CVE-2015-6266

CVE-2015-6266 affects Cisco Identity Services Engine (ISE) guest portal, where the portal does not restrict access to uploaded HTML documents. The underlying issue is lack of access control for customized HTML files, allowing remote attackers to retrieve sensitive information by requesting the fi...

Cisco Identity Services Engine Guest Portal Unauthorized Access Vulnerability

A vulnerability in the Cisco Identity Services Engine ISE guest portal could allow an unauthenticated, remote attacker to view a customized page on the guest portal. The vulnerability is due to lack of access control for the uploaded HTML files. An attacker could exploit this vulnerability by...

Cisco Identity Services Engine Cross-Site Scripting Attack Vulnerability

Cisco Identity Services Engine A centralized policy engine for Cisco TrustSec solutions. A security vulnerability exists in the Cisco Identity Services Engine that could be exploited by a remote attacker to conduct a cross-site scripting attack that could obtain sensitive information about the...

Cross site scripting

The web interface in Cisco Identity Services Engine ISE 1.14.1, 1.3106.146, and 1.3120.135 does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame...

CVE-2015-4266

The web interface in Cisco Identity Services Engine ISE 1.14.1, 1.3106.146, and 1.3120.135 does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame...

Multiple Cross-Site Scripting Vulnerabilities in Cisco Identity Services Engine (CNVD-2015-04709)

Cisco Identity Services Engine A centralized policy engine for Cisco TrustSec solutions. A cross-site scripting vulnerability exists in the Cisco Identity Services Engine, which could be exploited by remote attackers to inject malicious script or HTML code that, when viewed with malicious data,...

Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability

Cisco Identity Services Engine A centralized policy engine for Cisco TrustSec solutions. A cross-site request forgery vulnerability exists in the Cisco Identity Services Engine, which allows remote attackers to construct malicious URIs, trick users into resolving them, and perform malicious actio...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the web framework in Cisco Identity Services Engine ISE 1.20.793, 1.30.876, 1.40.109, 2.00.147, and 2.00.169 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus09940...

Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability

A vulnerability in the web framework of Cisco Identity Services Engine could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against the user of the web interface. The vulnerability is due to insufficient CSRF protections. An attacker could exploit th...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Infra Admin UI in Cisco Identity Services Engine ISE 1.21.198 and 1.30.876 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a 1 GET or 2 POST request, aka Bug ID CSCus16052...

CVE-2015-4268

Cisco Identity Services Engine (ISE) Infra Admin UI is affected by CVE-2015-4268, with XSS vulnerabilities in ISE versions 1.2(1.198) and 1.3(0.876). The root cause is insufficient input validation of certain HTTP GET/POST parameters, enabling remote attackers to inject arbitrary web script or HT...

Cisco Identity Services Engine Cross-Frame Scripting Vulnerability

A vulnerability in the web interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to execute a cross-frame scripting XFS attack. This vulnerability is due to insufficient HTML iframe protection. An attacker could exploit this vulnerability by directing a...

Cisco Mobility Services Engine Control And Provisioning Feature Information Disclosure Vulnerability

Cisco Mobility Services Engine MSE is a platform Mobility Services Engine that provides Wi-Fi services from Cisco. The platform collects, stores and manages data from wireless clients, Cisco access points and controllers. A security vulnerability exists in the Control And Provisioning feature of...

Cisco Identity Services Engine Cross-Site Scripting Vulnerability

A vulnerability in the Cisco Identity Services Engine ISE Infra Admin UI could allow an unauthenticated, remote attacker to perform a cross-site scripting XSS attack. The vulnerability is due to insufficient input validation of some parameters passed via HTTP GET or POST methods. An attacker coul...

Design/Logic Flaw

The Control and Provisioning functionality in Cisco Mobility Services Engine MSE 10.00.1 allows remote authenticated users to obtain sensitive information by reading log files, aka Bug ID CSCut36851...

Cisco Mobility Services Engine Control And Provisioning Information Disclosure Vulnerability

A vulnerability in the Control And Provisioning of the Cisco Mobility Services Engine MSE could allow an authenticated, remote attacker to have read access to sensitive information stored on an affected system. The vulnerability is due to the inclusion of sensitive information in certain log file...

Cisco Secure Access Control System and Cisco Identity Services Engine Information Disclosure Vulnerability

Cisco Secure Access Control System and Cisco Identity Services Engine are both products of the United States Cisco Cisco. The former is a set of secure access control system. The latter is an identity-based environment-aware platform ISE Identity Services Engine. A security vulnerability exists i...

Improper access control

Cisco Secure Access Control System before 5.40.46.2 and 5.5 before 5.50.46 and Cisco Identity Services Engine 1.04.573 do not properly implement access control for support bundles, which allows remote authenticated users to obtain sensitive information via brute-force attempts to send valid...

CVE-2015-4219

The CVE-2015-4219 issue affects Cisco Secure Access Control System and Cisco Identity Services Engine. The root cause is improper access control for support bundles, allowing an authenticated remote attacker to brute-force credentials and download the bundle contents, potentially leading to infor...

Cisco Identity Services Engine and Secure Access Control System Support Bundle Download Vulnerability

A vulnerability in Cisco Identity Services Engine and Secure Access Control System could allow an authenticated, remote attacker to gain unauthorized access to program data. The vulnerability is due to weak authentication and authorization used to control access to support bundles stored on a...