified Web and E-Mail Interaction Manager 9.0(2) exposes an authorization flaw. An authenticated, remote attacker can remove default messaging-queue system folders due to improper authorization logic. Root cause: insufficient validation of per...

Open redirect

Open redirect vulnerability in Cisco WebEx Node for Media Convergence Server MCS allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted HTTP request parameters, aka Bug ID CSCuv32136...

Design/Logic Flaw

The web interface in Cisco FireSIGHT Management Center 5.3.1.4 allows remote attackers to delete arbitrary system policies via modified parameters in a POST request, aka Bug ID CSCuu25390...

CVE-2015-4297

Open redirect vulnerability (CVE-2015-4297) in Cisco WebEx Node for Media Convergence Server (MCS) allows remote attackers to redirect users to arbitrary sites via crafted HTTP request parameters, enabling phishing-like redirection. Multiple sources (CNVD/CVE records) confirm the issue and note t...

CVE-2015-4302

The web interface in Cisco FireSIGHT Management Center 5.3.1.4 allows remote attackers to delete arbitrary system policies via modified parameters in a POST request, aka Bug ID CSCuu25390...

CVE-2015-4294

Cross-site scripting XSS vulnerability in Cisco IM and Presence Service before 10.5 MR1 allows remote attackers to inject arbitrary web script or HTML by constructing a crafted URL that leverages incomplete filtering of HTML elements, aka Bug ID CSCut41766...

CVE-2015-4292

Cross-site scripting XSS vulnerability in the management interface in Cisco Prime Central for Hosted Collaboration Solution PC4HCS 10.62 allows remote attackers to inject arbitrary web script or HTML via an unspecified value, aka Bug ID CSCuv45818...

CVE-2015-4291

Cisco IOS XE 2.x before 2.4.3 and 2.5.x before 2.5.1 on ASR 1000 devices allows remote attackers to cause a denial of service Embedded Services Processor crash via a crafted series of fragmented 1 IPv4 or 2 IPv6 packets, aka Bug ID CSCtd72617...

CVE-2015-4289

Directory traversal vulnerability in Cisco AnyConnect Secure Mobility Client 4.02049 allows remote head-end systems to write to arbitrary files via a crafted configuration attribute, aka Bug ID CSCut93920...

Code injection

Cisco IOS XE 2.x before 2.4.3 and 2.5.x before 2.5.1 on ASR 1000 devices allows remote attackers to cause a denial of service Embedded Services Processor crash via a crafted series of fragmented 1 IPv4 or 2 IPv6 packets, aka Bug ID CSCtd72617...

Cross site scripting

Cross-site scripting XSS vulnerability in Cisco IM and Presence Service before 10.5 MR1 allows remote attackers to inject arbitrary web script or HTML by constructing a crafted URL that leverages incomplete filtering of HTML elements, aka Bug ID CSCut41766...

Design/Logic Flaw

The Prime Collaboration Deployment component in Cisco Unified Communications Manager 10.53.10000.9 allows remote authenticated users to discover root credentials via a direct request to an unspecified URL, aka Bug ID CSCuv21819...

Cross site scripting

Cross-site scripting XSS vulnerability in the management interface in Cisco Prime Central for Hosted Collaboration Solution PC4HCS 10.62 allows remote attackers to inject arbitrary web script or HTML via an unspecified value, aka Bug ID CSCuv45818...

Directory traversal

Directory traversal vulnerability in Cisco AnyConnect Secure Mobility Client 4.02049 allows remote head-end systems to write to arbitrary files via a crafted configuration attribute, aka Bug ID CSCut93920...

CVE-2015-4295

The Prime Collaboration Deployment component in Cisco Unified Communications Manager 10.53.10000.9 allows remote authenticated users to discover root credentials via a direct request to an unspecified URL, aka Bug ID CSCuv21819...

CVE-2015-4294

CVE-2015-4294 affects Cisco IM and Presence Service before 10.5 MR1, a reflected XSS due to incomplete filtering of HTML/script tags in crafted URLs. This could allow an unauthenticated remote attacker to execute arbitrary script in an authenticated user’s browser. Cisco's advisory notes a softwa...