Code injection

Cisco IOS 12.2 allows remote attackers to cause a denial of service CPU consumption by establishing many IPv6 neighbors, aka Bug ID CSCtn78957...

Code injection

The updateTime function in sensorApp on Cisco IPS 4200 series sensors 7.0 and 7.1 allows remote attackers to cause a denial of service process crash and traffic-inspection outage via network traffic, aka Bug ID CSCta96144...

Design/Logic Flaw

The DMVPN tunnel implementation in Cisco IOS 15.2 allows remote attackers to cause a denial of service persistent IKE state via a large volume of hub-to-spoke traffic, aka Bug ID CSCtq39602...

Code injection

Cisco Unity Connection UC 8.6, 9.0, and 9.5 allows remote attackers to cause a denial of service CPU consumption via malformed UDP packets, aka Bug ID CSCtz76269...

Design/Logic Flaw

Cisco AnyConnect Secure Mobility Client 3.1.x before 3.1.00495, and 3.2.x, does not check whether an HTTP request originally contains ScanSafe headers, which allows remote attackers to have an unspecified impact via a crafted request, aka Bug ID CSCua13166...

Code injection

Cisco IOS 15.0 through 15.3 allows remote authenticated users to cause a denial of service device crash via an MVPNv6 update, aka Bug ID CSCty89224...

Code injection

Cisco Unity Connection UC 7.1, 8.0, and 8.5 allows remote authenticated users to cause a denial of service resource consumption and administration outage via extended use of the product, aka Bug ID CSCtd79132...

Design/Logic Flaw

Untrusted search path vulnerability in Cisco VPN Client 5.0 allows local users to gain privileges via a Trojan horse DLL in the current working directory, aka Bug ID CSCua28747...

Design/Logic Flaw

The SSLVPN implementation in Cisco IOS 15.1 and 15.2, when DTLS is enabled, does not properly handle certain outbound ACL configurations, which allows remote authenticated users to cause a denial of service device crash via a session involving a PPP over ATM PPPoA interface, aka Bug ID CSCty97961...

Code injection

The SSLVPN implementation in Cisco IOS 12.4, 15.0, 15.1, and 15.2, when DTLS is not enabled, does not properly handle certain outbound ACL configurations, which allows remote authenticated users to cause a denial of service device crash via a session involving a PPP over ATM PPPoA interface, aka...

CVE-2012-3895

Cisco IOS 15.0 through 15.3 allows remote authenticated users to cause a denial of service device crash via an MVPNv6 update, aka Bug ID CSCty89224...

CVE-2012-3893

The FlexVPN implementation in Cisco IOS 15.2 and 15.3 allows remote authenticated users to cause a denial of service spoke crash via spoke-to-spoke traffic, aka Bug ID CSCtz02622...

CVE-2012-3052

Untrusted search path vulnerability in Cisco VPN Client 5.0 allows local users to gain privileges via a Trojan horse DLL in the current working directory, aka Bug ID CSCua28747...

CVE-2012-3908

Multiple cross-site request forgery CSRF vulnerabilities in the ISE Administrator user interface aka the Apache Tomcat interface on Cisco Identity Services Engine ISE 3300 series appliances before 1.1.0.665 Cumulative Patch 1 allow remote attackers to hijack the authentication of administrators,...

CVE-2012-3094

The VPN downloader in the downloadinstall component in Cisco AnyConnect Secure Mobility Client 3.1.x before 3.1.00495 on Linux accepts arbitrary X.509 server certificates without user interaction, which allows remote attackers to obtain sensitive information via vectors involving an invalid...

CVE-2012-3052

The vulnerability CVE-2012-3052 affects Cisco VPN Client 5.x prior to 5.0.07.0440 and stems from untrusted DLL search path handling. An attacker with local access could place a Trojan DLL in the current working directory, which could be loaded and lead to privilege escalation. Publicly documented...

CVE-2012-3088

Cisco AnyConnect Secure Mobility Client 3.1.x (before 3.1.00495) and 3.2.x fails to verify whether an HTTP request contains ScanSafe headers, enabling remote attackers to trigger an unspecified impact via a crafted request (Bug ID CSCua13166). Affected component: AnyConnect client; root cause: la...

CVE-2012-3096

Cisco Unity Connection (UC) versions 7.1, 8.0, and 8.5 are affected by CVE-2012-3096. The advisory states that remote authenticated users can trigger a denial of service (resource consumption and administration outage) through extended use of the product, identified as Bug ID CSCtd79132. The avai...

CVE-2012-3079

CVE-2012-3079 affects Cisco IOS 12.2. A remote attacker can cause a denial of service (CPU consumption) by establishing many IPv6 neighbors, per Bug ID CSCtn78957. Impact is a network-based DoS; exploitation status and concrete remediation are not specified in the provided documents. No product v...

CVE-2012-3899

The CVE-2012-3899 entry affects Cisco IPS 4200 series sensors running 6.0, 6.2, or 7.0, where memory is not properly allocated in sensorApp. The root cause is a memory allocation issue leading to memory corruption and a process crash, causing a traffic-inspection outage. Exploitation is possible ...