Cisco Jabber Guest Server Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Jabber Guest Server could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of the affected software. The vulnerability is due to insufficient...

Cisco IOS and IOS XE Software Autonomic Control Plane Channel Information Disclosure Vulnerability

A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to reset the Autonomic Control Plane ACP of an affected system and view ACP packets that are transferred in clear text within an affected system. T...

Cisco Ultra Services Framework AutoVNF Log File User Credential Information Disclosure Vulnerability

A vulnerability in the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to access administrative credentials for Cisco Elastic Services Controller ESC and Cisco OpenStack deployments in an affected system. The vulnerability exists because the...

Vulnerability in Samba Affecting Cisco Products: May 2017

On May 24, 2017, the Samba team disclosed a vulnerability in Samba server software that could allow an authenticated attacker to execute arbitrary code remotely on a targeted system. This vulnerability has been assigned CVE ID CVE-2017-7494 This advisory is available at the following link:...

Cisco CVR100W Wireless-N VPN Router Universal Plug-and-Play Buffer Overflow Vulnerability

A vulnerability in the Universal Plug-and-Play UPnP implementation in the Cisco CVR100W Wireless-N VPN Router could allow an unauthenticated, Layer 2–adjacent attacker to execute arbitrary code or cause a denial of service DoS condition. The remote code execution could occur with root privileges...

Cisco IOS and IOS XE Software Simple Network Management Protocol Subsystem Denial of Service Vulnerability

A vulnerability in the Simple Network Management Protocol SNMP subsystem of Cisco IOS and IOS XE Software could allow an authenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to a race condition that could occur when the affected software processes an...

Cisco Prime Infrastructure Web Framework Code Cross-Site Scripting Vulnerability

A vulnerability in the web framework code of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of the affected system. The vulnerability is due to insufficient input validation of some...

Cisco UCS Manager, Cisco Firepower 4100 Series NGFW, and Cisco Firepower 9300 Security Appliance CLI Command Injection Vulnerability

A vulnerability in the CLI of the Cisco Unified Computing System UCS Manager, Cisco Firepower 4100 Series Next-Generation Firewall NGFW, and Cisco Firepower 9300 Security Appliance could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to...

Cisco NetFlow Generation Appliance Stream Control Transmission Protocol Denial of Service Vulnerability

A vulnerability in the Stream Control Transmission Protocol SCTP decoder of the Cisco NetFlow Generation Appliance NGA could allow an unauthenticated, remote attacker to cause the device to hang or unexpectedly reload, causing a denial of service DoS condition. The vulnerability is due to...

Cisco Unified Communications Manager Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Communications Manager Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due ...

Cisco Firepower Management Center and Cisco FireSIGHT System Software Malicious Software Detection Bypass Vulnerability

A vulnerability in the malicious file detection and blocking features of Cisco Firepower Management Center and Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass malware detection mechanisms on an affected system. The vulnerability is due to the incorrect...

Cisco Emergency Responder Directory Traversal Vulnerability

A vulnerability in the File Management Utility, the Download File form, and the Serviceability application of Cisco Emergency Responder could allow an authenticated, remote attacker to access files in arbitrary locations on the file system of an affected device. The issue is due to improper...

Cisco Wide Area Application Services Central Manager Denial of Service Vulnerability

A vulnerability in the SSL session cache management of Cisco Wide Area Application Services WAAS could allow an unauthenticated, remote attacker to cause a denial of service DoS condition due to high consumption of disk space. The user would see a performance degradation. The vulnerability is due...

Cisco Unified Intelligence Center (CUIC) Software Cross-Site Scripting Vulnerability

A vulnerability in the HTTP web-based management interface of Cisco Unified Intelligence Center CUIC Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of the affected system. The vulnerability is due to...

Cisco Prime Infrastructure and Evolved Programmable Network Manager Authentication Bypass API Vulnerability

A vulnerability in the application programming interface API of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager EPNM could allow an unauthenticated, remote attacker to access and control the API resources. The vulnerability is due to improper input validation of HTTP...

Cisco cBR-8 Series Converged Broadband Router SNMP Denial of Service Vulnerability

A vulnerability in the Simple Network Management Protocol SNMP subsystem of Cisco IOS XE Software running on Cisco cBR-8 Series Converged Broadband Routers could allow an authenticated, remote attacker to cause a denial of service DoS condition. The vulnerability exists because the affected...

Cisco Identity Services Engine Active Directory Integration Component Remote Denial of Service Vulnerability

A vulnerability in the Active Directory integration component of Cisco Identity Service Engine ISE could allow an unauthenticated, remote attacker to perform a denial of service attack. The vulnerability is due to improper handling of password authentication protocol PAP authentication requests...

Cisco Prime Infrastructure Log File Remote Code Execution Vulnerability

A vulnerability in the log file handling for Cisco Prime Infrastructure could allow an authenticated, remote attacker to change and modify the system log file. The log file could have executable code added to it that could be executed when the log file is viewed. The vulnerability is due to lack ...

Cisco Universal Small Cell Devices Unauthorized Firmware Retrieval Vulnerability

A vulnerability in Cisco Universal Small Cell devices could allow an unauthenticated, remote attacker to retrieve firmware from a Cisco-hosted binary server. The vulnerability is due to insufficient enforcement of the two-way certificate validation process by the Cisco-hosted binary server to...

Cisco Application Policy Infrastructure Controller Access Control Vulnerability

A vulnerability in the role-based access control RBAC of the Cisco Application Policy Infrastructure Controller APIC could allow an authenticated remote user to make configuration changes outside of their configured access privileges. The vulnerability is due to eligibility logic in the RBAC...

Cisco Small Business 500 Series Switches Denial of Service Vulnerability

A vulnerability in the web-based GUI of the Cisco Small Business 500 Series Stackable Managed Switches could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient handling of HTTP requests. An attacker...

Cisco Firepower 9000 Persistent Cross-Site Scripting Vulnerability

A vulnerability in the HTTP web-based management interface of Cisco Firepower 9000 devices could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the affected system. The vulnerability is due to insufficient input validation of a user-suppli...

Cisco Email Security Appliance Email Scanner Denial of Service Vulnerability

A vulnerability in the email message filtering feature of Cisco AsyncOS for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to cause an ESA device to become unavailable due to a denial of service DoS condition. The vulnerability is due to improper input validati...

Cisco ASR 5500 SAE Gateway BGP Denial of Service Vulnerability

A vulnerability in the Border Gateway Protocol BGP input packet handler in the Cisco ASR 5500 System Architecture Evolution SAE Gateway could allow an unauthenticated, remote attacker to cause a partial denial of service DoS condition because the BGP process restarts unexpectedly. The vulnerabili...

Cisco Unified Communications Domain Manager URI Enumeration Vulnerability

A vulnerability in Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to map a file system structure. The vulnerability is due to different handling of existent and nonexistent paths. An attacker could exploit this vulnerability by enumerating all possible...

Cisco ASA CX Context-Aware Security Web GUI Unauthorized Access Vulnerability

A vulnerability in the web-based GUI of Cisco Adaptive Security Appliance ASA CX Context-Aware Security could allow an authenticated, remote attacker to enumerate users and read user information without belonging to a role that allows those operations. The vulnerability is due to insufficient...

Cisco TelePresence Video Communication Server Expressway Command Injection Vulnerability

A vulnerability in a local file script in Cisco TelePresence Video Communication Server VCS Expressway could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with elevated privilege. The vulnerability is due to insufficient protection of a...

Cisco Aggregation Services Router ASR 5000 and ASR 5500 OSPF Denial of Service Vulnerability

A vulnerability in the Open Shortest Path First OSPF protocol implementation of the Cisco Aggregation Services Router ASR 5000 and ASR 5500 System Software could allow an unauthenticated, remote attacker to cause a partial denial of service DoS condition because the OSPF process restarts. The...

Cisco TelePresence Video Communication Server Expressway Access Vulnerability

A vulnerability in the Password Change functionality in the Administrative Web Interface of the Cisco TelePresence Video Communication Server VCS Expressway could allow an authenticated, remote attacker to make unauthorized changes to user passwords. The vulnerability is due to insufficient...

Cisco TelePresence Video Communication Server Expressway Access Vulnerability

A vulnerability in of the Cisco TelePresence Video Communication Server VCS Expressway could allow an authenticated, remote attacker to falsely register their Mobile and Remote Access MRA endpoint. The vulnerability is due to insufficient validation of the registering phone line. An attacker coul...

Cisco AnyConnect Secure Mobilty Client Directory Traversal Vulnerability

A vulnerability in the connection establishment process of Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, remote attacker to write or overwrite files in the active user's context. The vulnerability is due to insufficient input validation. An unauthenticated, remote attack...

Cisco AnyConnect Secure Mobility Client Local Denial of Service Vulnerability

A vulnerability in the kernel extension for Mac OS X of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker to cause a denial of service DoS condition. The vulnerability is due to insufficient bounds checking. An attacker could exploit this vulnerability by crafti...

Cisco Packet Data Network Gateway IP Stack Denial of Service Vulnerability

A vulnerability in the IP stack of the Cisco Packet Data Network Gateway PGW could allow an unauthenticated, remote attacker to cause a partial denial of service DoS of the Session Manager service when a malformed IP packet is received. The vulnerability is due to improper input validation of...

Cisco Unified Communications Manager ccmivr Page Cross-Site Scripting Vulnerability

A vulnerability in several parameters of the ccmivr page of Cisco Unified Communications Manager, formerly known as CallManager, could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface on an affected system. The vulnerabilit...

Cisco Adaptive Security Appliance SNMP Denial of Service Vulnerability

A vulnerability in the Simple Network Management Protocol SNMP code of Cisco Adaptive Security Appliance ASA Software could allow an authenticated, remote attacker to cause a reload of the affected system. The vulnerability is due to improper handling of SNMP packets. An attacker could exploit th...

Cisco Jabber for Windows Web-Based User Interface Information Disclosure Vulnerability

A vulnerability in the web-based user interface of Cisco Jabber for Windows could allow an unauthenticated, remote attacker to have read access to information stored in the affected system. The vulnerability is due to insufficient validation of specific values passed via HTTP GET methods by the...

Cisco IOS Voice Gateway Malformed ISDN Q931 Message Denial of Service Vulnerability

A vulnerability in the Integrated Services Digital Network ISDN processing code of Cisco IOS could allow an unauthenticated, adjacent attacker to cause a reload of the affected device. The vulnerability is due to improper processing of malformed ISDN Q931 SETUP messages. An attacker could exploit...

Cisco Wireless LAN Controller Web Administration Interface Authenticated Remote Denial of Service Vulnerability

A vulnerability in the web administration interface of Cisco Wireless LAN Controllers WLC could allow an authenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper validation of certain parameters submitted as part of form...

Cisco Unified Communications Domain Manager Application Software Information Disclosure Vulnerability

A vulnerability in Cisco Unified Communications Domain Manager Application Software could allow an authenticated, remote attacker to gain access to sensitive information. The vulnerability is due to unspecified condition within the affected software that could allow local file inclusion. An...

Cisco Unified Communications Domain Manager Application Software Remote Code Execution Vulnerability

A vulnerability in a deprecated page in Cisco Unified Communications Domain Manager Application Software could allow an authenticated, remote attacker to execute arbitrary code. The vulnerability is due to insufficient security restrictions imposed by the affected software that could allow...

Cisco NX-OS Software DHCP Options Command Injection Vulnerability

A vulnerability in DHCP code used with PowerOn Auto Provisioning POAP of Cisco NX-OS could allow an unauthenticated, adjacent attacker to inject arbitrary commands into the Cisco NX-OS device. The vulnerability is due to insufficient input validation of the DHCP options returned as a result of...

Cisco IOS Software and IOS XE Software mDNS Gateway Denial of Service Vulnerability

A vulnerability in the multicast DNS mDNS gateway function of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to reload the vulnerable device. The vulnerability is due to improper validation of mDNS packets. An attacker could exploit this vulnerability...

Multiple Vulnerabilities in Cisco TelePresence Video Communication Server, Cisco Expressway, and Cisco TelePresence Conductor

Cisco TelePresence Video Communication Server VCS, Cisco Expressway and Cisco TelePresence Conductor contain the following vulnerabilities: SDP Media Description Denial of Service Vulnerability Authentication Bypass Vulnerability Successful exploitation of the SDP Media Description Denial of...

Cisco UCS C-Series Integrated Management Controller Denial of Service Vulnerability

A vulnerability in the Cisco Integrated Management Controller IMC of Cisco Unified Computing System UCS C-Series Servers could allow an unauthenticated, adjacent attacker to access specific controls on the Cisco IMC on an affected device. The vulnerability is due to insufficient input validation...

Cisco Prime Infrastructure Cross-Site Request Forgery Vulnerability

A vulnerability in the INSERT page of Cisco Prime Infrastructure PI could allow an unauthenticated, remote attacker to perform a cross-site request forgery CSRF attack against the Cisco PI web interface. The vulnerability is due to insufficient CSRF protections on the Cisco PI web interface. An...

Cisco WebEx Meetings Server Password Encryption Vulnerability

A vulnerability in the OutlookAction LI of Cisco WebEx Meetings Server could allow an authenticated, remote attacker to generate sensitive encrypted values. The vulnerability is due to the return of a user's encrypted password. An attacker could exploit this vulnerability by generating these...

Cisco Jabber Guest Server HTML5 Information Disclosure Vulnerability

A vulnerability in the underlying application programming interface API of the Cisco Jabber Guest Server could allow an unauthenticated, remote attacker to access sensitive system information from the affected system. The vulnerability is due to insufficient validation of specific values passed v...

Cisco Unified Communications Manager Reports Interface Reflected Cross-Site Scripting Vulnerability

A vulnerability in the CCM reports interface of the Cisco Unified Communications Manager Server contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of the affected system. The vulnerabilit...

Cisco TelePresence System Directory Information Disclosure Vulnerability

A vulnerability in the code retrieving directory information of Cisco TelePresence System CTS could allow an unauthenticated, remote attacker to intercept and read the content of a directory transferred between the CTS and the Cisco Unified Communications Manager Cisco UCM. The vulnerability is d...

Cisco Unified Communications Manager IPMA Cross-Site Scripting Vulnerability

A vulnerability in the Cisco IP Manager Assistant IPMA interface of Cisco Unified Communications Manager UCM could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface on the affected system. The vulnerability is due to...