Design/Logic Flaw

The Intercluster Sync Agent Service in Cisco Unified Presence Server allows remote attackers to cause a denial of service via a TCP SYN flood, aka Bug ID CSCun34125...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the login page in the administrative web interface in Cisco TelePresence Server Software 4.02.8 allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, aka Bug ID CSCup90060...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the web framework in Cisco WebEx Meetings Server 1.5.1.131 and earlier allows remote attackers to hijack the authentication of unspecified victims via unknown vectors, aka Bug ID CSCuj81735...

CVE-2014-3328

CVE-2014-3328 affects Cisco Unified Presence Server’s Intercluster Sync Agent Service. A remote attacker can trigger a denial-of-service by sending大量 TCP SYN traffic, exploiting a SYN flood condition (Bug CSCun34125). Cisco’s advisory notes that software updates are not available to fix this vuln...

CVE-2014-3326

CVE-2014-3326 affects Cisco Security Manager 4.5 and 4.6. The issue is an SQL injection in the web framework caused by insufficient controls on SQL statements, allowing an authenticated remote attacker to execute arbitrary SQL commands via unspecified vectors. The vulnerability can lead to exposu...

CVE-2014-3305

Cross-site request forgery CSRF vulnerability in the web framework in Cisco WebEx Meetings Server 1.5.1.131 and earlier allows remote attackers to hijack the authentication of unspecified victims via unknown vectors, aka Bug ID CSCuj81735...

CVE-2014-3305

CVE-2014-3305 concerns a CSRF vulnerability in the Cisco WebEx Meetings Server web framework (affecting 1.5(.1.131) and earlier). The issue allows remote attackers to hijack the authentication of unspecified victims via unknown vectors (Bug ID CSCuj81735). The core impact is that user sessions co...

CVE-2014-3301

The CVE-2014-3301 issue affects Cisco WebEx Meetings Server (CWMS) 1.5(.1.131) and earlier, where the ProfileAction controller could disclose sensitive information by inadvertently returning stack traces in responses. Root cause: improper sanitization of returned messages, enabling an unauthentic...

CVE-2014-3322

Cisco IOS XR 4.3.2 and earlier on ASR 9000 devices does not properly perform NetFlow sampling of IP packets, which allows remote attackers to cause a denial of service chip and card hangs via malformed 1 IPv4 or 2 IPv6 packets, aka Bug ID CSCuo68417...

Code injection

Cisco IOS XR 4.3.2 and earlier on ASR 9000 devices does not properly perform NetFlow sampling of IP packets, which allows remote attackers to cause a denial of service chip and card hangs via malformed 1 IPv4 or 2 IPv6 packets, aka Bug ID CSCuo68417...

CVE-2014-3322

Cisco IOS XR 4.3.2 and earlier on ASR 9000 devices does not properly perform NetFlow sampling of IP packets, which allows remote attackers to cause a denial of service chip and card hangs via malformed 1 IPv4 or 2 IPv6 packets, aka Bug ID CSCuo68417...

CVE-2014-3323

CVE-2014-3323 concerns Cisco Unified Contact Center Enterprise. The vulnerability is a directory traversal flaw in the product’s web-facing component that allows remote authenticated users to read arbitrary files from the web root via a crafted URL (aka Bug ID CSCun25262). Impact, as stated, is p...

CVE-2014-3320

Cisco Unified Communications Domain Manager (CDM) admin HTTP redirect vulnerability (CVE-2014-3320) affects CDM 8.1(.4) and earlier. The issue stems from insufficient validation of input when invoking scripts via the admin web interface, allowing unauthenticated, remote attackers to redirect user...

CVE-2014-3320

Multiple open redirect vulnerabilities in the admin web interface in the web framework in Cisco Unified Communications Domain Manager CDM 8.1.4 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted URLs for unspecified scripts, aka Bu...

CVE-2014-3321

Cisco IOS XR 4.3.4 and earlier on ASR 9000 devices, when bridge-group virtual interface BVI routing is enabled, allows remote attackers to cause a denial of service chip and card hangs via a series of crafted MPLS packets, aka Bug ID CSCuo91149...

CVE-2014-3321

Cisco IOS XR 4.3.4 and earlier on ASR 9000 devices, when bridge-group virtual interface BVI routing is enabled, allows remote attackers to cause a denial of service chip and card hangs via a series of crafted MPLS packets, aka Bug ID CSCuo91149...

Command injection

The web server on Cisco DPC3010, DPC3212, DPC3825, DPC3925, DPQ3925, EPC3010, EPC3212, EPC3825, and EPC3925 Wireless Residential Gateway products allows remote attackers to execute arbitrary code via a crafted HTTP request, aka Bug ID CSCup40808...

Directory traversal

Directory traversal vulnerability in Cisco Unified Contact Center Enterprise allows remote authenticated users to read arbitrary web-root files via a crafted URL, aka Bug ID CSCun25262...

CVE-2013-6691

The WebVPN CIFS implementation in Cisco Adaptive Security Appliance ASA Software 9.0.4.1 and earlier allows remote CIFS servers to cause a denial of service device reload via a long share list, aka Bug ID CSCuj83344...

Code injection

The WebVPN CIFS implementation in Cisco Adaptive Security Appliance ASA Software 9.0.4.1 and earlier allows remote CIFS servers to cause a denial of service device reload via a long share list, aka Bug ID CSCuj83344...