CVE-2017-6626

A vulnerability in the Cisco Finesse Notification Service for Cisco Unified Contact Center Enterprise UCCE 11.51 and 11.61 could allow an unauthenticated, remote attacker to retrieve information from agents using the Finesse Desktop. The vulnerability is due to the existence of a user account tha...

CVE-2017-6620

A vulnerability in the remote management access control list ACL feature of the Cisco CVR100W Wireless-N VPN Router could allow an unauthenticated, remote attacker to bypass the remote management ACL. The vulnerability is due to incorrect implementation of the ACL decision made during the ingress...

CVE-2017-6625

CVE-2017-6625 affects Cisco Firepower System Software (FTD 6.0.0–6.2.2) and ASA with FirePOWER Module when SSL policy is enabled. The root cause is improper SSL policy handling in the access control policy, allowing an authenticated, remote attacker to craft SSL packets that cause the system to s...

CVE-2017-6626

CVE-2017-6626 affects Cisco Finesse Notification Service in Cisco UCCE 11.5(1) and 11.6(1). Root cause: a user account with an undocumented hard-coded password allows unauthenticated, remote attackers to subscribe to the Finesse Notification Service and receive agent-related notifications (sign-i...

CVE-2017-6624

CVE-2017-6624 affects Cisco IOS 15.5(3)M Software for Cisco CallManager Express (CME). The issue stems from a configuration restriction in the toll-fraud protections component, allowing an unauthenticated, remote attacker to place unauthorized long-distance calls via an affected system. Connected...

Input validation

A vulnerability in the detection engine parsing of Pragmatic General Multicast PGM protocol packets for Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition due to the Snort process unexpectedly restarting. The vulnerability is...

Cross site scripting

A vulnerability in the web framework code of Cisco Prime Infrastructure 2.22 could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of the affected system. The vulnerability is due to insufficient input validation of some...

Design/Logic Flaw

A vulnerability in the file-download feature of the web user interface for Cisco FindIT Network Probe Software 1.0.0 could allow an authenticated, remote attacker to download and view any system file by using the affected software. The vulnerability is due to the absence of role-based access...

Race condition

A vulnerability in the DNS input packet processor for Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to cause the DNS process to momentarily restart, which could lead to a partial denial of service DoS condition on the affected system. The vulnerability is due to...

Design/Logic Flaw

A vulnerability in the web-based GUI of Cisco Integrated Management Controller IMC 3.01c could allow an authenticated, remote attacker to execute arbitrary commands on an affected system. The vulnerability exists because the affected software does not sufficiently sanitize user-supplied HTTP inpu...

Design/Logic Flaw

A vulnerability in the Secure Sockets Layer SSL and Transport Layer Security TLS code of Cisco ASA Software could allow an unauthenticated, remote attacker to cause a reload of the affected system. The vulnerability is due to improper parsing of crafted SSL or TLS packets. An attacker could explo...

Input validation

A vulnerability in the Internet Key Exchange Version 1 IKEv1 XAUTH code of Cisco ASA Software could allow an authenticated, remote attacker to cause a reload of an affected system. The vulnerability is due to insufficient validation of the IKEv1 XAUTH parameters passed during an IKEv1 negotiation...

Design/Logic Flaw

A vulnerability in the IPsec code of Cisco ASA Software could allow an authenticated, remote attacker to cause a reload of the affected system. The vulnerability is due to improper parsing of malformed IPsec packets. An attacker could exploit this vulnerability by sending malformed IPsec packets ...

Design/Logic Flaw

A vulnerability in the DNS code of Cisco ASA Software could allow an unauthenticated, remote attacker to cause an affected device to reload or corrupt the information present in the device's local DNS cache. The vulnerability is due to a flaw in handling crafted DNS response messages. An attacker...

CVE-2017-6619

A vulnerability in the web-based GUI of Cisco Integrated Management Controller IMC 3.01c could allow an authenticated, remote attacker to execute arbitrary commands on an affected system. The vulnerability exists because the affected software does not sufficiently sanitize user-supplied HTTP inpu...

CVE-2017-6610

The CVE-2017-6610 issue affects Cisco ASA Software in routed firewall mode (single or multiple context) and can be triggered by IPv4/IPv6 traffic. It arises from insufficient validation of IKEv1 XAUTH parameters during negotiation, allowing an authenticated, remote attacker to cause a reload of t...

CVE-2017-6609

CVE-2017-6609 affects Cisco ASA Software IPsec handling. The vulnerability stems from improper parsing of malformed IPsec packets in the IPsec code, requiring an authenticated, remote attacker to establish a valid IPsec tunnel and send crafted traffic to the affected system. Exploitation can caus...

CVE-2017-6614

Cisco FindIT Network Probe Software 1.0.0 is affected by CVE-2017-6614 due to missing RBAC for file-download requests in its web UI. An authenticated, remote attacker could send a crafted HTTP request to download and view arbitrary system files using the affected software. Exploitation details an...

CVE-2017-6609

A vulnerability in the IPsec code of Cisco ASA Software could allow an authenticated, remote attacker to cause a reload of the affected system. The vulnerability is due to improper parsing of malformed IPsec packets. An attacker could exploit this vulnerability by sending malformed IPsec packets ...

CVE-2017-6611

A vulnerability in the web framework code of Cisco Prime Infrastructure 2.22 could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of the affected system. The vulnerability is due to insufficient input validation of some...