1761 matches found
CVE-2015-4219: Exposure of Sensitive Information to an Unauthorized Actor
Cisco Secure Access Control System before 5.40.46.2 and 5.5 before 5.50.46 and Cisco Identity Services Engine 1.04.573 do not properly implement access control for support bundles, which allows remote authenticated users to obtain sensitive information via brute-force attempts to send valid...
CVE-2015-0768
The Device Work Center DWC component in Cisco Prime Network Control System NCS 2.10.0.85, 2.20.0.58, and 2.20.0.69 does not properly implement AAA roles, which allows remote authenticated users to bypass intended access restrictions and execute commands via a login session, aka Bug ID CSCur27371...
CVE-2015-0768
The Device Work Center DWC component in Cisco Prime Network Control System NCS 2.10.0.85, 2.20.0.58, and 2.20.0.69 does not properly implement AAA roles, which allows remote authenticated users to bypass intended access restrictions and execute commands via a login session, aka Bug ID CSCur27371...
CVE-2015-0768: Undefined Security Weakness
The Device Work Center DWC component in Cisco Prime Network Control System NCS 2.10.0.85, 2.20.0.58, and 2.20.0.69 does not properly implement AAA roles, which allows remote authenticated users to bypass intended access restrictions and execute commands via a login session, aka Bug ID CSCur27371...
Cisco Prime Network Control System Unauthorized Configuration Vulnerability
A vulnerability in the authentication, authorization, and accounting AAA user roles of the Cisco Prime Network Control System NCS network management application could allow an authenticated, remote attacker who is logged in as a system monitor user to perform configuration tasks. The vulnerabilit...
CVE-2015-0744
Cisco DTA Control System DTACS 4.0.0.9 and Cisco Headend System Release allow remote attackers to cause a denial of service CPU and memory consumption, and TCP service outage via 1 a SYN flood or 2 another type of TCP traffic flood, aka Bug IDs CSCus50642, CSCus50662, CSCus50625, CSCus50657, and...
Design/Logic Flaw
Cisco DTA Control System DTACS 4.0.0.9 and Cisco Headend System Release allow remote attackers to cause a denial of service CPU and memory consumption, and TCP service outage via 1 a SYN flood or 2 another type of TCP traffic flood, aka Bug IDs CSCus50642, CSCus50662, CSCus50625, CSCus50657, and...
CVE-2015-0744
The CVE affects Cisco DTA Control System (DTACS) 4.0.0.9 and Cisco Headend System Release. It is caused by a lack of rate limiting in the TCP listener, enabling an unauthenticated remote attacker to trigger a denial-of-service via a TCP flood (e.g., SYN flood) that can exhaust CPU/memory and disr...
CVE-2015-0744
Cisco DTA Control System DTACS 4.0.0.9 and Cisco Headend System Release allow remote attackers to cause a denial of service CPU and memory consumption, and TCP service outage via 1 a SYN flood or 2 another type of TCP traffic flood, aka Bug IDs CSCus50642, CSCus50662, CSCus50625, CSCus50657, and...
CVE-2015-0744: Undefined Security Weakness
Cisco DTA Control System DTACS 4.0.0.9 and Cisco Headend System Release allow remote attackers to cause a denial of service CPU and memory consumption, and TCP service outage via 1 a SYN flood or 2 another type of TCP traffic flood, aka Bug IDs CSCus50642, CSCus50662, CSCus50625, CSCus50657, and...
Rockwell RSView32 Security Vulnerability Patched
Human machine interface software from Rockwell Automation has been patched, protecting users from a vulnerability in the way stored passwords are protected. The vulnerability was discovered in RSView32, versions 7.60.00 and earlier, according to an alert from the Industrial Control System Cyber...
Debian DSA-3257-1 : mercurial - security update
Jesse Hertz of Matasano Security discovered that Mercurial, a distributed version control system, is prone to a command injection vulnerability via a crafted repository name in a clone command. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...
Open Smart Grid Protocol Homegrown Crypto Weaknesses
In the three years since its inception, the Open Smart Grid Protocol has found its way into more than four million smart meters and similar devices worldwide. And like its SCADA, industrial control system, and embedded system brethren, it’s rife with security issues. Two researchers, Phillip...
[SECURITY] Fedora 20 Update: ikiwiki-3.20150329-1.fc20
Ikiwiki is a wiki compiler. It converts wiki pages into HTML pages suitable for publishing on a website. Ikiwiki stores pages and history in a revision control system such as Subversion or Git. There are many other features, including support for blogging, as well as a large array of plugins...
[SECURITY] Fedora 21 Update: ikiwiki-3.20150329-1.fc21
Ikiwiki is a wiki compiler. It converts wiki pages into HTML pages suitable for publishing on a website. Ikiwiki stores pages and history in a revision control system such as Subversion or Git. There are many other features, including support for blogging, as well as a large array of plugins...
The vulnerability of Cisco ACS’s microprogramming software allows a remote attacker to execute arbitrary code.
The vulnerability of the ACS View interface allows a remote authenticated user with administrator privileges to execute arbitrary SQL commands using specially crafted HTTPS requests...
Debian: Security Advisory (DSA-3231-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Report Recommends Series of Cybersecurity Changes at FAA
The Federal Aviation Administration needs to upgrade and update its information security capabilities–including building a threat-modeling capability and implementing federal security guidelines–in order to ensure the safety of the nation’s aviation infrastructure, according to a new report by th...
Cisco Secure Access Control System SQLi Vulnerability (cisco-sa-20150211-csacs)
The version of Cisco Secure Access Control System ACS running on the remote host is prior to 5.5 patch 7. It is, therefore, affected by a SQL injection vulnerability due to not properly sanitizing user input to the ACS View reporting interface pages. An authenticated, remote attacker, using craft...
