CVE-2017-6694

CVE-2017-6694 affects Cisco Ultra Services Platform's Virtual Network Function Manager (VNFM) logging function. A vulnerability allows an authenticated, local attacker to view sensitive data (cleartext credentials) on an affected system, via the VNFM logging interface. Affected release: 21.0.v0.6...

Cisco Ultra Services Platform Information Disclosure Vulnerability

A vulnerability in the ConfD server in Cisco Ultra Services Platform could allow an authenticated, local attacker to view sensitive information. The vulnerability is due to insufficient protection of sensitive files on the system. An attacker could exploit this vulnerability by logging in to the...

Cisco Ultra Services Platform Plaintext Credential Logging Information Disclosure Vulnerability

A vulnerability in the Virtual Network Function Manager's VNFM logging function of Cisco Ultra Services Platform could allow an authenticated, local attacker to view sensitive data on an affected system. The vulnerability is due to insufficient protection of sensitive data. An attacker could...

CVE-2016-2783

Avaya Fabric Connect Virtual Services Platform VSP Operating System Software VOSS before 4.2.3.0 and 5.x before 5.0.1.0 does not properly handle VLAN and I-SIS indexes, which allows remote attackers to obtain unauthorized access via crafted Ethernet frames...

Cisco Cloud Services Platform 2.x < 2.1.0 Multiple Vulnerabilities

According to its self-reported version number, the remote Cisco Cloud Services Platform CSP device is 2.x prior to 2.1.0. It is, therefore, affected by the following vulnerabilities : - A command injection vulnerability exists in the web-based GUI due to improper sanitization of user-supplied...

Cisco Cloud Services Platform Command Injection Vulnerability (CNVD-2016-08195)

Cisco Cloud Services Platform CSP is the U.S. Cisco Cisco company's set of hardware and software platforms for data center network function virtualization. A remote command injection vulnerability exists in Cisco CSP 2100 version 2.0. A remote attacker can exploit this vulnerability by sending a...

CVE-2016-6374

Cisco Cloud Services Platform CSP 2100 2.0 allows remote attackers to execute arbitrary code via a crafted dnslookup command in an HTTP request, aka Bug ID CSCuz89093...

CVE-2016-6373

The web-based GUI in Cisco Cloud Services Platform CSP 2100 2.0 allows remote authenticated administrators to execute arbitrary OS commands as root via crafted platform commands, aka Bug ID CSCva00541...

CVE-2016-6373

The web-based GUI in Cisco Cloud Services Platform CSP 2100 2.0 allows remote authenticated administrators to execute arbitrary OS commands as root via crafted platform commands, aka Bug ID CSCva00541...

Design/Logic Flaw

The web-based GUI in Cisco Cloud Services Platform CSP 2100 2.0 allows remote authenticated administrators to execute arbitrary OS commands as root via crafted platform commands, aka Bug ID CSCva00541...

Cisco Cloud Services Platform 2100 Command Injection Vulnerability

A vulnerability in the web-based GUI of the Cisco Cloud Services Platform 2100 could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system with the privileges of the root user. The vulnerability is due to insufficient sanitization of user-supplie...

Cisco Cloud Services Platform 2100 Remote Command Execution Vulnerability

A vulnerability in the web interface of Cisco Cloud Services Platform CSP 2100 could allow an unauthenticated, remote attacker to execute arbitrary code on a targeted system. The vulnerability is due to insufficient sanitization of specific values received as part of a user-supplied HTTP request...

Unauthorized Access Vulnerability in Multiple Avaya Products

Avaya Virtual Services Platform 8000 Series VSP 8000 and others are Ethernet switch products from Avaya, USA. An unauthorized access vulnerability exists in multiple Avaya products, which can be exploited by an attacker to gain access to affected devices...

WSO2 SOA Enablement Server for Java Cross-Site Scripting Vulnerability

WSO2 SOA Enablement Server for Java is a set of enterprise Web services platform of the U.S. WSO2 company . The platform supports the creation, publishing and use of Web services and other functions. A cross-site scripting vulnerability exists in WSO2 SOA Enablement Server for Java version 6.6...

CVE-2014-9209

Untrusted search path vulnerability in the Clean Utility application in Rockwell Automation FactoryTalk Services Platform before 2.71.00 and FactoryTalk View Studio 8.00.00 and earlier allows local users to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2014-9209

CVE-2014-9209 describes an Untrusted Search Path vulnerability in Rockwell Automation FactoryTalk components. A local user can gain privileges by loading a Trojan horse DLL via an unspecified directory in affected installations of FactoryTalk Services Platform before 2.71.00 and FactoryTalk View ...

Sierra Library Services Platform Multiple Vulnerability Disclosure

Product: Sierra Library Services Platform Vendor: Innovative Interfaces Inc Vulnerable Version: 1.23 Tested Version: 1.23 Vendor Notification: June 19, 2014 Public Disclosure: August 26, 2014 Vulnerability Type: Cross-Site Scripting CWE-79 CVE Reference: CVE-2014-5136 Risk Level: Medium CVSSv2 Ba...

CVE-2014-5136

Cross-site scripting XSS vulnerability in Innovative Interfaces Sierra Library Services Platform 1.23 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

Cross site request forgery (csrf)

Innovative Interfaces Sierra Library Services Platform 1.23 provides different responses for login request depending on whether the user account exists, which allows remote attackers to enumerate account names via a series of login requests, possibly related to the Webpac Pro submodule...

CVE-2014-5136

Sierra Library Services Platform (Product: Sierra LSP) v1.2_3 is affected by CVE-2014-5136, a reflected cross-site scripting (XSS) vulnerability. The issue arises from unsanitized data in application query parameters, allowing an attacker to inject arbitrary JavaScript in the victim’s browser via...