CVE-2017-6632

Cisco FirePOWER System Software SSL Logging DoS (CVE-2017-6632) affects 5.3.0–6.2.2 when SSL policy logging is enabled. An unauthenticated remote attacker can cause a DoS by sending a flood of crafted TCP packets, due to mis‑configurable SSL logging of certain TCP traffic. Impact is high availabi...

CVE-2017-6645

CVE-2017-6645 concerns Cisco Remote Expert Manager Software (web interface) 11.0.0. The issue arises from insufficient protection of sensitive data in HTTP responses, enabling an unauthenticated remote attacker to access sensitive information via the web interface. Impact is information disclosur...

CVE-2017-6644

A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to access sensitive information on an affected system. The vulnerability exists because the affected software does not sufficiently protect sensitive data when...

CVE-2017-6653

Summary: CVE-2017-6653 is a DoS vulnerability in the GUI TCP throttling of Cisco Identity Services Engine (ISE) 2.1(0.474). An unauthenticated remote attacker can cause the GUI to stop responding by sending a high rate of TCP connections to the GUI, due to insufficient TCP rate limiting. Affected...

CVE-2017-6630

CVE-2017-6630 affects Cisco IP Phone 8851 with firmware 11.0(0.1). A remote, unauthenticated attacker can trigger a denial of service by sending manipulated CANCEL SIP messages due to an abnormal SIP handling in the device. Multiple sources (Cisco advisory Cisco-SA-20170517-sip, Tenable plugin, a...

CVE-2017-6635

CVE-2017-6635 affects Cisco Prime Collaboration Provisioning Software (before Release 12.1). The web interface allows authenticated, remote attackers to delete arbitrary files via crafted HTTP requests that exploit directory traversal and weak RBAC enforcement. The issue is rooted in insufficient...

CVE-2017-6647

A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to access sensitive Temporary File information on an affected system. The vulnerability exists because the affected software does not sufficiently protect sensitive...

CVE-2017-6642

A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to access sensitive information on an affected system. The vulnerability exists because the affected software does not sufficiently protect sensitive data when...

Directory traversal

A vulnerability in the web framework of the Cisco TelePresence IX5000 Series could allow an unauthenticated, remote attacker to access arbitrary files on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by using directory...

CVE-2017-6652

A vulnerability in the web framework of the Cisco TelePresence IX5000 Series could allow an unauthenticated, remote attacker to access arbitrary files on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by using directory...

Design/Logic Flaw

A vulnerability in the web interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to access sensitive data. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to insufficient protection of...

CVE-2017-6652

The CVE-2017-6652 issue affects Cisco TelePresence IX5000 Series devices running software version 8.2.0 and is a directory-traversal vulnerability in the web framework caused by insufficient input validation. An unauthenticated, remote attacker could read arbitrary files from the device filesyste...

CVE-2017-6623

A vulnerability in a script file that is installed as part of the Cisco Policy Suite CPS Software distribution for the CPS appliance could allow an authenticated, local attacker to escalate their privilege level to root. The vulnerability is due to incorrect sudoers permissions on the script file...

CVE-2017-3876

A vulnerability in the Event Management Service daemon emsd of Cisco IOS XR routers could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on the affected device. The vulnerability is due to improper handling of gRPC requests. An attacker could exploit this...

Design/Logic Flaw

A vulnerability in the Universal Plug-and-Play UPnP implementation in the Cisco CVR100W Wireless-N VPN Router could allow an unauthenticated, Layer 2-adjacent attacker to execute arbitrary code or cause a denial of service DoS condition. The remote code execution could occur with root privileges...

CVE-2017-3882

CVE-2017-3882 affects Cisco CVR100W Wireless-N VPN Router due to a UPnP input data range check overflow. The root cause is incomplete UPnP input validation, enabling an unauthenticated, Layer 2-adjacent attacker to trigger a buffer overflow that could reload the device or execute arbitrary code w...

CVE-2017-3876

Cisco IOS XR DoS via Event Management Service daemon (emsd) due to improper handling of gRPC requests. Affected on all IOS XR platforms running release 6.1.1 with gRPC enabled (not enabled by default). An unauthenticated remote attacker can repeatedly send gRPC requests to crash the device, requi...

CVE-2017-3825

A vulnerability in the ICMP ingress packet processing of Cisco TelePresence Collaboration Endpoint CE Software could allow an unauthenticated, remote attacker to cause the TelePresence endpoint to reload unexpectedly, resulting in a denial of service DoS condition. The vulnerability is due to...

CVE-2017-6625

A "Cisco Firepower Threat Defense 6.0.0 through 6.2.2 and Cisco ASA with FirePOWER Module Denial of Service" vulnerability in the access control policy of Cisco Firepower System Software could allow an authenticated, remote attacker to cause an affected system to stop inspecting and processing...

Design/Logic Flaw

A vulnerability in Cisco IOS 15.53M Software for Cisco CallManager Express CME could allow an unauthenticated, remote attacker to make unauthorized phone calls. The vulnerability is due to a configuration restriction in the toll-fraud protections component of the affected software. An attacker...