CVE-2016-6404

CVE-2016-6404 describes a cross-site scripting (XSS) vulnerability in the web framework of Cisco IOx Local Manager, affecting Cisco IOS 15.5(2)T and IOS XE. A remote attacker can exploit a crafted URL to inject arbitrary web script or HTML, targeting users of the web interface. The issue is tied ...

CVE-2016-1433

Cisco IOS XR 6.0 and 6.0.1 on NCS 6000 devices allows remote attackers to cause a denial of service OSPFv3 process reload via crafted OSPFv3 packets, aka Bug ID CSCuz66289...

CVE-2016-6402

CVE-2016-6402 affects Cisco UCS Manager and UCS 6200 Fabric Interconnects (pre-3.0(2d)). The issue is a local privilege escalation caused by insufficient sanitization of CLI input, allowing an authenticated local user to obtain OS root access. Impact is OS-level compromise with full control on af...

CVE-2016-1482

Cisco WebEx Meetings Server 2.6 allows remote attackers to execute arbitrary commands by injecting these commands into an application script, aka Bug ID CSCuy83130...

CVE-2016-1482

Cisco WebEx Meetings Server 2.6 allows remote attackers to execute arbitrary commands by injecting these commands into an application script, aka Bug ID CSCuy83130...

CVE-2016-6401

Cisco Carrier Routing System CRS 5.1 and 5.1.4, as used in CRS Carrier Grade Services for CRS-1 and CRS-3 devices, allows remote attackers to cause a denial of service line-card reload via crafted IPv6-over-MPLS packets, aka Bug ID CSCva32494...

Code injection

Cisco AsyncOS through 9.5.0-444 on Web Security Appliance WSA devices allows remote attackers to cause a denial of service link saturation by making many HTTP requests for overlapping byte ranges simultaneously, aka Bug ID CSCuz27219...

Code injection

Cisco Carrier Routing System CRS 5.1 and 5.1.4, as used in CRS Carrier Grade Services for CRS-1 and CRS-3 devices, allows remote attackers to cause a denial of service line-card reload via crafted IPv6-over-MPLS packets, aka Bug ID CSCva32494...

CVE-2016-6401

Cisco Carrier Routing System CRS 5.1 and 5.1.4, as used in CRS Carrier Grade Services for CRS-1 and CRS-3 devices, allows remote attackers to cause a denial of service line-card reload via crafted IPv6-over-MPLS packets, aka Bug ID CSCva32494...

CVE-2016-6407

CVE-2016-6407 affects Cisco Web Security Appliance AsyncOS prior to 9.5.0-444. The issue is a denial-of-service condition caused by the device processing many overlapping HTTP byte-range requests, leading to link saturation. A remote attacker can trigger the DoS without authentication by issuing ...

CVE-2016-6398

The PPTP server in Cisco IOS 15.53M does not properly initialize packet buffers, which allows remote attackers to obtain sensitive information from earlier network communication by reading packet data, aka Bug ID CSCvb16274...

CVE-2016-6371

Directory traversal vulnerability in the web interface in Cisco Hosted Collaboration Mediation Fulfillment HCM-F 10.63 and earlier allows remote attackers to write to arbitrary files via a crafted URL, aka Bug ID CSCuz64717...

Authentication flaw

Cisco Firepower Management Center before 6.1 and FireSIGHT System Software before 6.1, when certain malware blocking options are enabled, allow remote attackers to bypass malware detection via crafted fields in HTTP headers, aka Bug ID CSCuz44482...

Directory traversal

Directory traversal vulnerability in the web interface in Cisco Hosted Collaboration Mediation Fulfillment HCM-F 10.63 and earlier allows remote attackers to write to arbitrary files via a crafted URL, aka Bug ID CSCuz64717...

Session fixation

Session fixation vulnerability in Cisco Firepower Management Center and Cisco FireSIGHT System Software through 6.1.0 allows remote attackers to hijack web sessions via a session identifier, aka Bug ID CSCuz80503...

Directory traversal

Directory traversal vulnerability in the web interface in Cisco Hosted Collaboration Mediation Fulfillment HCM-F 10.63 and earlier allows remote authenticated users to read arbitrary files via a crafted pathname in an HTTP request, aka Bug ID CSCuz27255...

Memory corruption

The PPTP server in Cisco IOS 15.53M does not properly initialize packet buffers, which allows remote attackers to obtain sensitive information from earlier network communication by reading packet data, aka Bug ID CSCvb16274...

CVE-2016-6371

Directory traversal vulnerability in the web interface in Cisco Hosted Collaboration Mediation Fulfillment HCM-F 10.63 and earlier allows remote attackers to write to arbitrary files via a crafted URL, aka Bug ID CSCuz64717...

CVE-2016-6396

Cisco Firepower Management Center and FireSIGHT System Software before 6.1 are affected by CVE-2016-6396. The issue arises from improper validation of HTTP header fields in the malware blocking/detection features, which could allow an unauthenticated, remote attacker to bypass malware detection b...

CVE-2016-6395

Cisco Firepower Management Center and FireSIGHT System Software are affected by CVE-2016-6395; the web-based management interface vulnerability allows remote authenticated users to inject arbitrary script or HTML via a crafted URL (XSS) in versions before 6.1. The issue is associated with Bug ID ...