CVE-2015-0762

Cross-site scripting XSS vulnerability in the management interface in Cisco Unified MeetingPlace 8.61.2 and 8.61.9 for Microsoft Outlook allows remote attackers to inject arbitrary web script or HTML via a crafted value in a URL, aka Bug ID CSCuu51400...

CVE-2015-0761

Cisco AnyConnect Secure Mobility Client for Linux (Linux builds affected: before 3.1(8009) and before 4.0(2052)) contains a local privilege escalation due to improper implementation of internal functions, allowing an authenticated, local attacker to obtain root privileges by crafting vpnagent opt...

CVE-2015-0765

Cisco ONS 15454 System Software 10.30 and 10.301 allows remote attackers to cause a denial of service tNetTask CPU consumption or card reset via a flood of 1 IP or 2 Ethernet traffic, aka Bug ID CSCus57263...

CVE-2015-0760

Cisco ASA Software versions 7.x, 8.0.x, 8.1.x, and 8.2.x before 8.2.2.13 contain a vulnerability in the IKEv1 code that can be exploited by an authenticated, remote attacker to bypass XAUTH authentication via crafted IKEv1 packets. The issue (Bug CSCus47259) allows bypass of Extended Authenticati...

CVE-2015-0764

Cisco Unified MeetingPlace 8.61.9 allows remote attackers to read arbitrary files via a crafted resource request, aka Bug ID CSCus95603...

CVE-2015-0763

Cisco Unified MeetingPlace 8.61.2 does not properly validate session IDs in http URLs, which allows remote attackers to obtain sensitive session information via a crafted URL, aka Bug ID CSCuu60338...

CVE-2015-0745

Cisco Headend System Release allows remote attackers to read temporary script files or archive files, and consequently obtain sensitive information, via a crafted header in an HTTP request, aka Bug ID CSCus44909...

Xxe

The web-based user interface in Cisco Unified MeetingPlace 8.61.9 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue, aka Bug ID CSCus97452...

Crlf injection

CRLF injection vulnerability in the HTTP Header Handler in Digital Broadband Delivery System in Cisco Headend System Release allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks or cross-site scripting XSS attacks, via a crafted request, aka Bug ID...

CVE-2015-0733

Cisco Headend System Release Digital Broadband Delivery System is affected by a CRLF injection vulnerability in the HTTP Header Handler, enabling remote attackers to inject arbitrary HTTP headers and perform HTTP response-splitting attacks (potentially enabling XSS). The issue, tracked as CVE-201...

CVE-2015-0757

The web framework in Cisco Identity Services Engine ISE 1.21.901 and 1.30.722 does not properly implement session handlers, which allows remote attackers to obtain sensitive information by reading web pages, as demonstrated by MnT reports, aka Bug ID CSCuq23140...

CVE-2015-0755

The Posture module for Cisco Identity Services Engine ISE, as distributed in Cisco AnyConnect Secure Mobility Client 4.064, allows local users to gain privileges via unspecified commands, aka Bug ID CSCut05797...

CVE-2015-0753

SQL injection vulnerability in Cisco Unified Email Interaction Manager EIM and Unified Web Interaction Manager WIM 9.02 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuu30028...

Cross site scripting

Cross-site scripting XSS vulnerability in Cisco TelePresence Video Communication Server VCS X8.5.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCut27635...

Code injection

Cisco Finesse 10.51 allows remote authenticated users to obtain sensitive information or cause a denial of service CPU and memory consumption via a crafted XML document, aka Bug ID CSCut95810...

Sql injection

SQL injection vulnerability in Cisco Unified Email Interaction Manager EIM and Unified Web Interaction Manager WIM 9.02 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuu30028...

Design/Logic Flaw

The Posture module for Cisco Identity Services Engine ISE, as distributed in Cisco AnyConnect Secure Mobility Client 4.064, allows local users to gain privileges via unspecified commands, aka Bug ID CSCut05797...

Command injection

Cisco IP Phone 7861, when firmware from Cisco Unified Communications Manager 10.31 is used, allows remote attackers to cause a denial of service via crafted packets, aka Bug ID CSCus81800...

Design/Logic Flaw

The web framework in Cisco Identity Services Engine ISE 1.21.901 and 1.30.722 does not properly implement session handlers, which allows remote attackers to obtain sensitive information by reading web pages, as demonstrated by MnT reports, aka Bug ID CSCuq23140...

CVE-2015-0753

SQL injection vulnerability in Cisco Unified Email Interaction Manager EIM and Unified Web Interaction Manager WIM 9.02 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuu30028...