CVE-2014-3345

The web framework in Cisco Transport Gateway for Smart Call Home aka TG-SCH or Transport Gateway Installation Software 4.0 does not properly check authorization for administrative web pages, which allows remote attackers to modify the product via a crafted URL, aka Bug ID CSCuq31503...

CVE-2014-3345

The web framework in Cisco Transport Gateway for Smart Call Home aka TG-SCH or Transport Gateway Installation Software 4.0 does not properly check authorization for administrative web pages, which allows remote attackers to modify the product via a crafted URL, aka Bug ID CSCuq31503...

Cisco Transport Gateway for Smart Call Home Unauthorized Configuration Change Vulnerability

A vulnerability in the web framework code of Cisco Transport Gateway for Smart Call Home TG-SCH could allow an unauthenticated, remote attacker to make certain changes to the system. The vulnerability is due to improper implementation of authorization controls when accessing certain administrativ...

PT-2014-5237

Name of the Vulnerable Software and Affected Versions Cisco Transport Gateway for Smart Call Home version 4.0 Description The issue concerns the web framework in the Cisco Transport Gateway for Smart Call Home, which fails to properly check authorization for administrative web pages. This allows...

CVE-2014-3345: Undefined Security Weakness

The web framework in Cisco Transport Gateway for Smart Call Home aka TG-SCH or Transport Gateway Installation Software 4.0 does not properly check authorization for administrative web pages, which allows remote attackers to modify the product via a crafted URL, aka Bug ID CSCuq31503...

CVE-2014-3344: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the web framework in Cisco Transport Gateway for Smart Call Home aka TG-SCH or Transport Gateway Installation Software 4.0 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCuq31129,...

Multiple Cross-Site Scripting Vulnerabilities in Transport Gateway for Smart Call Home

A vulnerability in the web framework of Cisco Transport Gateway for Smart Call Home TG-SCH could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of the affected system. The vulnerability is due to insufficient input...

CVE-2014-3336

SQL injection vulnerability in the web framework in Cisco Unity Connection 9.12 and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted request, aka Bug ID CSCuq31016...

CVE-2014-3336: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the web framework in Cisco Unity Connection 9.12 and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted request, aka Bug ID CSCuq31016...

Cisco WebEx Meetings Server Web Framework Vulnerability

A vulnerability in the web framework of Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to view sensitive information. The vulnerability occurs because sensitive information is passed in a query string. An attacker could exploit this vulnerability by viewing applicatio...

Code injection

The web framework in Cisco WebEx Meetings Server does not properly restrict the content of query strings, which allows remote attackers to obtain sensitive information by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser history, aka Bug ID CSCuj81713...

CVE-2014-3303

The Cisco WebEx Meetings Server vulnerability CVE-2014-3303 affects the web framework component, where sensitive data can be exposed via query strings. An unauthenticated, remote attacker could view information such as contents of web-server access logs, Referer logs, or browser history by crafti...

PT-2014-5198

Name of the Vulnerable Software and Affected Versions Cisco WebEx Meetings Server affected versions not specified Description The issue concerns the web framework in Cisco WebEx Meetings Server, which fails to properly restrict the content of query strings. This allows remote attackers to obtain...

Sql injection

SQL injection vulnerability in the web framework in Cisco Security Manager 4.5 and 4.6 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCup26957...

CVE-2014-3305

CVE-2014-3305 concerns a CSRF vulnerability in the Cisco WebEx Meetings Server web framework (affecting 1.5(.1.131) and earlier). The issue allows remote attackers to hijack the authentication of unspecified victims via unknown vectors (Bug ID CSCuj81735). The core impact is that user sessions co...

CVE-2014-3326

CVE-2014-3326 affects Cisco Security Manager 4.5 and 4.6. The issue is an SQL injection in the web framework caused by insufficient controls on SQL statements, allowing an authenticated remote attacker to execute arbitrary SQL commands via unspecified vectors. The vulnerability can lead to exposu...

PT-2014-5200

Name of the Vulnerable Software and Affected Versions Cisco WebEx Meetings Server version 1.5.1.131 and earlier Description A cross-site request forgery CSRF issue in the web framework allows remote attackers to hijack the authentication of victims via unknown vectors. Recommendations For Cisco...

PT-2014-5220

Name of the Vulnerable Software and Affected Versions Cisco Security Manager versions 4.5 through 4.6 Description A SQL injection issue in the web framework of Cisco Security Manager allows remote authenticated users to execute arbitrary SQL commands. Recommendations For Cisco Security Manager...

Cisco WebEx Meetings Server Cross-Site Request Forgery Vulnerability

A vulnerability in the web framework code of Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to perform a cross-site request forgery CSRF attack. The vulnerability is due to insufficient CSRF protections. An attacker could exploit this vulnerability by convincing the...

Cisco Security Manager SQL Injection Vulnerability

A vulnerability in the web framework code of Cisco Security Manager could allow an authenticated, remote attacker to execute arbitrary queries on the database. The vulnerability is due to insufficient controls on Structured Query Language SQL statements. An attacker could exploit this vulnerabili...