CVE-2013-3471

The captive portal application in Cisco Identity Services Engine ISE allows remote attackers to discover cleartext usernames and passwords by leveraging unspecified use of hidden form fields in an HTML document, aka Bug ID CSCug02515...

CVE-2013-3471

CVE-2013-3471 concerns Cisco Identity Services Engine (ISE) – captive portal. The issue arises from improper use of hidden HTML form fields in the portal, enabling an attacker to discover cleartext usernames and passwords. The vulnerability can be exploited remotely by unauthenticated or minimall...

Cisco ISE Captive Portal Application Plaintext Credentials Exposure Vulnerability

A vulnerability in the captive portal application of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker or local, authenticated attacker to potentially gain access to the username and password of an authenticated session. The vulnerability is due to improper use of...

ASUS RT-AC66U ACSD Remote Root Buffer Overflow

!/usr/bin/env python import signal, struct from time import sleep from socket import from sys import exit, excinfo TitleASUS RT-AC66U Remote Root Shell Exploit - acsd param command Discovered and ReportedJune 2013 Discovered/Exploited ByJacob Holcomb/Gimppy and Jacob Thompson Security Analsyts @...

CVE-2013-3420

Cisco Identity Services Engine (ISE) is affected by CVE-2013-3420 via a CSRF flaw in the ISE web framework. The issue allows remote attackers to hijack the authentication of arbitrary users by exploiting insufficient CSRF protections, potentially executing arbitrary requests in the context of aut...

Cisco Identity Services Engine Software Administration Panel Cross-Site Scripting Vulnerability

A vulnerability in the search form of the Cisco ISE administration/monitoring panel could allow an unauthenticated, remote attacker to send a malicious script to an unsuspecting user. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by convincing...

Cross site scripting

Cross-site scripting XSS vulnerability in the search form in the administration/monitoring panel on the Cisco Identity Services Engine ISE allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCuh87036...

CVE-2013-3413

Cross-site scripting XSS vulnerability in the search form in the administration/monitoring panel on the Cisco Identity Services Engine ISE allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCuh87036...

CVE-2013-3413

Cisco Identity Services Engine (ISE) suffers a Cross-Site Scripting (XSS) vulnerability in the admin/monitoring panel search form (CVE-2013-3413). The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The advisory notes improper input validation and tha...

Code injection

The Cisco Network Admission Control NAC agent on Mac OS X does not verify the X.509 certificate of an Identity Services Engine ISE server during an SSL session, which allows man-in-the-middle attackers to spoof ISE servers via an arbitrary certificate, aka Bug ID CSCub24309...

CVE-2013-1124

The Cisco Network Admission Control NAC agent on Mac OS X does not verify the X.509 certificate of an Identity Services Engine ISE server during an SSL session, which allows man-in-the-middle attackers to spoof ISE servers via an arbitrary certificate, aka Bug ID CSCub24309...

CVE-2013-1125

The command-line interface in Cisco Identity Services Engine Software, Secure Access Control System ACS, Application Networking Manager ANM, Prime LAN Management Solution LMS, Prime Network Control System, Quad, Context Directory Agent, Prime Collaboration, Unified Provisioning Manager, and Netwo...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the ISE Administrator user interface aka the Apache Tomcat interface on Cisco Identity Services Engine ISE 3300 series appliances before 1.1.0.665 Cumulative Patch 1 allow remote attackers to hijack the authentication of administrators,...

CVE-2012-3908

Multiple cross-site request forgery CSRF vulnerabilities in the ISE Administrator user interface aka the Apache Tomcat interface on Cisco Identity Services Engine ISE 3300 series appliances before 1.1.0.665 Cumulative Patch 1 allow remote attackers to hijack the authentication of administrators,...

CVE-2012-3908

Cisco advisory CISCO-SA-20120920-CVE-2012-3908 describes CSRF vulnerabilities in the ISE Administrator UI (Tomcat-based) on Cisco Identity Services Engine 3300-series appliances prior to 1.1.0.665 Patch 1. An unauthenticated, remote attacker could trick an authorized user into following a malicio...

CVE-2011-3290

Cisco Identity Services Engine (ISE) prior to 1.0.4.MR2 is affected by CVE-2011-3290 due to default Oracle database credentials. The underlying cause is hard-coded/default credentials in the ISE database, enabling a remote attacker to modify configuration and perform administrative actions withou...