5047 matches found
CVE-2014-3332
Cisco Unified Communications Manager CM 8.6.2 and earlier has an incorrect CLI restrictions setting, which allows remote authenticated users to establish undetected concurrent logins via unspecified vectors, aka Bug ID CSCup98029...
CVE-2014-3336
SQL injection vulnerability in the web framework in Cisco Unity Connection 9.12 and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted request, aka Bug ID CSCuq31016...
CVE-2014-3332
Cisco Unified Communications Manager (CM) 8.6(.2) and earlier contains an incorrect CLI restrictions setting that may allow an authenticated, remote attacker to establish undetected concurrent logins. The issue stems from improper sanitization of authenticated users, per Cisco’s advisory for CVE-...
CVE-2014-3333
The server in Cisco Unity Connection 9.11 and 9.12 allows remote authenticated users to obtain privileged access by conducting an "HTTP Intercept" attack and leveraging the ability to read files within the context of the web-server user account, aka Bug ID CSCup41014...
CVE-2014-3336
Cisco Unity Connection 9.1(2) and earlier contains a SQL injection in the web framework. The root cause is insufficient validation of SQL statements in the web server code, allowing an authenticated remote attacker to execute arbitrary SQL and potentially read data from the database. Cisco’s advi...
CVE-2014-3333
Cisco Unity Connection 9.1(1) and 9.1(2) are affected by CVE-2014-3333, where an authenticated remote attacker can elevate privileges by performing an HTTP Intercept attack and reading files within the web server user context, per Cisco's advisory CSCu p41014. The root cause is improper privilege...
CVE-2014-3302
user.php in Cisco WebEx Meetings Server 1.5.1.131 and earlier does not properly implement the token timer for authenticated encryption, which allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCuj81708...
Design/Logic Flaw
user.php in Cisco WebEx Meetings Server 1.5.1.131 and earlier does not properly implement the token timer for authenticated encryption, which allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCuj81708...
CVE-2014-3302
user.php in Cisco WebEx Meetings Server 1.5.1.131 and earlier does not properly implement the token timer for authenticated encryption, which allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCuj81708...
Cisco IOS IPSec Packet DoS (CSCui79745)
According to its self-reported version, the remote IOS device is affected by a denial of service vulnerability. A denial of service flaw exists within IPSec packet handling. An authenticated attacker, using a malformed IPSec packet, could cause the device to reboot. TRUSTED...
CVE-2014-3329
Cross-site scripting XSS vulnerability in the web-server component in Cisco Prime Data Center Network Manager DCNM 6.32 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCum86620...
CVE-2014-3329
Cisco Prime Data Center Network Manager (DCNM) 6.x (including 6.3(2) and earlier) is affected by a cross-site scripting (XSS) vulnerability in the DCNM web-server component. The root cause is insufficient validation of input parameters, which allows a remote attacker to inject arbitrary web scrip...
Code injection
The web framework in Cisco WebEx Meetings Server does not properly restrict the content of query strings, which allows remote attackers to obtain sensitive information by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser history, aka Bug ID CSCuj81713...
Design/Logic Flaw
The OutlookAction Class in Cisco WebEx Meetings Server allows remote attackers to enumerate user accounts by entering crafted URLs and examining the returned messages, aka Bug ID CSCuj81722...
CVE-2014-3328
The Intercluster Sync Agent Service in Cisco Unified Presence Server allows remote attackers to cause a denial of service via a TCP SYN flood, aka Bug ID CSCun34125...
CVE-2014-3326
SQL injection vulnerability in the web framework in Cisco Security Manager 4.5 and 4.6 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCup26957...
CVE-2014-3324
Multiple cross-site scripting XSS vulnerabilities in the login page in the administrative web interface in Cisco TelePresence Server Software 4.02.8 allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, aka Bug ID CSCup90060...
CVE-2014-3305
Cross-site request forgery CSRF vulnerability in the web framework in Cisco WebEx Meetings Server 1.5.1.131 and earlier allows remote attackers to hijack the authentication of unspecified victims via unknown vectors, aka Bug ID CSCuj81735...
Sql injection
SQL injection vulnerability in the web framework in Cisco Security Manager 4.5 and 4.6 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCup26957...