CVE-2015-0692

Cisco Web Security Appliance WSA devices with software 8.5.0-ise-147 do not properly restrict use of the pickle Python module during certain tunnel-status checks, which allows local users to execute arbitrary Python code and gain privileges via crafted serialized objects, aka Bug ID CSCut39230...

Cisco Identity Services Engine WebUI Detection

Binary data ciscoisewebuidetect.nbin...

Design/Logic Flaw

The periodic-backup feature in Cisco Identity Services Engine ISE allows remote attackers to discover backup-encryption passwords via a crafted request that triggers inclusion of a password in a reply, aka Bug ID CSCur41673...

CVE-2014-8015

Cisco Identity Services Engine (ISE) Sponsor Portal is affected by CVE-2014-8015. An authenticated remote attacker can manipulate an HTTP request to access or modify a guest account created by another sponsor due to a failure to enforce cross-sponsor guest-account isolation. The issue is exploita...

CVE-2014-8017

Cisco Identity Services Engine (ISE) periodic-backup password disclosure vulnerability (CVE-2014-8017) arises from improper processing of certain client requests. An unauthenticated, remote attacker can trigger a crafted request that causes the backup password to be included in a reply, enabling ...

MIPS Little Endian Shellcode

No description provided by source. Disassembled MIPS Little Endian Shellcode Shellcode was designed for ACSD exploit on the ASUS RT-AC66U SOHO router. CVE: CVE-2013-4659 Written by Jacob Holcomb, Security Analyst @ Independent Security Evaluators Blog: http://infosec42.blogspot.com Company Websit...

CVE-2014-3276

Cisco Identity Services Engine ISE 1.2.1 patch 2 and earlier does not properly handle deadlock conditions during reception of crafted RADIUS accounting packets from multiple NAS devices, which allows remote authenticated users to cause a denial of service RADIUS outage by sourcing these packets...

Sql injection

SQL injection vulnerability in the web framework in Cisco Identity Services Engine ISE 1.2.1 patch 2 and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCul21337...

Design/Logic Flaw

Cisco Identity Services Engine ISE 1.2.1 patch 2 and earlier does not properly handle deadlock conditions during reception of crafted RADIUS accounting packets from multiple NAS devices, which allows remote authenticated users to cause a denial of service RADIUS outage by sourcing these packets...

CVE-2014-3276

Cisco Identity Services Engine ISE 1.2.1 patch 2 and earlier does not properly handle deadlock conditions during reception of crafted RADIUS accounting packets from multiple NAS devices, which allows remote authenticated users to cause a denial of service RADIUS outage by sourcing these packets...

CVE-2014-3275

Cisco Identity Services Engine (ISE) is affected by CVE-2014-3275, a SQL injection in the web framework that allows an authenticated, remote attacker to execute arbitrary SQL via a crafted URL. The root cause is a failure to validate user-supplied input in SQL queries, potentially impacting integ...

CVE-2014-3276

Cisco's advisory and CVE records describe a denial-of-service vulnerability in Cisco Identity Services Engine (ISE) prior to or including 1.2(.1 patch 2). The issue stems from improper handling of deadlock conditions when receiving crafted RADIUS accounting packets from two different NAS devices,...

CVE-2014-0681

Cisco Identity Services Engine (ISE) 1.2 patch 2 and earlier is affected by a cross-site scripting (XSS) vulnerability in the report output pages. The root cause is insufficient input validation when generating reports, allowing an unauthenticated, remote attacker to inject arbitrary web script o...

CVE-2014-0681

Cross-site scripting XSS vulnerability in Cisco Identity Services Engine ISE 1.2 patch 2 and earlier allows remote attackers to inject arbitrary web script or HTML via a report containing a crafted URL that is not properly handled during generation of report-output pages, aka Bug ID CSCui15064...

CVE-2014-0680

Cisco Identity Services Engine (ISE) NAC Web Agent’s HTTP control interface is affected by a Cross-Site Scripting (XSS) vulnerability. The issue arises from insufficient input validation, allowing remote attackers to inject arbitrary scripts via a crafted URL. Exploitation could cause a user to e...

ASUS RT-N56U - Remote Buffer Overflow (ROP)

ASUS RT-N56U - Remote Buffer Overflow ROP !/usr/bin/env python from time import sleep from sys import exit import urllib2, signal, struct, base64, socket, ssl Title: ASUS RT-N56U Remote Root Shell Exploit - appsname Discovered and Reported: October 2013 Discovered/Exploited By: Jacob Holcomb/Gimp...

ASUS RT-N56U Remote Root

!/usr/bin/env python from time import sleep from sys import exit import urllib2, signal, struct, base64, socket, ssl Title: ASUS RT-N56U Remote Root Shell Exploit - appsname Discovered and Reported: October 2013 Discovered/Exploited By: Jacob Holcomb/Gimppy - Security Analyst @ ISE Contact: Twitt...

Cisco ISE Unprivileged Support Bundle Download Vulnerability

A vulnerability in the role-based access control code of the Cisco Identity Services Engine ISE could allow an authenticated, but unprivileged, remote attacker to access support bundle information. The vulnerability is due to a failure to check the user privileges correctly when downloading the...

CVE-2014-0665

The RBAC implementation in Cisco Identity Services Engine ISE Software does not properly verify privileges for support-bundle downloads, which allows remote authenticated users to obtain sensitive information via a download action, as demonstrated by obtaining read access to the user database, ak...

Design/Logic Flaw

The RBAC implementation in Cisco Identity Services Engine ISE Software does not properly verify privileges for support-bundle downloads, which allows remote authenticated users to obtain sensitive information via a download action, as demonstrated by obtaining read access to the user database, ak...