CVE-2014-0669

Cisco ASR 5000 Series Gateway GPRS Support Node (GGSN) vulnerability: the Wireless Session Protocol (WSP) mis-processes certain WSP packets, allowing an unauthenticated, remote attacker to bypass Top‑Up payment restrictions (browse without charging). Root cause: incorrect handling of WSP packets....

CVE-2014-0671

Cisco MediaSense contains an open redirect vulnerability exploitable by an unauthenticated, remote attacker due to insufficient input validation in a specific URL parameter. An attacker can craft a link directing users to a malicious site, enabling phishing attempts. The Cisco advisory notes no s...

CVE-2014-0670

Cross-site scripting XSS vulnerability in the Search and Play interface in Cisco MediaSense allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCum16686...

Cross site scripting

Cross-site scripting XSS vulnerability in the portal in Cisco Secure Access Control System ACS allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCue65949...

CVE-2014-0668

Cisco Secure ACS Portal suffers a cross-site scripting (XSS) vulnerability due to insufficient input validation of a parameter in the ACS portal. This could allow a remote attacker to inject arbitrary script or HTML when a user visits a malicious link. Cisco’s advisory Cisco-SA-20140121-CVE-2014-...

CVE-2014-0649

The RMI interface in Cisco Secure Access Control System ACS 5.x before 5.5 does not properly enforce authorization requirements, which allows remote authenticated users to obtain superadmin access via a request to this interface, aka Bug ID CSCud75180...

CVE-2014-0666

Directory traversal vulnerability in the Send Screen Capture implementation in Cisco Jabber 9.2.1 and earlier on Windows allows remote attackers to upload arbitrary types of files, and consequently execute arbitrary code, via modified packets, aka Bug ID CSCug48056...

CVE-2013-6687

The web portal in the Enterprise License Manager component in Cisco WebEx Meetings Server allows remote authenticated users to discover the cleartext administrative password by reading HTML source code, aka Bug ID CSCul33876...

Design/Logic Flaw

The web portal in the Enterprise License Manager component in Cisco WebEx Meetings Server allows remote authenticated users to discover the cleartext administrative password by reading HTML source code, aka Bug ID CSCul33876...

Design/Logic Flaw

The RMI interface in Cisco Secure Access Control System ACS 5.x before 5.5 does not properly enforce authorization requirements, which allows remote authenticated users to obtain superadmin access via a request to this interface, aka Bug ID CSCud75180...

Authorization

The RMI interface in Cisco Secure Access Control System ACS 5.x before 5.5 does not properly enforce authentication and authorization requirements, which allows remote attackers to obtain administrative access via a request to this interface, aka Bug ID CSCud75187...

Design/Logic Flaw

The web interface in Cisco Secure Access Control System ACS 5.x before 5.4 Patch 3 allows remote attackers to execute arbitrary operating-system commands via a request to this interface, aka Bug ID CSCue65962...

CVE-2014-0666

Directory traversal vulnerability in the Send Screen Capture implementation in Cisco Jabber 9.2.1 and earlier on Windows allows remote attackers to upload arbitrary types of files, and consequently execute arbitrary code, via modified packets, aka Bug ID CSCug48056...

CVE-2014-0667

Cisco Secure Access Control System (ACS) is affected by CVE-2014-0667 due to insufficient authorization enforcement in the Remote Method Invocation (RMI) interface. A remote, authenticated attacker can read arbitrary files on the ACS server by issuing a crafted request to the RMI interface. The i...

CVE-2013-6687

The web portal in the Enterprise License Manager component in Cisco WebEx Meetings Server allows remote authenticated users to discover the cleartext administrative password by reading HTML source code, aka Bug ID CSCul33876...

CVE-2014-0666

Cisco Jabber for Windows is affected by a directory traversal vulnerability in the Send Screen Capture feature (CVE-2014-0666). Affected: Jabber for Windows 9.x before 9.2(2) (Windows). Root cause: input validation issue in the Send Screen Capture flow that could traverse directories and write ar...

CVE-2014-0649

The CVE-2014-0649 issue affects Cisco Secure Access Control System (ACS) 5.x before 5.5, where the RMI interface does not properly enforce authorization, enabling a remote authenticated user to gain superadmin access via the RMI interface (Bug ID CSCud75180). Connected Cisco advisories confirm an...

CVE-2014-0667

The RMI interface in Cisco Secure Access Control System ACS does not properly enforce authorization requirements, which allows remote authenticated users to read arbitrary files via a request to this interface, aka Bug ID CSCud75169...

Design/Logic Flaw

The RBAC implementation in Cisco Identity Services Engine ISE Software does not properly verify privileges for support-bundle downloads, which allows remote authenticated users to obtain sensitive information via a download action, as demonstrated by obtaining read access to the user database, ak...

CVE-2014-0665

Summary of CVE-2014-0665 (Cisco ISE): A flaw in the RBAC code allows an authenticated, unprivileged user to download the support bundle and access sensitive data (e.g., user database) because privileges are not properly checked. An attacker, with valid credentials, could exploit this to obtain in...