Buffer overflow

Multiple buffer overflows in the administrative web interface in Cisco Unified Computing System UCS allow remote authenticated users to cause a denial of service memory corruption and session termination via long string values for unspecified parameters, aka Bug ID CSCtg20751...

Hardcoded credentials

The Board Management Controller BMC in the Serial over LAN SoL subsystem in Cisco Unified Computing System UCS relies on a hardcoded private key, which allows man-in-the-middle attackers to obtain sensitive information or modify the data stream by leveraging knowledge of this key, aka Bug ID...

Code injection

The KVM subsystem in the client in Cisco Unified Computing System UCS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers, and read or modify KVM data, via a crafted certificate, aka Bug ID CSCte90332...

Design/Logic Flaw

Cisco AnyConnect Secure Mobility Client on Mac OS X uses weak permissions for a library directory, which allows local users to gain privileges via a crafted library file, aka Bug ID CSCue33619...

Hardcoded credentials

The KVM subsystem in Cisco Unified Computing System UCS relies on a hardcoded X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers, and read keyboard and mouse events, by leveraging knowledge of this certificate's private key, aka Bug ID CSCte90327...

Code injection

The Manager component in Cisco Unified Computing System UCS allows local users to cause a denial of service via an invalid Smart Call Home contact address, aka Bug ID CSCtl00186...

CVE-2012-4073

The CVE-2012-4073 issue affects the Cisco Unified Computing System (UCS) KVM client, where the KVM subsystem fails to verify X.509 certificates from SSL servers. Root cause: improper certificate validation in the KVM client, enabling a man-in-the-middle attacker to intercept a KVM connection and ...

CVE-2012-4083

Multiple buffer overflows in the administrative web interface in Cisco Unified Computing System UCS allow remote authenticated users to cause a denial of service memory corruption and session termination via long string values for unspecified parameters, aka Bug ID CSCtg20751...

CVE-2013-1130

Cisco AnyConnect Secure Mobility Client on macOS is affected by weak permissions in a library directory (root cause: misconfigured library directory permissions), enabling local privilege escalation via a crafted library file (Bug ID CSCue33619). No patch/version details are provided in the suppl...

CVE-2012-4074

The CVE-2012-4074 issue affects Cisco Unified Computing System Serial over LAN (SoL) with the Board Management Controller (BMC) using a hard-coded private key. This enables unauthenticated MITM attacks on SoL connections, allowing an attacker to view or modify SoL communications. Root cause: hard...

CVE-2013-1130

Cisco AnyConnect Secure Mobility Client on Mac OS X uses weak permissions for a library directory, which allows local users to gain privileges via a crafted library file, aka Bug ID CSCue33619...

CVE-2012-4072

The KVM subsystem in Cisco Unified Computing System UCS relies on a hardcoded X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers, and read keyboard and mouse events, by leveraging knowledge of this certificate's private key, aka Bug ID CSCte90327...

CVE-2012-4072

The CVE-2012-4072 issue affects Cisco Unified Computing System (UCS) KVM. The root cause is a hardcoded X.509 certificate in the KVM subsystem, enabling a remote attacker to perform MITM on KVM connections, spoof SSL servers, and read keyboard/mouse events by using knowledge of the private key. E...

CVE-2013-5501

Cisco MediaSense is affected by a cross-site scripting (XSS) vulnerability in the oraservice page. The issue stems from insufficient input validation of a parameter, allowing an unauthenticated, remote attacker to execute arbitrary script or HTML in a user’s browser via a crafted link. Cisco’s ad...

CVE-2013-5501

Cross-site scripting XSS vulnerability in the oraservice page in Cisco MediaSense allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCuj23328...

CVE-2012-4093

The Manager component in Cisco Unified Computing System UCS allows local users to cause a denial of service via an invalid Smart Call Home contact address, aka Bug ID CSCtl00186...

Code injection

The regex engine in the BGP implementation in Cisco NX-OS, when a complex regular expression is configured for inbound routes, allows remote attackers to cause a denial of service device reload via a crafted AS path set, aka Bug ID CSCuf49554...

Open redirect

Open Network Environment Platform ONEP in Cisco NX-OS allows remote authenticated users to cause a denial of service network-element reload via a crafted packet, aka Bug ID CSCui51551...

Cross site scripting

Cross-site scripting XSS vulnerability in the web framework in the Application Server in Cisco Unified MeetingPlace allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui44681...

CVE-2013-5495

Cisco Unified MeetingPlace Application Server Web Framework contains a cross-site scripting (XSS) vulnerability (CVE-2013-5495) that lets remote attackers inject arbitrary script/HTML via an unspecified parameter. Affects the web framework component of the Application Server; root cause is insuff...