CVE-2014-3358: Improper Neutralization of Special Elements used in an OS Command

Memory leak in Cisco IOS 15.0, 15.1, 15.2, and 15.4 and IOS XE 3.3.xSE before 3.3.2SE, 3.3.xXO before 3.3.1XO, 3.5.xE before 3.5.2E, and 3.11.xS before 3.11.1S allows remote attackers to cause a denial of service memory consumption, and interface queue wedge or device reload via malformed mDNS...

Cisco IOS Software DHCP Version 6 Denial of Service Vulnerability

A vulnerability in the DHCP version 6 DHCPv6 server implementation of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to improper parsing of malformed DHCPv6 packets. An attacker coul...

PT-2014-5252

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.4 and 15.0 through 15.4 Cisco IOS XE versions 3.1.xS through 3.7.xS before 3.7.6S Cisco IOS XE versions 3.8.xS, 3.9.xS, and 3.10.xS before 3.10.1S Cisco IOS XE version 3.11.xS before 3.12S Description A vulnerability in t...

PT-2014-5246

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.0, 12.2, 12.4, 15.0, 15.1, 15.2, and 15.3 Cisco IOS XE versions 2.x and 3.x before 3.7.4S Cisco IOS XE versions 3.2.xSE and 3.3.xSE before 3.3.2SE Cisco IOS XE versions 3.3.xSG and 3.4.xSG before 3.4.4SG Cisco IOS XE...

Cisco IOS XE Software EnergyWise DoS (cisco-sa-20140806-energywise

According to its self-reported version, the version of Cisco IOS XE running on the remote host is affected by a denial of service vulnerability in EnergyWise module. The issue exists due to improper handling of specially crafted EnergyWise packets. An unauthenticated, remote attacker could exploi...

Cisco IOS XE NTP Information Disclosure (CSCuj66318)

The remote Cisco device potentially contains an issue with the 'ntp access-group' which could allow a remote attacker to bypass the NTP access group and query an NTP server configured to deny-all requests. TRUSTED...

PT-2014-1134

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.2, 15.0, 15.1, 15.2, and 15.4 Cisco IOS XE versions 3.2.xXO, 3.3.xSG, 3.4.xSG, and 3.5.xE before 3.5.3E Description The issue is related to the EnergyWise module in Cisco IOS and Cisco IOS XE Software, which allows an...

Cisco EnergyWise Module Vulnerability

Cisco has released an advisory to address a vulnerability in the EnergyWise module of Cisco IOS and Cisco IOS XE Software. Exploitation of the vulnerability could allow an unauthenticated, remote attacker to cause a Denial of Service condition on the affected system. Users and administrators are...

Cisco IOS XE mDNS Manipulation (CSCun64867)

According to its self-reported version, the remote IOS XE device is affected by a manipulation vulnerability. A flaw exists due to unconstrained autonomic networking with mDNS multicast Domain Name System. This could allow a remote attacker to read or overwrite autonomic networking services...

Cisco IOS XE SNMP DoS (CSCug65204)

The remote Cisco device potentially contains an issue in the SNMP module which may allow remote authenticated users to cause a denial of service device reload via continuous SNMP polling requests. TRUSTED...

Cisco IOS XE DHCP AAA Clients DoS (CSCuh04949)

According to its self-reported version, the remote IOS device is affected by a denial of service vulnerability. A denial of service flaw exists in the DHCP function when handling AAA client IP address assignment. An authenticated attacker, with a specially crafted AAA packet, could cause the devi...

Cisco IOS Software and IOS XE Software NTP Access Group Vulnerability

A vulnerability in the implementation of the ntp access-group command in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass the configured Network Time Protocol NTP access group and query the affected NTP-configured server for the time. The...

CVE-2014-3309

Summary of CVE-2014-3309 (Cisco) : The NTP implementation in Cisco IOS and IOS XE is vulnerable due to improper handling of the ntp access-group command in a deny-all configuration, potentially allowing a remote attacker to bypass NTP access restrictions and query the NTP server configured to den...

CVE-2014-3309: Undefined Security Weakness

The NTP implementation in Cisco IOS and IOS XE does not properly support use of the access-group command for a "deny all" configuration, which allows remote attackers to bypass intended restrictions on time synchronization via a standard query, aka Bug ID CSCuj66318...

PT-2014-5204

Name of the Vulnerable Software and Affected Versions Cisco IOS and IOS XE affected versions not specified Description The issue is related to the improper implementation of the ntp access-group command in certain Cisco IOS Software and Cisco IOS XE Software versions. This allows an...

XIGLA Absolute Form Processor XE 1.5 'login.asp' SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/34463/info Absolute Form Processor XE is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker ...

Absolute Form Processor XE-V 1.5 - Remote Change Pasword Exploit

No description provided by source. title Absolute Form Processor XE-V 1.5 Remote Change Pasword /title body bgcolor=FFFFFF text=000000 form name=form1 method=post action=http://www.xigla.com/absolutefp/demo/edituser.asp table width=96% border=0 cellspacing=2 cellpadding=2 align=center tr...

Absolute Poll Manager XE 4.1 xlaapmview.asp Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/25492/info Absolute Poll Manager XE is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. Exploiting this vulnerability may allow an attacker to perform cross-site...

CVE-2014-3290

The mDNS implementation in Cisco IOS XE 3.12S does not properly interact with autonomic networking, which allows remote attackers to obtain sensitive networking-services information by sniffing the network or overwrite networking-services data via a crafted mDNS response, aka Bug ID CSCun64867...

Information disclosure

The mDNS implementation in Cisco IOS XE 3.12S does not properly interact with autonomic networking, which allows remote attackers to obtain sensitive networking-services information by sniffing the network or overwrite networking-services data via a crafted mDNS response, aka Bug ID CSCun64867...