Cisco Unified Intelligence Center (CUIC) Software Cross-Site Scripting Vulnerability

A vulnerability in the HTTP web-based management interface of Cisco Unified Intelligence Center CUIC Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of the affected system. The vulnerability is due to...

Cisco Firepower Management Center and FireSIGHT System Software Cross-Site Request Forgery Vulnerability

A cross-site request forgery CSRF vulnerability for Cisco Firepower Management Center and Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to execute unwanted actions. The vulnerability is due to a lack of CSRF protections by an affected device. An attacker could...

Cisco Smart Call Home Transport Gateway Cross-Site Scripting Vulnerability

A vulnerability in the web framework of the Cisco Smart Call Home Transport Gateway could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack. The vulnerability is due to insufficient input validation of a user-supplied value. An attacker could exploit this...

Cisco IOS and IOS XE Software Crafted Network Time Protocol Packets Denial of Service Vulnerability

A vulnerability in the processing of Network Time Protocol NTP packets by Cisco IOS and Cisco IOS XE could allow an unauthenticated, remote attacker to cause an interface wedge and an eventual denial of service DoS condition on the affected device. The vulnerability is due to insufficient checks ...

Cisco Unified Communications Manager IM and Presence Service SIP Packet Processing Denial of Service Vulnerability

A vulnerability in Session Initiation Protocol SIP processing functions of the Cisco Unified Communications Manager Instant Messaging IM and Presence Service could allow an unauthenticated, remote attacker to cause the Cisco SIP Proxy Daemon sipd process to restart unexpectedly, resulting in a...

Cisco Nexus 1000v Application Virtual Switch Cisco Discovery Protocol Packet Processing Denial of Service Vulnerability

A vulnerability in Cisco Discovery Protocol packet processing for the Cisco Nexus 1000v Application Virtual Switch AVS could allow an unauthenticated, remote attacker to cause the ESXi hypervisor to crash and display a purple diagnostic screen, resulting in a denial of service DoS condition. The...

Cisco WebEx Meetings Server Administrator Interface SQL Injection Vulnerability

A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries. The vulnerability is due to a lack of input validation on user-supplied input in SQL queries. An attacker could exploit this...

Cisco Adaptive Security Appliance with FirePOWER Services Kernel Logging Denial of Service Vulnerability

A vulnerability in the kernel logging configuration for Firepower System Software for the Adaptive Security Appliance ASA 5585-X FirePOWER Security Services Processor SSP module could allow an unauthenticated, remote attacker to cause a denial of service DoS condition due to high consumption of...

Cisco Prime Infrastructure and Evolved Programmable Network Manager Privilege Escalation API Vulnerability

A vulnerability in the web application programming interface API of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager EPNM could allow an authenticated, remote attacker to gain elevated privileges. The vulnerability is due to improper role-based access control RBAC when an...

Cisco TelePresence Server Crafted IPv6 Packet Handling Denial of Service Vulnerability

A vulnerability in Cisco TelePresence Server devices running software versions 3.0 through 4.24.18 could allow an unauthenticated, remote attacker to cause a kernel panic on the device. The vulnerability exists due to a failure to properly handle a specially crafted stream of IPv6 packets. A...

Cisco ASA-CX and Cisco Prime Security Manager Privilege Escalation Vulnerability

A vulnerability in the role-based access control of Cisco ASA-CX and Cisco Prime Security Manager PRSM could allow an authenticated, remote attacker to change the password of any user on the system. The vulnerability exists because the password change request is not fully qualified. An...

Cisco Unity Connection User Search Cross-Site Scripting Vulnerability

A vulnerability in the HTTP web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the affected system's web interface. The vulnerability is due to insufficient input validation of a...

Cisco Prime Infrastructure Frame Injection Vulnerability

A vulnerability in the web interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to execute a cross-frame scripting XFS attack. The vulnerability is due to insufficient HTML iframe protection. An attacker could exploit this vulnerability by directing a user to an...

Cisco Unified Computing System 6200 Series Fabric Interconnect Series Switch DoS Vulnerability

A vulnerability in the SSH management interface of the Cisco Unified Computing System UCS 6200 Series Fabric Interconnect Series Switch could allow an unauthenticated, remote attacker to cause a denial of service DoS condition because a fabric interconnect interface might not boot completely up o...

Cisco Unified Computing System Blade Server Information Disclosure Vulnerability

A vulnerability in the web interface of the Cisco Unified Computing System UCS Blade Server could allow an unauthenticated, remote attacker to obtain information about the UCS software version. The vulnerability is due to the verbose output that is returned when a specific URL is submitted to an...

Cisco NX-OS Malformed ARP Header Denial of Service Vulnerability

A vulnerability in Address Resolution Protocol ARP feature of the Cisco Nexus Operating System NX-OS could allow an unauthenticated, adjacent attacker to cause a partial denial of service DoS condition because the ARP process unexpectedly restarts. The vulnerability is due to improper input...

Cisco TelePresence Video Communication Server Expressway TFTP Information Disclosure Vulnerability

A vulnerability in TFTP in Cisco TelePresence Video Communication Server VCS Expressway could allow an authenticated, remote attacker to obtain unauthorized access to configuration files from the device by using TFTP. The vulnerability is due to lack of TFTP authentication and control for the...

Cisco Unified Interaction Manager Cross-Site Scripting Vulnerability

A vulnerability in the web chat interface of Cisco Unified Interaction Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the chat on the affected system. The vulnerability is due to insufficient input validation of user-supplied...

Cisco Nexus Operating System Address Resolution Protocol Denial of Service Vulnerability

A vulnerability in the Address Resolution Protocol ARP input packet processing of the Cisco Nexus Operating System NX-OS devices could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition. The vulnerability is due to improper validation of the ARP packet and the...

Cisco TelePresence Video Communication Server Expressway Denial of Service Vulnerability

A vulnerability in the Cisco TelePresence Video Communication Server VCS Expressway could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to insufficient handling of malformed GET request messages. An attacker could exploit this...

Cisco Adaptive Security Appliance Message Authentication Code Checking Vulnerability

A vulnerability in the Transport Layer Security TLS code on the Cisco Adaptive Security Appliance ASA could allow an unauthenticated, remote attacker to modify the contents of an encrypted TLS packet without detection of the modifications. The vulnerability is due to an error on the firmware of t...

Cisco Adaptive Security Appliance Software OSPFv2 Denial of Service Vulnerability

A vulnerability in the Open Shortest Path First version 2 OSPFv2 code of Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, adjacent attacker to cause the reload of the affected system. The vulnerability is due to improper handling of OSPFv2 packets. An attacker could...

Cisco Unified Communications Domain Manager Default Static Privileged Account Credentials

A vulnerability in the Cisco Unified Communications Domain Manager Platform Software could allow an unauthenticated, remote attacker to login with the privileges of the root user and take full control of the affected system. The vulnerability occurs because a privileged account has a default and...

Cisco IM and Presence Service SQL Injection Vulnerability

A vulnerability in the database of Cisco IM and Presence Service could allow an authenticated, remote attacker to impact the confidentiality, integrity, and availability of the affected system by executing arbitrary SQL queries. The vulnerability is due to a failure to validate user-supplied inpu...

Cisco Web Security Appliance Web Framework HTTP Header Injection Vulnerability

A vulnerability in the web framework of Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to inject a crafted HTTP header that could introduce arbitrary code into the web interface. The vulnerability is due to insufficient validation of user input before it is used...

Cisco Nexus and Cisco Multilayer Director Switches MOTD Telnet Login Reset Vulnerability

A vulnerability in the Message of the Day MOTD or banner functionality of the NX-OS Software could allow an unauthenticated, remote attacker to cause the login process to reset. The vulnerability is due to the MOTD display handling when a certain type of terminal session is requested via Telnet...

Cisco Unified Communications Manager root Shell Access Local Privilege Escalation Vulnerability

A vulnerability in the local read file of the Cisco Unified Communications Manager could allow an authenticated, local attacker to execute commands and obtain an interactive Linux shell as the root user if the attacker has already obtained sensitive information from the system. The vulnerability ...

Cisco IOS XE Software OTV Processing Code Denial of Service Vulnerability

A vulnerability in the Overlay Transport Virtualization OTV processing code of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a reload of the affected device. The vulnerability is due to improper processing of oversized OTV frames passing through an affected...

Cisco IOS Software and Cisco IOS XE Software Crafted RADIUS Packet Denial of Service Vulnerability

A vulnerability in Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to improper processing of crafted RADIUS packets by a device running the affected software. An authenticated, remote...

Cisco IOS Software and IOS XE Software mDNS Gateway Denial of Service Vulnerability

A vulnerability in the multicast DNS mDNS gateway function of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to reload the vulnerable device. The vulnerability is due to improper validation of mDNS packets. An attacker could exploit this vulnerability...

Cisco Unified Communications Manager Real-Time Monitoring Tool File Disclosure Vulnerability

A vulnerability in the application programming interface API that supports the Real-Time Monitoring Tool RTMT in Cisco Unified Communications Manager could allow an authenticated, remote attacker to access the contents of arbitrary files on an affected device. The vulnerability is due to a failur...

Cisco AnyConnect and Cisco Host Scan Web Launch Cross-Site Scripting Vulnerability

A vulnerability in Cisco AnyConnect Secure Mobility Client and Cisco Host Scan could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the client when AnyConnect is launched through the web interface. The vulnerability is due to insufficien...

Cisco Prime Service Catalog XML External Entity Processing Vulnerability

A vulnerability in the configuration of the XML parser of Cisco Prime Service Catalog could allow an authenticated, remote attacker to access sensitive data stored on the host operating system or cause system resource consumption that could cause a denial of service condition. Cisco has released...

Cisco Integrated Management Controller Privilege Escalation Vulnerability

Cisco Integrated Management Controller contains a vulnerability that could allow an authenticated, local attacker to gain shell-level access to the affected device. The vulnerability is due to improper input validation in the map-nfs command. An attacker could exploit this vulnerability by sendin...

Cisco Unified Presence Server Sync Agent Vulnerability

A vulnerability in the Intercluster Sync Agent Service on Cisco Unified Presence Server could allow an unauthenticated, remote attacker to trigger a denial of service DoS condition. The vulnerability is due to a SYN flood. An attacker could exploit this vulnerability by exceeding the tcp max...

Cisco WebEx Meetings Server Web Framework Vulnerability

A vulnerability in the web framework of Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to view sensitive information. The vulnerability occurs because sensitive information is passed in a query string. An attacker could exploit this vulnerability by viewing applicatio...

Cisco Unified Communications Manager Real-Time Monitoring Tool Path Traversal Vulnerability

A vulnerability in the Real-Time Monitoring Tool RTMT of Cisco Unified Communications Manager Cisco Unified CM could allow an authenticated, remote attacker to download files from arbitrary locations on the filesystem. The vulnerability is due to insufficient input validation. An attacker could...

Cisco WebEx Meetings Client Arbitrary File Download Vulnerability

A vulnerability in the File Transfer functionality of the Cisco WebEx Meetings client could allow an unauthenticated, remote attacker to access arbitrary files on another user's computer also running the Cisco WebEx Meetings client. The vulnerability exists because the affected software does not...

Cisco Adaptive Security Appliance WebVPN Login Page Cross-Site Scripting Vulnerability

A vulnerability in the WebVPN login page of Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of WebVPN on the Cisco ASA. The vulnerability is due to insufficient input validation of a...

Cisco NX-OS Software TACACS+ Command Authorization Vulnerability

A vulnerability in the TACACS+ command authorization code of Cisco NX-OS Software could allow an authenticated, local attacker to execute certain commands without TACACS+ server authorization. The vulnerability is due to the processing of certain commands when executed in a sequence. An attacker...

Cisco Secure Access Control System Cross-Site Scripting Vulnerability

A vulnerability in the web framework of Cisco Secure Access Control System ACS could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface on the affected system. The vulnerability is due to insufficient input validation of a...

Cisco NX-OS Arbitrary File Access Vulnerability

A vulnerability in the Command Line Interface CLI of the Cisco NX-OS Software could allow an authenticated, local attacker to access arbitrary files on the device. The vulnerability is due to improper filtering of user input. An attacker could exploit this vulnerability by leveraging the tar...

Cisco Unified Operations Manager HTTP Header Injection Vulnerability

A vulnerability in Cisco Unified Operations Manager could allow an unauthenticated, remote attacker to cause arbitrary HTML or scripts to be executed in a user's browser. The vulnerability is due to a failure to properly validate application URLs. An attacker could exploit this vulnerability by...

Cisco ASA Software VPN Group Enumeration Vulnerability

A vulnerability in the Internet Security Association and Key Management Protocol ISAKMP implementation in Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to enumerate remote access VPN groups configured in a Cisco ASA device. The vulnerability is due...

Cisco Unified Computing System Fabric Interconnect SNMP Message Processing Denial of Service Vulnerability

Cisco Unified Computing System contains a vulnerability that could allow an authenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to errors in processing malicious Simple Network Management Protocol SNMP messages by the affected software. An...

Cisco IOS Software IP Service Level Agreement Vulnerability

The Cisco IOS IP Service Level Agreement IP SLA feature contains a denial of service DoS vulnerability. The vulnerability is triggered when malformed UDP packets are sent to a vulnerable device. The vulnerable UDP port numbers depend on the device configuration. Default ports are not used for the...

Cisco Global Site Selector Appliances DNS Vulnerability

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES TH...

Cisco 10000, uBR10012, uBR7200 Series Devices IPC Vulnerability

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES TH...

Multiple Cisco Products Vulnerable to DNS Cache Poisoning Attacks

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES TH...

Multiple Vulnerabilities in the WLSE Appliance

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES TH...