CVE-2014-2153

CVE-2014-2153 concerns Cisco Prime Infrastructure, where multiple XSS vulnerabilities exist in INSERT pages. The root cause is insufficient input validation on several parameters in INSERT-related HTML pages, allowing an unauthenticated, remote attacker to craft a link that injects arbitrary scri...

CVE-2015-0606

The IOS Shell in Cisco IOS allows local users to cause a denial of service device crash via unspecified commands, aka Bug ID CSCur59696...

CVE-2014-2152

Cisco Prime Infrastructure (PI) contains a Cross-Site Request Forgery (CSRF) vulnerability on the INSERT page that could allow an unauthenticated/remote attacker to hijack the authentication of an authenticated PI user and perform actions on behalf of that user. Root cause is insufficient CSRF pr...

CVE-2015-0619

Memory leak in the embedded web server in the WebVPN subsystem in Cisco Adaptive Security Appliance ASA Software allows remote attackers to cause a denial of service memory consumption and SSL outage via multiple crafted HTTP requests, aka Bug ID CSCue05458...

CVE-2015-0592

The Zone-Based Firewall implementation in Cisco IOS 15.42T3 and earlier allows remote attackers to cause a denial of service device reload via crafted network traffic that triggers incorrect kernel-timer handling, aka Bug ID CSCuh25672...

CVE-2014-2147

The CVE-2014-2147 issue affects Cisco Prime Infrastructure 2.1 and earlier, where the web interface does not properly restrict IFRAME use, due to insufficient HTML iframe protection. This enables cross-frame scripting (XFS) attacks, including clickjacking, via a crafted attacker-controlled page. ...

CVE-2014-3365

CVE-2014-3365 (Cisco Prime Security Manager) affects PRSM versions up to 9.2(.1-2) and earlier. The vulnerability is a result of improper input validation in the Dashboard and Configure Realm pages, allowing an unauthenticated, remote attacker to inject and execute arbitrary web script or HTML (X...

CVE-2014-2152

Cross-site request forgery CSRF vulnerability in the INSERT page in Cisco Prime Infrastructure PI allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCun21868...

CVE-2014-3365

Multiple cross-site scripting XSS vulnerabilities in Cisco Prime Security Manager PRSM 9.2.1-2 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted input to the 1 Dashboard or 2 Configure Realm page, aka Bug ID CSCuo94808...

CVE-2015-0608

CVE-2015-0608 refers to a race condition in Cisco IOS <> causing a denial of service (device reload) when processing traffic that triggers timing between process switching and Cisco Express Forwarding (CEF) switching. Affected: Cisco IOS 15.4(2)T3 and older. Exploitation: remote, unauthenti...

CVE-2014-2147

The web interface in Cisco Prime Infrastructure 2.1 and earlier does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting XFS" issue, aka B...

CVE-2015-0600

The mobility extension on Cisco Unified IP 9900 phones with firmware 9.4.1 and earlier allows remote attackers to cause a denial of service logoff via crafted packets, aka Bug ID CSCuq12139...

CVE-2015-0589

The administrative web interface in Cisco WebEx Meetings Server 1.0 through 1.5 allows remote authenticated users to execute arbitrary OS commands with root privileges via unspecified fields, aka Bug ID CSCuj40460...

Design/Logic Flaw

The administrative web interface in Cisco WebEx Meetings Server 1.0 through 1.5 allows remote authenticated users to execute arbitrary OS commands with root privileges via unspecified fields, aka Bug ID CSCuj40460...

Code injection

The mobility extension on Cisco Unified IP 9900 phones with firmware 9.4.1 and earlier allows remote attackers to obtain sensitive information by sniffing the network, aka Bug ID CSCuq12117...

Command injection

The mobility extension on Cisco Unified IP 9900 phones with firmware 9.4.1 and earlier allows remote attackers to cause a denial of service logoff via crafted packets, aka Bug ID CSCuq12139...

CVE-2015-0589

The administrative web interface in Cisco WebEx Meetings Server 1.0 through 1.5 allows remote authenticated users to execute arbitrary OS commands with root privileges via unspecified fields, aka Bug ID CSCuj40460...

CVE-2015-0605

The uuencode inspection engine in Cisco AsyncOS on Cisco Email Security Appliance ESA devices 8.5 and earlier allows remote attackers to bypass intended content restrictions via a crafted e-mail attachment with uuencode encoding, aka Bug ID CSCzv54343...

Code injection

Cisco Unified IP 9900 phones with firmware 9.4.1 and earlier use weak permissions for unspecified files, which allows local users to cause a denial of service persistent hang or reboot by writing to a phone's filesystem, aka Bug ID CSCup90474...

Command injection

The web framework on Cisco Unified IP 9900 phones with firmware 9.4.1 and earlier allows remote attackers to upload files to arbitrary locations on a phone's filesystem via crafted HTTP requests, aka Bug ID CSCup90424...