CVE-2015-6323

The Admin portal in Cisco Identity Services Engine ISE 1.1.x, 1.2.0 before patch 17, 1.2.1 before patch 8, 1.3 before patch 5, and 1.4 before patch 4 allows remote attackers to obtain administrative access via unspecified vectors, aka Bug ID CSCuw34253...

CVE-2015-6323

CVE-2015-6323 affects Cisco Identity Services Engine (ISE) Admin Portal. The vulnerability is described as an unauthorized access flaw in the Admin Portal that could allow an unauthenticated, remote attacker to obtain administrative access to affected devices. Affected releases include ISE 1.1.x ...

Design/Logic Flaw

The guest portal in Cisco Identity Services Engine ISE 3300 1.20.899 does not restrict access to uploaded HTML documents, which allows remote attackers to obtain sensitive information from customized documents via a direct request, aka Bug ID CSCuo78045...

CVE-2015-6266

CVE-2015-6266 affects Cisco Identity Services Engine (ISE) guest portal, where the portal does not restrict access to uploaded HTML documents. The underlying issue is lack of access control for customized HTML files, allowing remote attackers to retrieve sensitive information by requesting the fi...

CVE-2015-6266

The guest portal in Cisco Identity Services Engine ISE 3300 1.20.899 does not restrict access to uploaded HTML documents, which allows remote attackers to obtain sensitive information from customized documents via a direct request, aka Bug ID CSCuo78045...

CVE-2015-4266

The web interface in Cisco Identity Services Engine ISE 1.14.1, 1.3106.146, and 1.3120.135 does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame...

CVE-2015-4266

CVE-2015-4266 affects Cisco Identity Services Engine (ISE) web interface: ISE 1.1(4.1), 1.3(106.146), and 1.3(120.135) are vulnerable due to insufficient iframe protection, enabling cross-frame scripting (XFS)/clickjacking via a crafted site. Impact is remote, unauthenticated browser attacks (cli...

CVE-2015-4267

Cross-site request forgery CSRF vulnerability in the web framework in Cisco Identity Services Engine ISE 1.20.793, 1.30.876, 1.40.109, 2.00.147, and 2.00.169 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus09940...

CVE-2015-4267

Cisco Identity Services Engine (ISE) 1.2(0.793), 1.3(0.876), 1.4(0.109), 2.0(0.147), and 2.0(0.169) are affected by a CSRF vulnerability in the web framework due to insufficient CSRF protections. The CVE describes that remote attackers could hijack the authentication of arbitrary users, with an u...

CVE-2015-4267

Cross-site request forgery CSRF vulnerability in the web framework in Cisco Identity Services Engine ISE 1.20.793, 1.30.876, 1.40.109, 2.00.147, and 2.00.169 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus09940...

CVE-2015-4268

Multiple cross-site scripting XSS vulnerabilities in the Infra Admin UI in Cisco Identity Services Engine ISE 1.21.198 and 1.30.876 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a 1 GET or 2 POST request, aka Bug ID CSCus16052...

CVE-2015-4268

Cisco Identity Services Engine (ISE) Infra Admin UI is affected by CVE-2015-4268, with XSS vulnerabilities in ISE versions 1.2(1.198) and 1.3(0.876). The root cause is insufficient input validation of certain HTTP GET/POST parameters, enabling remote attackers to inject arbitrary web script or HT...

CVE-2015-4268

Multiple cross-site scripting XSS vulnerabilities in the Infra Admin UI in Cisco Identity Services Engine ISE 1.21.198 and 1.30.876 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a 1 GET or 2 POST request, aka Bug ID CSCus16052...

CVE-2015-4182

The administrative web interface in Cisco Identity Services Engine ISE before 1.3 allows remote authenticated users to bypass intended access restrictions, and obtain sensitive information or change settings, via unspecified vectors, aka Bug ID CSCui72087...

CVE-2015-4182

Cisco Identity Services Engine (ISE) administrative web interface before 1.3 contains a vulnerability in the web page access controls that allows an authenticated remote attacker to bypass access restrictions and either read sensitive information or change settings via unspecified vectors (Bug ID...

CVE-2015-4182

The administrative web interface in Cisco Identity Services Engine ISE before 1.3 allows remote authenticated users to bypass intended access restrictions, and obtain sensitive information or change settings, via unspecified vectors, aka Bug ID CSCui72087...

Design/Logic Flaw

The Posture module for Cisco Identity Services Engine ISE, as distributed in Cisco AnyConnect Secure Mobility Client 4.064, allows local users to gain privileges via unspecified commands, aka Bug ID CSCut05797...

CVE-2015-0757

The CVE concerns Cisco Identity Services Engine (ISE) web framework versions 1.2(1.901) and 1.3(0.722), where improper session handler implementation allows an unauthenticated, remote attacker to read web pages and obtain sensitive information (e.g., MnT reports). This is a genuine information-di...

CVE-2015-0755

The CVE-2015-0755 entry concerns Cisco Identity Services Engine (ISE) Posture module in Cisco AnyConnect Secure Mobility Client 4.0(64). The vulnerability is an elevation of privilege due to insufficient access controls in the Posture module, allowing an authenticated, local attacker to run arbit...

Cisco Identity Services Engine Privilege Escalation Vulnerability

A vulnerability in the Posture module of the Cisco Identity Services Engine ISE could allow an authenticated, local attacker to run arbitrary programs with elevated privileges. The vulnerability is due to insufficient access control protections. An attacker could exploit this vulnerability by...