Input validation

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 improperly checks for a user account's read-only attribute, which allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, as demonstrated by read or write operations on the Unified...

Code injection

The CLI in Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 allows local users to obtain root privileges by writing script arguments to an unspecified file, aka Bug ID CSCuv12542...

CVE-2015-4320

The Configuration Log File component in Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 allows remote authenticated users to obtain sensitive information by reading a log file, aka Bug ID CSCuv12340...

CVE-2015-4327

The CLI in Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 allows local users to obtain root privileges by writing script arguments to an unspecified file, aka Bug ID CSCuv12542...

CVE-2015-4328

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 improperly checks for a user account's read-only attribute, which allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, as demonstrated by read or write operations on the Unified...

Security Advisory 0012

Security Advisory 0012 PDF Date: August 20th 2015 Revision | Date | Changes ---|---|--- 1.0 | August 20th, 2015 | Initial release 1.1 | August 24th, 2015 | Updated with patch details. 1.2 | November 22nd, 2017 | Updated with the fixed updated EOS releases Arista 7000 Series Products and Arista EO...

Design/Logic Flaw

Nexus Data Broker NDB on Cisco Nexus 3000 devices with software 6.02A61 allows remote attackers to cause a denial of service Java process restart via crafted connections to the Java application, aka Bug ID CSCut87006...

CVE-2015-4296

Cisco Nexus 3000 Series switches are affected by CVE-2015-4296 via the Nexus Data Broker (NDB). The issue arises in the Java application handling incoming connections, where crafted connections can cause the Java process to restart, yielding a partial Denial of Service. Affected software is Nexus...

CVE-2015-4296

Nexus Data Broker NDB on Cisco Nexus 3000 devices with software 6.02A61 allows remote attackers to cause a denial of service Java process restart via crafted connections to the Java application, aka Bug ID CSCut87006...

Design/Logic Flaw

The global-configuration implementation on Cisco ASR 9000 devices with software 5.1.3 and 5.3.0 improperly closes vty sessions after a commit/end operation, which allows local users to cause a denial of service tmp/config file creation, memory consumption, and device hang via unspecified vectors,...

CVE-2015-4277

The global-configuration implementation on Cisco ASR 9000 devices with software 5.1.3 and 5.3.0 improperly closes vty sessions after a commit/end operation, which allows local users to cause a denial of service tmp/config file creation, memory consumption, and device hang via unspecified vectors,...

CVE-2015-4277

CVE-2015-4277 affects Cisco ASR 9000 Series Aggregation Services Routers running software 5.1.3 and 5.3.0. The issue stems from abrupt closing of vty sessions after a commit/end in global configuration mode, which allows a local, authenticated attacker to cause a denial of service by creating exc...

CVE-2015-4301

Cisco NX-OS on Nexus 9000 devices 11.11c allows remote authenticated users to cause a denial of service device hang via large files that are copied to a device's filesystem, aka Bug ID CSCuu77225...

CVE-2015-4298

Cisco Unified Web and E-Mail Interaction Manager 9.02 and 11.01 improperly performs authorization, which allows remote authenticated users to read or write to stored data via unspecified vectors, aka Bug ID CSCuo89056...

Design/Logic Flaw

The webGUI configuration-export feature in Cisco Edge Bluebird Operating System 1.2 on Edge 340 devices allows remote authenticated users to obtain sensitive information via unspecified vectors, aka Bug ID CSCuu43968...

Authorization

Cisco Unified Web and E-Mail Interaction Manager 9.02 and 11.01 improperly performs authorization, which allows remote authenticated users to read or write to stored data via unspecified vectors, aka Bug ID CSCuo89056...

Authentication flaw

Cisco Content Security Management Appliance SMA 8.3.6-039, 9.1.0-31, and 9.1.0-103 improperly restricts the privileges available after LDAP authentication, which allows remote authenticated users to read or write to an arbitrary user's Spam Quarantine folder by visiting a spam-notification URL, a...

CVE-2015-4308

The webGUI configuration-export feature in Cisco Edge Bluebird Operating System 1.2 on Edge 340 devices allows remote authenticated users to obtain sensitive information via unspecified vectors, aka Bug ID CSCuu43968...

CVE-2015-4298

CVE-2015-4298 affects Cisco Unified Web and E-Mail Interaction Manager (versions 9.0(2) and 11.0(1)). The root cause is improper authorization handling that allows remote authenticated users to read or write stored data via unspecified vectors. The vulnerability results from insufficient validati...

CVE-2015-4322

Cisco Content Security Management Appliance SMA 8.3.6-039, 9.1.0-31, and 9.1.0-103 improperly restricts the privileges available after LDAP authentication, which allows remote authenticated users to read or write to an arbitrary user's Spam Quarantine folder by visiting a spam-notification URL, a...