CVE-2015-4458

The TLS implementation in the Cavium cryptographic-module firmware, as distributed with Cisco Adaptive Security Appliance ASA Software 9.15.21 and other products, does not verify the MAC field, which allows man-in-the-middle attackers to spoof TLS content by modifying packets, aka Bug ID CSCuu529...

CVE-2015-4280

Cisco Prime Collaboration Assurance 10.0 is affected by CVE-2015-4280. The vulnerability arises from improper handling of crafted HTTP requests to the web interface, allowing a remote, unauthenticated attacker to cause the web UI to become unresponsive (DoS). Impact is described as partial availa...

CVE-2015-4276

Cisco WebEx Meetings Server 2.5MR1 allows remote authenticated users to execute arbitrary code via a crafted command parameter, aka Bug ID CSCus56138...

Cross site scripting

The web interface in Cisco Identity Services Engine ISE 1.14.1, 1.3106.146, and 1.3120.135 does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame...

Command injection

The Packet Data Network Gateway aka PGW component on Cisco ASR 5000 devices with software 18.0.0.59167 and 18.0.0.59211 allows remote attackers to cause a denial of service via a malformed header in a GTPv2 packet, aka Bug ID CSCut11534...

Code injection

Cisco WebEx Meetings Server 2.5MR1 allows remote authenticated users to execute arbitrary code via a crafted command parameter, aka Bug ID CSCus56138...

CVE-2015-4276

CVE-2015-4276 affects Cisco WebEx Meetings Server 2.5MR1. The vulnerability arises from insufficient sanitization of user-supplied input, allowing an authenticated, remote attacker to craft a command parameter to execute arbitrary code on the target system. Impact per sources: remote code executi...

CVE-2015-4266

The web interface in Cisco Identity Services Engine ISE 1.14.1, 1.3106.146, and 1.3120.135 does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame...

CVE-2015-4271

Cisco TelePresence TC before 7.3.4 on Integrator C devices allows remote attackers to bypass authentication via vectors involving multiple request parameters, aka Bug ID CSCuv00604...

CVE-2015-4267

Cisco Identity Services Engine (ISE) 1.2(0.793), 1.3(0.876), 1.4(0.109), 2.0(0.147), and 2.0(0.169) are affected by a CSRF vulnerability in the web framework due to insufficient CSRF protections. The CVE describes that remote attackers could hijack the authentication of arbitrary users, with an u...

CVE-2015-4273

The Packet Data Network Gateway aka PGW component on Cisco ASR 5000 devices with software 15.0912, 15.0935, and 15.0938 allows remote attackers to cause a denial of service Session Manager outage via malformed fields in an IP packet, aka Bug ID CSCut38476...

CVE-2015-4273

CVE-2015-4273 affects the Cisco ASR 5000 Series Packet Data Network Gateway (PGW) IP stack. The vulnerability arises from improper input validation of certain fields in IP packets, allowing remote, unauthenticated attackers to cause a denial of service, specifically a Session Manager outage, on d...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Infra Admin UI in Cisco Identity Services Engine ISE 1.21.198 and 1.30.876 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a 1 GET or 2 POST request, aka Bug ID CSCus16052...

CVE-2015-4268

Cisco Identity Services Engine (ISE) Infra Admin UI is affected by CVE-2015-4268, with XSS vulnerabilities in ISE versions 1.2(1.198) and 1.3(0.876). The root cause is insufficient input validation of certain HTTP GET/POST parameters, enabling remote attackers to inject arbitrary web script or HT...

CVE-2015-4268

Multiple cross-site scripting XSS vulnerabilities in the Infra Admin UI in Cisco Identity Services Engine ISE 1.21.198 and 1.30.876 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a 1 GET or 2 POST request, aka Bug ID CSCus16052...

CVE-2015-4269

The Tomcat throttling feature in Cisco Unified Communications Manager 10.51.99995.9 allows remote authenticated users to cause a denial of service management outage by sending many requests, aka Bug ID CSCuu99709...

Code injection

The Tomcat throttling feature in Cisco Unified Communications Manager 10.51.99995.9 allows remote authenticated users to cause a denial of service management outage by sending many requests, aka Bug ID CSCuu99709...

CVE-2015-4272

Multiple cross-site scripting XSS vulnerabilities in the ccmivr page in Cisco Unified Communications Manager formerly CallManager 10.52.10000.5 allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, aka Bug ID CSCut19580...

CVE-2015-4269

Cisco Unified Communications Manager 10.5(1.99995.9) contains a DoS vulnerability in the Tomcat throttling feature. An authenticated, remote attacker can trigger the issue by sending a high rate of requests, causing the management page to become slow or unresponsive. The Cisco advisory notes that...

Design/Logic Flaw

The Control and Provisioning functionality in Cisco Mobility Services Engine MSE 10.00.1 allows remote authenticated users to obtain sensitive information by reading log files, aka Bug ID CSCut36851...