Cross site scripting

Cross-site scripting XSS vulnerability in the file-upload interface in Cisco Identity Services Engine ISE allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename, aka Bug ID CSCui67495...

Unrestricted file upload

The file-upload feature in Cisco Identity Services Engine ISE allows remote authenticated users to cause a denial of service disk consumption and administration-interface outage by uploading many files, aka Bug ID CSCui67519...

CVE-2013-5538

The Sponsor Portal in Cisco Identity Services Engine ISE uses weak permissions for uploaded files, which allows remote attackers to read arbitrary files via a direct request, aka Bug ID CSCui67506...

CVE-2013-5539

The upload-dialog implementation in Cisco Identity Services Engine ISE allows remote authenticated users to upload files with an arbitrary file type, and consequently conduct attacks against unspecified other systems, via a crafted file, aka Bug ID CSCui67511...

CVE-2013-5539

The CVE-2013-5539 entry concerns Cisco Identity Services Engine (ISE). The vulnerability is located in the upload-dialog component, where remote authenticated users can upload files of arbitrary types due to insufficient validation/filtering. This could enable attackers to plant files that may be...

CVE-2013-5538

CVE-2013-5538 affects Cisco Identity Services Engine (ISE) Sponsor Portal. The root cause is weak permissions on uploaded Sponsor Portal files, enabling an unauthenticated remote attacker to read arbitrary files via a direct URL. The Cisco advisory notes that updates are not available to fix this...

CVE-2013-5523

The Sponsor Portal in Cisco Identity Services Engine ISE 1.2 and earlier does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting XFS"...

Cross site scripting

The Sponsor Portal in Cisco Identity Services Engine ISE 1.2 and earlier does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting XFS"...

CVE-2013-5523

The Sponsor Portal in Cisco Identity Services Engine ISE 1.2 and earlier does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting XFS"...

CVE-2013-5524

Cross-site scripting XSS vulnerability in the troubleshooting page in Cisco Identity Services Engine ISE 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCug77655...

Cisco Identity Services Engine Troubleshooting Interface Cross-Site Scripting Vulnerability

A vulnerability in the troubleshooting page of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of the affected system. The vulnerability is due to insufficient input validation of...

Cisco Identity Services Engine Blind SQL Injection Vulnerability

A vulnerability in the web framework of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to impact the integrity and availability of the affected system by executing arbitrary SQL queries. The vulnerability is due to a failure to validate user-supplied input used i...

Cisco Identity Services Engine Administration Interface Cross-Site Scripting Vulnerability

A vulnerability in an administration page of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of the affected system. The vulnerability is due to insufficient input validation of a...

CVE-2013-5504

Cross-site scripting XSS vulnerability in the Mobile Device Management MDM portal in Cisco Identity Services Engine ISE allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui30266...

CVE-2013-5505

Cross-site scripting XSS vulnerability in an administration page in Cisco Identity Services Engine ISE allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui30275...

Cross site scripting

Cross-site scripting XSS vulnerability in the Mobile Device Management MDM portal in Cisco Identity Services Engine ISE allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui30266...

Cross site scripting

Cross-site scripting XSS vulnerability in an administration page in Cisco Identity Services Engine ISE allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui30275...

CVE-2013-5505

Cross-site scripting XSS vulnerability in an administration page in Cisco Identity Services Engine ISE allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui30275...

Cisco Identity Services Engine Mobile Device Management Portal Cross-Site Scripting Vulnerability

A vulnerability in the Mobile Device Management MDM portal of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of the affected system. The vulnerability is due to insufficient inpu...

Code injection

The PPTP-ALG component in CRS Carrier Grade Services Engine CGSE and ASR 9000 Integrated Service Module ISM in Cisco IOS XR allows remote attackers to cause a denial of service module reset via crafted packet streams, aka Bug ID CSCue91963...