Cisco IP Interoperability and Collaboration System Cross-Site Scripting Vulnerability

A vulnerability in the web framework code of the Cisco IP Interoperability and Collaboration System IPICS could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack. The vulnerability is due to insufficient input validation of some parameters passed to the web...

Cisco Web Security Appliance MIME Header Bypass Vulnerability

A vulnerability in the email message and content filtering for malformed Multipurpose Internet Mail Extensions MIME headers of Cisco AsyncOS Software for Cisco Email Security Appliances ESA and Web Security Appliances WSA could allow an unauthenticated, remote attacker to bypass the filtering...

Synology NAS servers contain insecure default credentials

Overview Synology NAS servers DS107, DS116, and DS213, use default credentials. Description CWE-255: Credentials Management - CVE-2016-6554Synology NAS servers DS107, firmware version 3.1-1639 and prior, and DS116, DS213, firmware versions prior to 5.2-5644-1, use non-random default credentials o...

Cisco Wide Area Application Services Central Manager Denial of Service Vulnerability

A vulnerability in the SSL session cache management of Cisco Wide Area Application Services WAAS could allow an unauthenticated, remote attacker to cause a denial of service DoS condition due to high consumption of disk space. The user would see a performance degradation. The vulnerability is due...

Cisco IOS XR Software Command-Line Interface Privilege Escalation Vulnerability

A vulnerability in the command-line interface CLI of IOS-XR series software could allow an authenticated, local attacker to execute arbitrary code on a targeted system at the root privilege level. The vulnerability is due to incorrect permissions given to a set of users. An attacker could exploit...

Cisco IOS Software for Cisco Catalyst 6500 Series Switches and 7600 Series Routers ACL Bypass Vulnerability

A vulnerability in the ternary content addressable memory TCAM share access control list ACL functionality of Cisco IOS Software running on Supervisor Engine 720 and Supervisor Engine 32 Modules for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers could allow an unauthenticated,...

Cisco Web Security Appliance HTTP Load Denial of Service Vulnerability

A vulnerability in HTTP request forwarding with Cisco AsyncOS for Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to cause a denial of service DoS condition due to link saturation. The vulnerability is due to how HTTP data ranges are downloaded from the destinatio...

Cisco Unified Computing System Command Line Interface Privilege Escalation Vulnerability

A vulnerability in the command-line interface CLI of the Cisco Unified Computing System UCS Manager and UCS 6200 Series Fabric Interconnects could allow an authenticated, local attacker to access the underlying operating system with the privileges of the root user. The vulnerability is due to...

Cisco Catalyst Switches Network Mobility Services Protocol Port Information Disclosure Vulnerability (cisco-sa-20160413-nms)

Cisco Catalyst Switches running Cisco IOS Software releases may allow an unauthenticated, remote attacker to retrieve version information about the software release running on the device by accessing the Network Mobility Services Protocol NMSP port. SPDX-FileCopyrightText: 2016 Greenbone AG Some...

Cisco IOS XE Software Border Gateway Protocol Message Processing DoS (cisco-sa-20160715-bgp)

The Cisco IOS XE Software running on the remote device is missing a security patch. It is, therefore, affected by a denial of service vulnerability in the Border Gateway Protocol BGP message processing functions due to improper processing of BGP attributes. An authenticated, remote attacker can...

Cisco Acknowledges ASA Zero Day Exposed by ShadowBrokers

Cisco has quickly provided a workaround for one of two vulnerabilities that was disclosed in the ShadowBrokers’ data dump and issued an advisory on the other, which was patched in 2011, in order to raise awareness among its customers. The networking giant today released advisories saying that it...

Possible XSS Vulnerability in Action View

There is a possible XSS vulnerability in Action View. Text declared as "HTML safe" will not have quotes escaped when used as attribute values in tag helpers. Impact ------ Text declared as "HTML safe" when passed as an attribute value to a tag helper will not have quotes escaped which can lead to...

Cisco Prime Infrastructure Cross-Frame Scripting Vulnerability

A vulnerability in the web interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to execute a cross-frame scripting XFS attack. This vulnerability is due to insufficient HTML iframe protection. An attacker could exploit this vulnerability by directing a user to a...

Cisco Videoscape Session Resource Manager Denial of Service Vulnerability

A vulnerability in system resource management in the Cisco Videoscape Session Resource Manager VSRM could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition because the device unexpectedly restarts. The vulnerability occurs because the VSRM is not installed usi...

Cisco IOS Software Border Gateway Protocol Message Processing Denial of Service Vulnerability (cisco-sa-20160715-bgp)

A vulnerability in Border Gateway Protocol BGP message processing functions of Cisco IOS Software could allow an authenticated, remote attacker to cause an affected device to reload. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and...

Medical Study Blasts Hospitals' Security Practices

A scathing rebuke of medical professionals’ attitudes toward information security reveals nurses and doctors fumble over protocols often putting patients at risk. The revealing study, “Workarounds to Computer Access in Healthcare Organizations PDF,” offers a fascinating look behind the privacy...

Cisco Firepower Management Center Persistent Cross-Site Scripting Vulnerability

A vulnerability in the HTTP framework of Cisco Firepower Management Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against an affected device. The vulnerability is due to insufficient filtering of output data. An attacker could exploit this...

Cisco IOS Software Link Layer Discovery Protocol Processing Code Denial of Service Vulnerability (cisco-sa-20160616-ios)

A vulnerability in the Link Layer Discovery Protocol LLDP packet processing code of Cisco IOS Software could allow an unauthenticated, adjacent attacker to cause an affected device to crash. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced...

KLA10832 Obsolete Adobe Flash Player for Windows

Microsoft released update to address vulnerabilities in Flash Player for Internet explorer. For details look at KLA10830. Technical details To mitigate this vulnerability you can implement some of workarounds listed in original Microsoft advisory: disable Adobe Flash Player, prevent Adobe FP from...

KLA10896 Obsolete Adobe Flash Player for Windows

Microsoft released update to address vulnerabilities in Flash Player for Internet Explorer & Edge. For details look at KLA10830. Technical details To mitigate this vulnerability you can implement some of workarounds listed in original Microsoft advisory: don’t click a link in an email message or...