CVE-2017-14920: Improper Neutralization of Input During Web Page Generation

Stored XSS vulnerability in eGroupware Community Edition before 16.1.20170922 allows an unauthenticated remote attacker to inject JavaScript via the User-Agent HTTP header, which is mishandled during rendering by the application administrator...

PT-2017-13639

Name of the Vulnerable Software and Affected Versions DenyAll WAF versions 5.5.0 through 5.5.12 DenyAll WAF version 5.6 DenyAll WAF version 5.7 DenyAll WAF versions 6.x before 6.4.1 Description The issue allows unauthenticated remote attackers to obtain authentication information by making a...

CVE-2017-6776: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web framework of Cisco Elastic Services Controller ESC could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface. The vulnerability is due to insufficient validation of user-supplied input by the affecte...

CVE-2017-6755: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web portal of the Cisco Prime Collaboration Provisioning PCP Tool could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of an affected system. More Information: CSCvc90312. Known Affected Releases:...

CVE-2017-6632: Uncontrolled Resource Consumption

A vulnerability in the logging configuration of Secure Sockets Layer SSL policies for Cisco FirePOWER System Software 5.3.0 through 6.2.2 could allow an unauthenticated, remote attacker to cause a denial of service DoS condition due to high consumption of system resources. The vulnerability is du...

CVE-2017-8338: Uncontrolled Resource Consumption

A vulnerability in MikroTik Version 6.38.5 could allow an unauthenticated remote attacker to exhaust all available CPU via a flood of UDP packets on port 500 used for L2TP over IPsec, preventing the affected router from accepting new connections; all devices will be disconnected from the router a...

CVE-2017-3499: Undefined Security Weakness

Vulnerability in the Oracle Social Network component of Oracle Fusion Middleware subcomponent: Android Client. The supported version that is affected is prior to 11.1.12.0.0 17019101. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTPS to compromise...

CVE-2017-3885: Uncontrolled Resource Consumption

A vulnerability in the detection engine reassembly of Secure Sockets Layer SSL packets for Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition because the Snort process consumes a high level of CPU resources. Affected Products...

CVE-2017-6604: URL Redirection to Untrusted Site

A vulnerability in the web interface of Cisco Integrated Management Controller IMC Software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability affects the following Cisco products running Cisco IMC Software: Unified Computing System UCS...

CVE-2016-8019: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in attributes in Intel Security VirusScan Enterprise Linux VSEL 2.0.3 and earlier allows unauthenticated remote attackers to inject arbitrary web script or HTML via a crafted user input...

CVE-2017-3839: Improper Restriction of XML External Entity Reference

An XML External Entity vulnerability in the web-based user interface of the Cisco Secure Access Control System ACS could allow an unauthenticated, remote attacker to have read access to part of the information stored in the affected system. More Information: CSCvc04845. Known Affected Releases:...

CVE-2017-3845: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. Affected Products: Cisco Prime...

CVE-2017-3838: Improper Neutralization of Input During Web Page Generation

A vulnerability in Cisco Secure Access Control System ACS could allow an unauthenticated, remote attacker to conduct a DOM-based cross-site scripting XSS attack against the user of the web interface of the affected system. More Information: CSCvc04838. Known Affected Releases: 5.82.5...

CVE-2017-3841: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability in the web interface of the Cisco Secure Access Control System ACS could allow an unauthenticated, remote attacker to disclose sensitive information. More Information: CSCvc04854. Known Affected Releases: 5.82.5...

CVE-2017-3800: Improper Input Validation

A vulnerability in the content scanning engine of Cisco AsyncOS Software for Cisco Email Security Appliances ESA could allow an unauthenticated, remote attacker to bypass configured message or content filters on the device. Affected Products: This vulnerability affects all releases prior to the...

CVE-2016-9223: Undefined Security Weakness

A vulnerability in the Docker Engine configuration of Cisco CloudCenter Orchestrator CCO; formerly CliQr could allow an unauthenticated, remote attacker to install Docker containers with high privileges on the affected system. Affected Products: This vulnerability affect all releases of Cisco...

CVE-2016-6468: Cross-Site Request Forgery (CSRF)

A vulnerability in the web-based management interface of Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. More Information: CSCvb06663. Known Affected Releases:...

CVE-2016-6458: Improper Input Validation

A vulnerability in the content filtering functionality of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an unauthenticated, remote attacker to bypass content filters configured on an affected device. Email that should have been filtered could instead be forwarded by the...

CVE-2016-6455

A vulnerability in the Slowpath of StarOS for Cisco ASR 5500 Series routers with Data Processing Card 2 DPC2 could allow an unauthenticated, remote attacker to cause a subset of the subscriber sessions to be disconnected, resulting in a partial denial of service DoS condition. This vulnerability...

CVE-2016-6452: Improper Authentication

A vulnerability in the web-based graphical user interface GUI of Cisco Prime Home could allow an unauthenticated, remote attacker to bypass authentication. The attacker could be granted full administrator privileges. Cisco Prime Home versions 5.1.1.6 and earlier and 5.2.2.2 and earlier have been...