CVE-2014-0665

Summary of CVE-2014-0665 (Cisco ISE): A flaw in the RBAC code allows an authenticated, unprivileged user to download the support bundle and access sensitive data (e.g., user database) because privileges are not properly checked. An attacker, with valid credentials, could exploit this to obtain in...

MIPS Little Endian - Reverse Shell Shellcode Linux

MIPS Little Endian - Reverse Shell Shellcode Linux. Shellcode exploit for hardware platform MIPS Little Endian Reverse Shell ASM File and Assembled Shellcode Written by Jacob Holcomb, Security Analyst @ Independent Security Evaluators Blog: http://infosec42.blogspot.com Company Website:...

Cisco Identity Services Engine multiple security vulnerabilities

Authentication bypass, code execution...

Cisco Identity Services Engine contains an input validation vulnerability

Overview Cisco Identity Services Engine contains an input validation vulnerability CWE-20. Description CWE-20: Improper Input Validation Cisco Identity Services Engine ISE contains an input validation vulnerability. The ISE device contains a TCP Dump option for analyzing traffic on the device. By...

CVE-2013-5531

Cisco Identity Services Engine ISE 1.x before 1.1.1 allows remote attackers to bypass authentication, and read support-bundle configuration and credentials data, via a crafted session on TCP port 443, aka Bug ID CSCty20405...

CVE-2013-5530

Cisco Identity Services Engine (ISE) web framework vulnerability affects ISE releases 1.0 and 1.1.x up to 1.1.4.x and 1.2 up to 1.2.0.x: specifically 1.0, 1.1.0 before 1.1.0.665-5; 1.1.1 before 1.1.1.268-7; 1.1.2 before 1.1.2.145-10; 1.1.3 before 1.1.3.124-7; 1.1.4 before 1.1.4.218-7; 1.2 before ...

CVE-2013-5521

Cisco Identity Services Engine (ISE) is affected by CVE-2013-5521, where the guest-account creation page can be used to exhaust the system’s guest account capacity. The root cause is an insufficient restriction on creating guest accounts, allowing an attacker to generate a large number of account...

CVE-2013-5531

Cisco Identity Services Engine (ISE) 1.x before 1.1.1 contains an authentication bypass vulnerability that allows remote attackers to bypass authentication and read the support-bundle configuration and credentials data via a crafted session on TCP port 443 (Bug CSCty20405). This is documented in ...

CVE-2013-5531

Cisco Identity Services Engine ISE 1.x before 1.1.1 allows remote attackers to bypass authentication, and read support-bundle configuration and credentials data, via a crafted session on TCP port 443, aka Bug ID CSCty20405...

Cisco Fixes DoS, Remote Code Execution Bugs in Six Products

Telecommunications company Cisco rolled out three patches for multiple products yesterday, addressing vulnerabilities that could’ve led to a denial of service DoS attack or allowed an attacker to execute code and obtain sensitive information. Per usual, Cisco’s Product Security Incident Respoinse...

Cisco ISE Support Information Download Authentication Bypass Vulnerability

A vulnerability in the implementation of the authentication code that is used to validate requests to download a product support bundle could allow an unauthenticated, remote attacker to download a full product support bundle. The vulnerability is due to an error in the logic that is used to...

Design/Logic Flaw

The upload-dialog implementation in Cisco Identity Services Engine ISE allows remote authenticated users to upload files with an arbitrary file type, and consequently conduct attacks against unspecified other systems, via a crafted file, aka Bug ID CSCui67511...

Design/Logic Flaw

The Sponsor Portal in Cisco Identity Services Engine ISE uses weak permissions for uploaded files, which allows remote attackers to read arbitrary files via a direct request, aka Bug ID CSCui67506...

CVE-2013-5541

CVE-2013-5541 concerns Cisco Identity Services Engine (ISE) and its file-upload filename handling. The issue is a cross-site scripting (XSS) vulnerability triggered by crafting a filename uploaded via the ISE web interface. Root cause per Cisco advisory is insufficient validation of uploaded file...

CVE-2013-5540

The file-upload feature in Cisco Identity Services Engine ISE allows remote authenticated users to cause a denial of service disk consumption and administration-interface outage by uploading many files, aka Bug ID CSCui67519...

CVE-2013-5539

The CVE-2013-5539 entry concerns Cisco Identity Services Engine (ISE). The vulnerability is located in the upload-dialog component, where remote authenticated users can upload files of arbitrary types due to insufficient validation/filtering. This could enable attackers to plant files that may be...

CVE-2013-5540

CVE-2013-5540 affects Cisco Identity Services Engine (ISE) file-upload management. The issue allows an authenticated remote attacker to upload multiple files, exhausting disk space and causing denial of service by making the administration interface unresponsive. Root cause is insufficient manage...

CVE-2013-5541

Cross-site scripting XSS vulnerability in the file-upload interface in Cisco Identity Services Engine ISE allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename, aka Bug ID CSCui67495...

CVE-2013-5538

CVE-2013-5538 affects Cisco Identity Services Engine (ISE) Sponsor Portal. The root cause is weak permissions on uploaded Sponsor Portal files, enabling an unauthenticated remote attacker to read arbitrary files via a direct URL. The Cisco advisory notes that updates are not available to fix this...

CVE-2013-5525

SQL injection vulnerability in the web framework in Cisco Identity Services Engine ISE 1.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCug90502...