CVE-2017-12260

CVE-2017-12260 describes a DoS vulnerability in Cisco Small Business SPA50x/SPA51x/SPA52x IP Phones caused by improper handling of SIP requests. An unauthenticated remote attacker can send a SIP payload containing formatted specifiers, causing the device to become unresponsive until manual restar...

CVE-2017-12251

The CVE-2017-12251 issue affects Cisco Cloud Services Platform (CSP) 2100 running software releases 2.1.0, 2.1.1, 2.1.2, 2.2.0, 2.2.1, or 2.2.2. The vulnerability arises from weaknesses in the generation of authentication mechanisms in the CSP web console URL, enabling an authenticated, remote at...

CVE-2017-12271

CVE-2017-12271 affects Cisco SPA300 and SPA500 Series IP Phones. The issue is a lack of cross-site request forgery (CSRF) protection in the web interface, allowing an unauthenticated, remote attacker to trigger unwanted actions by tricking a user into executing an adverse action. Documented impac...

CVE-2017-12288

The CVE-2017-12288 entry describes a cross-site scripting (XSS) flaw in the web-based management interface of Cisco Unified Contact Center Express (UCCE). The root cause is insufficient validation of user-supplied input in the interface, allowing an unauthenticated, remote attacker to lure a user...

CVE-2017-12285

CVE-2017-12285 affects Cisco Network Analysis Module (NAM) web interface. The issue is a directory traversal vulnerability caused by improper input validation and lack of RBAC on HTTP URLs, allowing an unauthenticated, remote attacker to delete arbitrary files via a crafted request. Multiple advi...

Input validation

A vulnerability in the routine that loads DLL files in Cisco Meeting App for Windows could allow an authenticated, local attacker to run an executable file with privileges equivalent to those of Cisco Meeting App. The vulnerability is due to incomplete input validation of the path name for DLL...

Cross site scripting

A vulnerability in the web-based UI of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to execute a cross-frame scripting XFS attack. The vulnerability exists because the affected software does not provide sufficient protections for HTML inline frames iframes...

CVE-2017-12265

A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device, aka HREF XSS. The...

CVE-2017-12256

A vulnerability in the Akamai Connect feature of Cisco Wide Area Application Services WAAS Appliances could allow an unauthenticated, remote attacker to cause a denial-of-service DoS condition on an affected device. The vulnerability is due to certain file-handling inefficiencies of the affected...

CVE-2017-12263

A vulnerability in the web interface of Cisco License Manager software could allow an unauthenticated, remote attacker to download and view files within the application that should be restricted, aka Directory Traversal. The issue is due to improper sanitization of user-supplied input in HTTP...

CVE-2017-12268

A vulnerability in the Network Access Manager NAM of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker to enable multiple network adapters, aka a Dual-Homed Interface vulnerability. The vulnerability is due to insufficient NAM policy enforcement. An attacker cou...

Security feature bypass

A vulnerability in the Network Access Manager NAM of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker to enable multiple network adapters, aka a Dual-Homed Interface vulnerability. The vulnerability is due to insufficient NAM policy enforcement. An attacker cou...

Directory traversal

A vulnerability in the web interface of Cisco License Manager software could allow an unauthenticated, remote attacker to download and view files within the application that should be restricted, aka Directory Traversal. The issue is due to improper sanitization of user-supplied input in HTTP...

Race condition

A vulnerability in the Independent Computing Architecture ICA accelerator feature for the Cisco Wide Area Application Services WAAS could allow an unauthenticated, remote attacker to cause an ICA application optimization-related process to restart, resulting in a partial denial of service DoS...

Design/Logic Flaw

A vulnerability in SSL traffic decryption for Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause depletion of system memory, aka a Firepower Detection Engine SSL Decryption Memory Consumption Denial of Service vulnerability. If this memory leak...

Cross site scripting

A vulnerability in the web framework of Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation of some parameters...

CVE-2017-12264

A vulnerability in the Web Admin Interface of Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to insufficient bound checks performed by the affected software. An attacker could exploit this vulnerability by...

CVE-2017-12246

A vulnerability in the implementation of the direct authentication feature in Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to cause an affected device to unexpectedly reload, resulting in a denial of service DoS condition. The vulnerability is due...

CVE-2017-12246

A vulnerability in the implementation of the direct authentication feature in Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to cause an affected device to unexpectedly reload, resulting in a denial of service DoS condition. The vulnerability is due...

CVE-2017-12245

CVE-2017-12245 describes a memory-consumption DoS vulnerability in Cisco Firepower Threat Defense (FTD) Software’s SSL traffic decryption. Root cause: an error in how the Firepower Detection Snort Engine handles SSL traffic decryption and communicates with the ASA handler, enabling an unauthentic...