CVE-2017-12271

A vulnerability in Cisco SPA300 and SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute unwanted actions on an affected device. The vulnerability is due to a lack of cross-site request forgery CSRF protection. An attacker could exploit this vulnerability by tricking...

Directory traversal

A vulnerability in the web interface of Cisco Network Analysis Module Software could allow an unauthenticated, remote attacker to delete arbitrary files from an affected system, aka Directory Traversal. The vulnerability exists because the affected software does not perform proper input validatio...

Input validation

A vulnerability in the web interface of Cisco Jabber could allow an authenticated, local attacker to retrieve user profile information from the affected software, which could lead to the disclosure of confidential information. The vulnerability is due to a lack of input and validation checks in t...

Cross site scripting

A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the affected system. The vulnerability is due to insufficient input validation of some parameters that are passed to the web server of the...

CVE-2017-12260

A vulnerability in the implementation of Session Initiation Protocol SIP functionality in Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones could allow an unauthenticated, remote attacker to cause an affected device to become unresponsive, resulting in a denial of service DoS...

CVE-2017-12285

A vulnerability in the web interface of Cisco Network Analysis Module Software could allow an unauthenticated, remote attacker to delete arbitrary files from an affected system, aka Directory Traversal. The vulnerability exists because the affected software does not perform proper input validatio...

CVE-2017-3883

CVE-2017-3883 affects Cisco FXOS and NX-OS System Software with AAA enabled. An unauthenticated remote attacker can brute-force login attempts, causing AAA processes to block keepalive messages; memory pressure can trigger AAA restart or device reload, leading to a denial of service. Affected pro...

CVE-2017-12286

A vulnerability in the web interface of Cisco Jabber could allow an authenticated, local attacker to retrieve user profile information from the affected software, which could lead to the disclosure of confidential information. The vulnerability is due to a lack of input and validation checks in t...

CVE-2017-12296

CVE-2017-12296 affects Cisco WebEx Meetings Server (CWMS). The issue stems from insufficient input validation on parameters passed to the web server, enabling unauthenticated, remote attackers to trigger cross-site scripting (XSS). An attacker can lure a user to a malicious link or intercept a us...

CVE-2017-12301

CVE-2017-12301 describes a vulnerability in the Python scripting subsystem of Cisco NX-OS Software. An authenticated, local attacker can escape the Python parser’s sandbox by exploiting insufficient sanitization of user-provided parameters passed to Python functions, potentially executing arbitra...

CVE-2017-12301

A vulnerability in the Python scripting subsystem of Cisco NX-OS Software could allow an authenticated, local attacker to escape the Python parser and gain unauthorized access to the underlying operating system of the device. The vulnerability exists due to insufficient sanitization of...

CVE-2017-12271

A vulnerability in Cisco SPA300 and SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute unwanted actions on an affected device. The vulnerability is due to a lack of cross-site request forgery CSRF protection. An attacker could exploit this vulnerability by tricking...

CVE-2017-12287

CVE-2017-12287 affects Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) Software. The issue stems from incomplete input validation of URL requests in the REST API of the CDB management component, allowing an authenticated, remote attacker to send a crafted URL that ...

CVE-2017-12272

CVE-2017-12272 affects Cisco IOS XE Software Web Framework, where insufficient input validation in the web server enables unauthenticated, remote attackers to perform a cross-site scripting (XSS) attack. The exploit requires the victim to visit a malicious link or for an attacker to intercept a u...

CVE-2017-12260

CVE-2017-12260 describes a DoS vulnerability in Cisco Small Business SPA50x/SPA51x/SPA52x IP Phones caused by improper handling of SIP requests. An unauthenticated remote attacker can send a SIP payload containing formatted specifiers, causing the device to become unresponsive until manual restar...

CVE-2017-3883

A vulnerability in the authentication, authorization, and accounting AAA implementation of Cisco Firepower Extensible Operating System FXOS and NX-OS System Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability occurs because AAA process...

CVE-2017-12251

The CVE-2017-12251 issue affects Cisco Cloud Services Platform (CSP) 2100 running software releases 2.1.0, 2.1.1, 2.1.2, 2.2.0, 2.2.1, or 2.2.2. The vulnerability arises from weaknesses in the generation of authentication mechanisms in the CSP web console URL, enabling an authenticated, remote at...

CVE-2017-12296

A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the affected system. The vulnerability is due to insufficient input validation of some parameters that are passed to the web server of the...

CVE-2017-12288

The CVE-2017-12288 entry describes a cross-site scripting (XSS) flaw in the web-based management interface of Cisco Unified Contact Center Express (UCCE). The root cause is insufficient validation of user-supplied input in the interface, allowing an unauthenticated, remote attacker to lure a user...

CVE-2017-12285

CVE-2017-12285 affects Cisco Network Analysis Module (NAM) web interface. The issue is a directory traversal vulnerability caused by improper input validation and lack of RBAC on HTTP URLs, allowing an unauthenticated, remote attacker to delete arbitrary files via a crafted request. Multiple advi...