CVE-2017-6642

A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to access sensitive information on an affected system. The vulnerability exists because the affected software does not sufficiently protect sensitive data when...

CVE-2017-6630

CVE-2017-6630 affects Cisco IP Phone 8851 with firmware 11.0(0.1). A remote, unauthenticated attacker can trigger a denial of service by sending manipulated CANCEL SIP messages due to an abnormal SIP handling in the device. Multiple sources (Cisco advisory Cisco-SA-20170517-sip, Tenable plugin, a...

CVE-2017-6635

CVE-2017-6635 affects Cisco Prime Collaboration Provisioning Software (before Release 12.1). The web interface allows authenticated, remote attackers to delete arbitrary files via crafted HTTP requests that exploit directory traversal and weak RBAC enforcement. The issue is rooted in insufficient...

CVE-2017-6632

Cisco FirePOWER System Software SSL Logging DoS (CVE-2017-6632) affects 5.3.0–6.2.2 when SSL policy logging is enabled. An unauthenticated remote attacker can cause a DoS by sending a flood of crafted TCP packets, due to mis‑configurable SSL logging of certain TCP traffic. Impact is high availabi...

CVE-2017-6644

A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to access sensitive information on an affected system. The vulnerability exists because the affected software does not sufficiently protect sensitive data when...

CVE-2017-6653

Summary: CVE-2017-6653 is a DoS vulnerability in the GUI TCP throttling of Cisco Identity Services Engine (ISE) 2.1(0.474). An unauthenticated remote attacker can cause the GUI to stop responding by sending a high rate of TCP connections to the GUI, due to insufficient TCP rate limiting. Affected...

CVE-2017-6641

A vulnerability in the TCP connection handling functionality of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to disable TCP ports and cause a denial of service DoS condition on an affected system. The vulnerability is due to a lack of rate-limiting...

CVE-2017-6650

Summary: CVE-2017-6650 affects Cisco NX-OS System Software 7.1–7.3 on Cisco Nexus Series Switches. The issue is a command injection in the Telnet CLI, caused by insufficient input validation of command arguments. An authenticated local attacker could inject crafted arguments into the Telnet CLI t...

Directory traversal

A vulnerability in the web framework of the Cisco TelePresence IX5000 Series could allow an unauthenticated, remote attacker to access arbitrary files on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by using directory...

CVE-2017-6652

A vulnerability in the web framework of the Cisco TelePresence IX5000 Series could allow an unauthenticated, remote attacker to access arbitrary files on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by using directory...

Design/Logic Flaw

A vulnerability in the web interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to access sensitive data. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to insufficient protection of...

CVE-2017-6623

A vulnerability in a script file that is installed as part of the Cisco Policy Suite CPS Software distribution for the CPS appliance could allow an authenticated, local attacker to escalate their privilege level to root. The vulnerability is due to incorrect sudoers permissions on the script file...

CVE-2017-6652

The CVE-2017-6652 issue affects Cisco TelePresence IX5000 Series devices running software version 8.2.0 and is a directory-traversal vulnerability in the web framework caused by insufficient input validation. An unauthenticated, remote attacker could read arbitrary files from the device filesyste...

Design/Logic Flaw

A vulnerability in the Universal Plug-and-Play UPnP implementation in the Cisco CVR100W Wireless-N VPN Router could allow an unauthenticated, Layer 2-adjacent attacker to execute arbitrary code or cause a denial of service DoS condition. The remote code execution could occur with root privileges...

CVE-2017-3876

A vulnerability in the Event Management Service daemon emsd of Cisco IOS XR routers could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on the affected device. The vulnerability is due to improper handling of gRPC requests. An attacker could exploit this...

CVE-2017-3825

A vulnerability in the ICMP ingress packet processing of Cisco TelePresence Collaboration Endpoint CE Software could allow an unauthenticated, remote attacker to cause the TelePresence endpoint to reload unexpectedly, resulting in a denial of service DoS condition. The vulnerability is due to...

CVE-2017-3876

Cisco IOS XR DoS via Event Management Service daemon (emsd) due to improper handling of gRPC requests. Affected on all IOS XR platforms running release 6.1.1 with gRPC enabled (not enabled by default). An unauthenticated remote attacker can repeatedly send gRPC requests to crash the device, requi...

CVE-2017-3882

CVE-2017-3882 affects Cisco CVR100W Wireless-N VPN Router due to a UPnP input data range check overflow. The root cause is incomplete UPnP input validation, enabling an unauthenticated, Layer 2-adjacent attacker to trigger a buffer overflow that could reload the device or execute arbitrary code w...

Design/Logic Flaw

A vulnerability in Cisco IOS 15.53M Software for Cisco CallManager Express CME could allow an unauthenticated, remote attacker to make unauthorized phone calls. The vulnerability is due to a configuration restriction in the toll-fraud protections component of the affected software. An attacker...

CVE-2017-6620

A vulnerability in the remote management access control list ACL feature of the Cisco CVR100W Wireless-N VPN Router could allow an unauthenticated, remote attacker to bypass the remote management ACL. The vulnerability is due to incorrect implementation of the ACL decision made during the ingress...