CVE-2013-5541

CVE-2013-5541 concerns Cisco Identity Services Engine (ISE) and its file-upload filename handling. The issue is a cross-site scripting (XSS) vulnerability triggered by crafting a filename uploaded via the ISE web interface. Root cause per Cisco advisory is insufficient validation of uploaded file...

CVE-2013-5541

Cross-site scripting XSS vulnerability in the file-upload interface in Cisco Identity Services Engine ISE allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename, aka Bug ID CSCui67495...

CVE-2013-5539

The CVE-2013-5539 entry concerns Cisco Identity Services Engine (ISE). The vulnerability is located in the upload-dialog component, where remote authenticated users can upload files of arbitrary types due to insufficient validation/filtering. This could enable attackers to plant files that may be...

CVE-2013-5540

CVE-2013-5540 affects Cisco Identity Services Engine (ISE) file-upload management. The issue allows an authenticated remote attacker to upload multiple files, exhausting disk space and causing denial of service by making the administration interface unresponsive. Root cause is insufficient manage...

CVE-2013-5538

CVE-2013-5538 affects Cisco Identity Services Engine (ISE) Sponsor Portal. The root cause is weak permissions on uploaded Sponsor Portal files, enabling an unauthenticated remote attacker to read arbitrary files via a direct URL. The Cisco advisory notes that updates are not available to fix this...

CVE-2013-5524

Cross-site scripting XSS vulnerability in the troubleshooting page in Cisco Identity Services Engine ISE 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCug77655...

CVE-2013-5525

SQL injection vulnerability in the web framework in Cisco Identity Services Engine ISE 1.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCug90502...

Sql injection

SQL injection vulnerability in the web framework in Cisco Identity Services Engine ISE 1.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCug90502...

CVE-2013-5524

Cisco acknowledges CVE-2013-5524: an XSS vulnerability in the Cisco Identity Services Engine (ISE) troubleshooting page (ISE 1.2 and earlier). The issue allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter. Impact is cross-site scripting on the web interface...

CVE-2013-5525

SQL injection vulnerability in the web framework in Cisco Identity Services Engine ISE 1.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCug90502...

CVE-2013-5525

The available sources confirm CVE-2013-5525 affects Cisco Identity Services Engine (ISE) 1.2 and earlier, via a SQL injection in the web framework. A remote, authenticated attacker can execute arbitrary SQL through unspecified vectors by submitting crafted requests (e.g., crafted URLs). The root ...

CVE-2013-5523

CVE-2013-5523 concerns the Sponsor Portal of Cisco Identity Services Engine (ISE) 1.2 and earlier, where insufficient protection of IFRAME elements allows cross-frame scripting (XFS) and clickjacking via a user‑directed attacker page. The root cause is inadequate HTML iframe protection in the Spo...

CVE-2013-5504

Cross-site scripting XSS vulnerability in the Mobile Device Management MDM portal in Cisco Identity Services Engine ISE allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui30266...

CVE-2013-5505

Cisco SA-20131001-CVE-2013-5505 documents an unauthenticated, remote XSS vulnerability in the Cisco Identity Services Engine (ISE) administration page. The issue stems from insufficient input validation of a parameter, allowing an attacker to inject arbitrary web script or HTML via a malicious li...

CVE-2013-5504

The CVE-2013-5504 entry concerns Cisco Identity Services Engine (ISE) – specifically the Mobile Device Management (MDM) portal. Affected component: MDM portal input handling with insufficient input validation on an unspecified parameter, leading to cross-site scripting (XSS). Impact: remote attac...

CVE-2012-5744

The CVE-2012-5744 issue concerns multiple XSS vulnerabilities in the Cisco Identity Services Engine (ISE) guest portal. Connected sources specify that the flaw stems from improper input validation in the guest portal, enabling an unauthenticated or remote attacker to lure a user to a link and cau...

CVE-2012-5744

Multiple cross-site scripting XSS vulnerabilities in the guest portal in Cisco Identity Services Engine ISE Software allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug IDs CSCud11139 and CSCug02904...

Cisco ISE Guest Portal Cross-Site Scripting Vulnerability

A vulnerability in the guest portal of the Cisco Identity Services Engine ISE Software could allow an unauthenticated, remote attacker to send a malicious script to an unsuspecting user. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by...

CVE-2013-3471

The captive portal application in Cisco Identity Services Engine ISE allows remote attackers to discover cleartext usernames and passwords by leveraging unspecified use of hidden form fields in an HTML document, aka Bug ID CSCug02515...

CVE-2013-3471

CVE-2013-3471 concerns Cisco Identity Services Engine (ISE) – captive portal. The issue arises from improper use of hidden HTML form fields in the portal, enabling an attacker to discover cleartext usernames and passwords. The vulnerability can be exploited remotely by unauthenticated or minimall...