Remote code execution

A "Cisco WebEx Network Recording Player Remote Code Execution Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced Recording Format ARF and WebEx Recording Format WRF files. A remote attacker could exploit this by providing a user with a malicious ARF or WRF file via email o...

Sql injection

A SQL Injection vulnerability in the web framework of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to execute unauthorized Structured Query Language SQL queries. The vulnerability is due to a failure to validate user-supplied input that is used in SQL queries. An...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Jabber for Windows, Mac, Android, and iOS could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface. The vulnerability is due to insufficient...

CVE-2017-12349

Multiple vulnerabilities in the web-based management interface of Cisco UCS Central Software could allow a remote attacker to conduct a cross-site scripting XSS attack against a user of the affected interface or hijack a valid session ID from a user of the affected interface. Cisco Bug IDs:...

CVE-2017-12354

A vulnerability in the web-based interface of Cisco Secure Access Control System ACS could allow an unauthenticated, remote attacker to view sensitive information on an affected system. The vulnerability exists because the affected software does not sufficiently protect system software version...

CVE-2017-12332

A vulnerability in Cisco NX-OS System Software patch installation could allow an authenticated, local attacker to write a file to arbitrary locations. The vulnerability is due to insufficient restrictions in the patch installation process. An attacker could exploit this vulnerability by installin...

CVE-2017-12339

A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient input validation of command arguments to the CLI parser. An attacker could exploit this vulnerability by injecting...

CVE-2017-12372

CVE-2017-12372 is a Cisco WebEx Network Recording Player remote code execution vulnerability in ARF/WRF playback. The flaw allows a remote attacker to cause the affected WebEx players to crash and, in the worst case, execute arbitrary code on the user’s system when a malicious ARF or WRF file is ...

CVE-2017-12360

CVE-2017-12360 is a vulnerability in Cisco WebEx Network Recording Player for WebEx Recording Format (WRF) files. The issue allows a remote attacker to cause a denial-of-service by convincing a user to open a malicious WRF file (delivered via email or URL), causing the affected WebEx Player to cr...

CVE-2017-12331

CVE-2017-12331 affects Cisco NX-OS System Software on Multilayer Director Switches, Nexus 7000/7700 Series, and UCS Manager. Root cause: insufficient NX-OS signature verification for software patches. An authenticated, local attacker with valid administrator credentials could bypass signature ver...

CVE-2017-12368

A "Cisco WebEx Network Recording Player Remote Code Execution Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced Recording Format ARF and WebEx Recording Format WRF files. A remote attacker could exploit this by providing a user with a malicious ARF or WRF file via email o...

CVE-2017-12366

Cisco WebEx Meeting Center is affected by CVE-2017-12366 through insufficient input validation of parameters sent to the web server, enabling an unauthenticated, remote attacker to perform cross-site scripting (XSS). Exploitation requires convincing a user to follow a malicious link or intercepti...

CVE-2017-12358

Cisco Jabber’s web-based management interface (Windows, Mac, Android, iOS) contains an XSS vulnerability due to insufficient input validation. An authenticated, remote attacker could entice a user to click a malicious link, potentially executing arbitrary script code in the interface or accessing...

CVE-2017-12340

CVE-2017-12340 affects Cisco NX-OS System Software on Cisco MDS Multilayer Director Switches, Nexus 7000, and Nexus 7700 series. The flaw is due to insufficient sanitization of user-supplied parameters in the Python scripting sandbox, enabling an authenticated, local attacker to escape the sandbo...

CVE-2017-12365

CVE-2017-12365 affects Cisco WebEx Event Center. A design flaw allows an authenticated, remote attacker to query the Event Center site and view both listed and unlisted meetings, enabling potential attendance of meetings not accessible to them. Root cause is a information-disclosure design weakne...

CVE-2017-12338

A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to read the contents of arbitrary files. The vulnerability is due to insufficient input validation for a specific CLI command. An attacker could exploit this vulnerability by issuing a crafted...

CVE-2017-12357

The CVE-2017-12357 issue affects Cisco Unified Communications Manager (CUCM) web-based administration interface. The vulnerability stems from improper validation of user-supplied input in the web UI, enabling an authenticated, remote attacker to persuade a user to click a crafted link and trigger...

CVE-2017-12336

CVE-2017-12336 describes a local, authenticated exploitation of the TCL scripting subsystem in Cisco NX-OS System Software. The issue arises from insufficient input validation of user-supplied files passed to the interactive TCL shell, allowing an attacker with administrative or tclsh privileges ...

CVE-2017-12371

A "Cisco WebEx Network Recording Player Remote Code Execution Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced Recording Format ARF and WebEx Recording Format WRF files. A remote attacker could exploit this by providing a user with a malicious ARF or WRF file via email o...

CVE-2017-12369

A "Cisco WebEx Network Recording Player Out-of-Bounds Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced Recording Format ARF and WebEx Recording Format WRF files. A remote attacker could exploit this by providing a user with a malicious ARF or WRF file via email or URL an...