CVE-2011-2586

The HTTP client in Cisco IOS 12.4 and 15.0 allows user-assisted remote attackers to cause a denial of service device crash via a malformed HTTP response to a request for service installation, aka Bug ID CSCts12249...

CVE-2011-2583

Cisco Unified Contact Center Express aka CCX 8.0 and 8.5 allows remote attackers to cause a denial of service via network traffic, as demonstrated by an SEC-BE-STABLE test case, aka Bug ID CSCth33834...

CVE-2011-3289

Cisco IOS 12.4 and 15.0 through 15.2 allows physically proximate attackers to bypass the No Service Password-Recovery feature and read the start-up configuration via unspecified vectors, aka Bug ID CSCtr97640...

CVE-2011-4006

The ESMTP inspection feature on Cisco Adaptive Security Appliances ASA 5500 series devices with software 8.2 through 8.5 allows remote attackers to cause a denial of service CPU consumption via an unspecified closing sequence, aka Bug ID CSCtt32565...

Crlf injection

CRLF injection vulnerability in /+CSCOE+/logon.html on Cisco Adaptive Security Appliances ASA 5500 series devices with software 8.0 through 8.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors, aka Bug ID CSCth63101...

Code injection

The sccp-protocol component in Cisco IP Communicator CIPC 7.0 through 8.6 does not limit the rate of SCCP messages to Cisco Unified Communications Manager CUCM, which allows remote attackers to cause a denial of service via vectors that trigger 1 on hook and 2 off hook messages, as demonstrated b...

Design/Logic Flaw

Cisco IOS 12.2 through 12.4 and 15.0 does not recognize the vrf-also keyword during enforcement of access-class commands, which allows remote attackers to establish TELNET connections from arbitrary source IP addresses via a standard TELNET client, aka Bug ID CSCsi77774...

Authentication flaw

Cisco Small Business IP phones with SPA 500 series firmware 7.4.9 and earlier do not require authentication for Push XML requests, which allows remote attackers to make telephone calls via an XML document, aka Bug ID CSCts08768...

Command injection

Cisco IOS 15.0 and 15.1 and IOS XE 3.x do not properly handle the "set mpls experimental imposition" command, which allows remote attackers to cause a denial of service device crash via network traffic that triggers 1 fragmentation or 2 reassembly, aka Bug ID CSCtr56576...

Information disclosure

Cisco Adaptive Security Appliances ASA 5500 series devices with software 7.2 through 8.4 do not properly perform proxy authentication during attempts to cut through a firewall, which allows remote attackers to obtain sensitive information via a connection attempt, aka Bug ID CSCtx42746...

Code injection

Cisco Adaptive Security Appliances ASA 5500 series devices with software 8.2 through 8.4 process IKE requests despite a vpnclient mode configuration, which allows remote attackers to obtain potentially sensitive information by reading IKE responder traffic, aka Bug ID CSCtt07749...

Command injection

The TAC Case Attachment tool in Cisco Wireless Control System WCS 7.0 allows remote authenticated users to read arbitrary files under webnms/Temp/ via unspecified vectors, aka Bug ID CSCtq86807...

Code injection

The NETIO and IPV4IO processes in Cisco IOS XR 3.8 through 4.1, as used in Cisco Carrier Routing System and other products, allow remote attackers to cause a denial of service CPU consumption via crafted network traffic, aka Bug ID CSCti59888...

Code injection

Cisco Carrier Routing System 3.9.1 allows remote attackers to cause a denial of service Metro subsystem crash via a fragmented GRE packet, aka Bug ID CSCts14887...

Design/Logic Flaw

Cisco IOS 12.2 through 12.4 and 15.0 does not recognize the vrf-also keyword during enforcement of access-class commands, which allows remote attackers to establish SSH connections from arbitrary source IP addresses via a standard SSH client, aka Bug ID CSCsv86113...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Solution Engine in Cisco Secure Access Control Server ACS 5.2 allow remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting XSS sequences, aka Bug ID CSCtr78143...

Design/Logic Flaw

The HTTP client in Cisco IOS 12.4 and 15.0 allows user-assisted remote attackers to cause a denial of service device crash via a malformed HTTP response to a request for service installation, aka Bug ID CSCts12249...

Design/Logic Flaw

Cisco IOS 12.4 and 15.0 through 15.2 allows physically proximate attackers to bypass the No Service Password-Recovery feature and read the start-up configuration via unspecified vectors, aka Bug ID CSCtr97640...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Solution Engine in Cisco Secure Access Control Server ACS 5.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCtr78192...

Code injection

Cisco Unified Contact Center Express aka CCX 8.0 and 8.5 allows remote attackers to cause a denial of service via network traffic, as demonstrated by an SEC-BE-STABLE test case, aka Bug ID CSCth33834...