Cisco Unified Intelligence Center Cross-Site Scripting Vulnerability

A vulnerability in the web framework code of Cisco Unified Intelligence Center Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation...

Cisco Wide Area Application Services HTTP Application Optimization Denial of Service Vulnerability

A vulnerability in the HTTP web interface for Cisco Wide Area Application Services WAAS could allow an unauthenticated, remote attacker to cause an HTTP Application Optimization AO related process to restart, causing a partial denial of service DoS condition. The vulnerability is due to lack of...

Cisco Meeting Server TURN Server Unauthorized Access and Information Disclosure Vulnerability

A vulnerability in the Traversal Using Relay NAT TURN server included with Cisco Meeting Server CMS could allow an authenticated, remote attacker to gain unauthenticated or unauthorized access to components of or sensitive information in an affected system. The vulnerability is due to an incorrec...

Cisco Email Security Appliance Malformed EML Attachment Bypass Vulnerability

A vulnerability in the malware detection functionality within Advanced Malware Protection AMP of Cisco AsyncOS Software for Cisco Email Security Appliances ESAs could allow an unauthenticated, remote attacker to cause an email attachment containing malware to be delivered to the end user. The...

Cisco Prime Collaboration Provisioning Tool Inventory Management Feature Information Disclosure Vulnerability

A vulnerability in the Inventory Management feature of Cisco Prime Collaboration Provisioning Tool could allow an authenticated, remote attacker to view sensitive information on the system. The vulnerability is due to insufficient protection of restricted information. An attacker could exploit th...

Cisco ASA Software Internet Key Exchange Version 1 XAUTH Denial of Service Vulnerability

A vulnerability in the Internet Key Exchange Version 1 IKEv1 XAUTH code of Cisco ASA Software could allow an authenticated, remote attacker to cause a reload of an affected system. The vulnerability is due to insufficient validation of the IKEv1 XAUTH parameters passed during an IKEv1 negotiation...

Cisco IOS and IOS XE Software EnergyWise Denial of Service Vulnerabilities

Multiple vulnerabilities in the EnergyWise module of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a buffer overflow condition or a reload of an affected device, leading to a denial of service DoS condition. These vulnerabilities are due to improper...

Cisco IOS and IOS XE Software Layer 2 Tunneling Protocol Denial of Service Vulnerability

A vulnerability in the Layer 2 Tunneling Protocol L2TP parsing function of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to insufficient validation of L2TP packets. An attacker could exploit this...

Cisco IOS XE Software HTTP Command Injection Vulnerability

A vulnerability in the web framework of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation of HTTP parameters supplied by the user. An attacker could...

Cisco Prime Infrastructure Cross-Site Scripting Vulnerability

A vulnerability in the HTTP web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of the affected system. The vulnerability is due to insufficient input validati...

Cisco Prime Collaboration Assurance Directory Listing Unauthorized Access Vulnerability

A vulnerability in exporting functions of the user interface for Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to view file directory listings and download files. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could...

Cisco Meeting Server HTTP Packet Processing Vulnerability

A vulnerability in the Web Bridge interface of the Cisco Meeting Server CMS, formerly Acano Conferencing Server, could allow an authenticated, remote attacker to retrieve memory contents, which could lead to the disclosure of confidential information. In addition, the attacker could potentially...

Cisco FireAMP Connector Endpoint Software Denial of Service Vulnerability

A vulnerability in the system management of certain FireAMP system processes in Cisco FireAMP Connector Endpoint software could allow an authenticated, local attacker to stop certain protected FireAMP processes without requiring a password. Stopping certain critical processes could cause a denial...

Cisco IP Interoperability and Collaboration System Universal Media Services Unauthorized Access Vulnerability

A vulnerability in the interdevice communications interface of the Cisco IP Interoperability and Collaboration System IPICS Universal Media Services UMS could allow an unauthenticated, remote attacker to modify configuration parameters of the UMS and cause the system to become unavailable. The...

Cisco NX-OS Border Gateway Protocol Denial of Service Vulnerability

A vulnerability in the Border Gateway Protocol BGP implementation of Cisco NX-OS System Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition due to the device unexpectedly reloading. The vulnerability is due to incomplete input validation of the BGP...

Cisco IOS XE Software IP Fragment Reassembly Denial of Service Vulnerability

A vulnerability in the IPv4 fragment reassembly function of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to the corruption of an internal data structure that occurs when the affected software reassembles an...

Cisco Carrier Routing System IPv6 Denial of Service Vulnerability

A vulnerability in IPv6 over MPLS packet processing of Cisco IOS XR for Cisco Carrier Routing System CRS platforms could allow an unauthenticated, adjacent attacker to cause a reload of the affected line card. The vulnerability is due to insufficient logic in processing of crafted IPv6 over MPLS...

Cisco AnyConnect Secure Mobility Client Local Privilege Escalation Vulnerability

A vulnerability in Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to install and execute an arbitrary executable file with privileges equivalent to the Microsoft Windows operating system SYSTEM account. The vulnerability is due to incomplete input...

Cisco WebEx Meetings Server Administrator Interface Reflected Cross-Site Scripting Vulnerability

A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct reflected cross-site scripting XSS attacks. The vulnerability is due to insufficient sanitization of user-supplied input by the affected software. An unauthenticated, remote attacker could...

Cisco Unified Contact Center Enterprise Web-Based Management Interface Cross-Site Scripting Vulnerability

A vulnerability in the HTTP web-based management interface of Cisco Unified Contact Center Enterprise Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of an affected system. The vulnerability is due to...

Cisco 8800 Series IP Phone Directory Traversal Vulnerability

A vulnerability in the license upload interface of Cisco 8800 Series IP Phones could allow an authenticated, remote attacker to delete arbitrary files from the filesystem. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by uploading invalid...

Cisco Firepower Management Center Persistent Cross-Site Scripting Vulnerability

A vulnerability in the HTTP framework of Cisco Firepower Management Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against an affected device. The vulnerability is due to insufficient filtering of output data. An attacker could exploit this...

Cisco Prime Network Registrar System Configuration Protocol Information Disclosure Vulnerability

A vulnerability in the System Configuration Protocol SCP core messaging interface of the Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to access sensitive data. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability ...

Cisco Prime Network Analysis Module Unauthenticated Remote Code Execution Vulnerability

A vulnerability in the web interface of Cisco Network Analysis Modules could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of the affected device with the privileges of the web server. The vulnerability is due to a failure to properly...

Cisco Prime Infrastructure and Evolved Programmable Network Manager Privilege Escalation API Vulnerability

A vulnerability in the web application programming interface API of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager EPNM could allow an authenticated, remote attacker to gain elevated privileges. The vulnerability is due to improper role-based access control RBAC when an...

Cisco 1000 Series Connected Grid Routers SNMP BRIDGE MIB Denial of Service Vulnerability

A vulnerability in the Simple Network Management Protocol SNMP BRIDGE Management Information Base MIB of the Cisco 1000 Series Connected Grid Routers could allow an authenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to a faulty implementation of...

Cisco Jabber Guest Server HTTP Web-Based Management Interface Cross-Site Scripting Vulnerability

A vulnerability in the HTTP web-based management interface of the Cisco Jabber Guest application could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface. The vulnerability is due to insufficient input validation of the HTTP...

Cisco Wide Area Application Service CIFS Denial of Service Vulnerability

A vulnerability in the Common Internet File System CIFS optimization feature of the Cisco Wide Area Application Service WAAS device could allow an unauthenticated, remote attacker to perform a resource consumption attack which, could result in a complete denial of service DoS condition. The...

Cisco FireSIGHT Management Center Stored Cross-Site Scripting Vulnerabilities

Multiple vulnerabilities in the web framework of Cisco FireSIGHT Management Center could allow an unauthenticated, remote attacker to execute a stored cross-site scripting XSS attack against a user of the Cisco FireSIGHT Management Center web interface. The vulnerabilities are due to improper...

Cisco Prime Infrastructure Frame Injection Vulnerability

A vulnerability in the web interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to execute a cross-frame scripting XFS attack. The vulnerability is due to insufficient HTML iframe protection. An attacker could exploit this vulnerability by directing a user to an...

Cisco Emergency Responder Service Web Framework Cross-Site Request Forgery Vulnerability

A vulnerability in the web framework of Cisco Emergency Responder server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against a user of the web interface. The vulnerability is due to insufficient CSRF protections. An attacker could exploit th...

Cisco Unified Computing System 6200 Series Fabric Interconnect Series Switch DoS Vulnerability

A vulnerability in the SSH management interface of the Cisco Unified Computing System UCS 6200 Series Fabric Interconnect Series Switch could allow an unauthenticated, remote attacker to cause a denial of service DoS condition because a fabric interconnect interface might not boot completely up o...

Cisco Networking Services Sensitive Information Disclosure Vulnerability

A vulnerability in the debug logging function of Cisco Networking Services CNS used for configuring Cisco IOS networking devices could allow an authenticated, local attacker to disclose sensitive data. The vulnerability is due to insufficient protections of sensitive data at rest. An attacker...

Cisco Aironet 1850 Access Point Privilege Escalation Vulnerability

A vulnerability in the command-line interface CLI of the Cisco Aironet 1850 Series Access Point device could allow an authenticated, local attacker to obtain elevated privileges to the restricted shell on the device. The vulnerability is due to a lack of proper escape protections when validating...

Cisco TelePresence Video Communication Server Expressway Information Disclosure Vulnerability

A vulnerability in the System Snapshot of Cisco TelePresence Video Communication Server VCS Expressway could allow an authenticated, remote attacker to view sensitive data. The vulnerability is due to insufficient protection of data at rest. An attacker could exploit this vulnerability by...

Cisco Adaptive Security Appliance Message Authentication Code Checking Vulnerability

A vulnerability in the Transport Layer Security TLS code on the Cisco Adaptive Security Appliance ASA could allow an unauthenticated, remote attacker to modify the contents of an encrypted TLS packet without detection of the modifications. The vulnerability is due to an error on the firmware of t...

Cisco Unified MeetingPlace SQL Injection Vulnerability

A vulnerability in Cisco Unified MeetingPlace could allow an authenticated, remote attacker to impact the confidentiality, integrity, and availability of the affected system by executing arbitrary SQL queries. The vulnerability is due to failure to validate user-supplied input used in SQL queries...

Cisco IOS Software UBR Devices IPv6 VPN Multiprotocol Label Switching Denial of Service Vulnerability

A vulnerability in Cisco Universal Broadband Routers performing IPv6 VPN over Multiprotocol Label Switching MPLS; 6VPE and configured for NetFlow could allow an unauthenticated, remote attacker to cause a crash of the Parallel Express Forwarding PXF process on the Performance Routing Engine PRE...

Cisco IOS XR telnetd Packet Processing Denial of Service Vulnerability

A vulnerability in the telnetd process of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a reload of the affected service. The vulnerability is due to improper processing of malformed Telnet packets directed to a device configured to process such packets. An attack...

Cisco FireSIGHT Management Center Cross-Site Scripting Vulnerability

A vulnerability in the Cisco FireSIGHT Management Center could allow an authenticated, remote attacker to perform cross-site scripting XSS attacks. The vulnerability is due to insufficient input validation of some parameters passed via HTTP GET or POST methods. An attacker could exploit this...

Cisco Unified Customer Voice Portal Cross-Site Request Forgery Vulnerability

A vulnerability in Cisco Unified Customer Voice Portal CVP could allow an unauthenticated, remote attacker to conduct cross-site request forgery CSRF attacks. The vulnerability is due to insufficient CSRF protections on an affected system. An attacker could exploit this vulnerability by persuadin...

Cisco Wide Area Application Services Server Message Block Protocol Module Denial of Service Vulnerability

A vulnerability in the Server Message Block Protocol SMB module of Cisco Wide Area Application Services WAAS could allow an unauthenticated, remote attacker to cause a reload of the SMB module. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by...

Cisco Unified Communications Manager SQL Injection Vulnerability

A vulnerability in Cisco Unified Communications Manager could allow an authenticated, remote attacker to perform SQL injection attacks. The vulnerability is due to a failure to properly sanitize user-supplied input passed to the affected application. An attacker could exploit this vulnerability b...

Cisco ACE 4710 Application Control Engine and Application Networking Manager Cross-Site Request Forgery Vulnerability

A vulnerability in the web GUI of the Cisco Application Networking Manager ANM and the Device Manager DM in the Cisco ACE 4710 Application Control Engine ACE Appliance could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against the user of the web...

Cisco Collaboration Desk Experience Endpoints Command Injection Vulnerability

A vulnerability in the image upgrade facility of Cisco Collaboration Desk Experience DX Series endpoints could allow an authenticated, local attacker to execute commands in the context of the underlying operating system. The vulnerability is due to insufficient sanitization of input during the...

Cisco ASA Challenge-Response Tunnel Group Selection Bypass Vulnerability

A vulnerability in the authentication code of Cisco ASA Software could allow an authenticated, remote attacker to access resources of a VPN tunnel group. The vulnerability is due to improper implementation of the tunnel group selection when a user authenticates to the remote access VPN via the...

Cisco AsyncOS Software Uuencoded Email Filtering Bypass Vulnerability

A vulnerability in the uuencode inspection engine of Cisco AsyncOS for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass engine protection and deliver a malicious file as an email attachment. The vulnerability is due to improper implementation of the log...

Cisco WebEx Meetings Server User Enumeration Vulnerability

A vulnerability in the Forgot Password process of the Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to enumerate a valid administrator account. The vulnerability is due to insufficient user input validation. An attacker could exploit this vulnerability by submitting...

Cisco Unified Communications Domain Manager Platform High CPU Utilization Denial of Service Vulnerability

A vulnerability in Cisco Unified Communications Domain Manager Platform Software could allow an unauthenticated, remote attacker to cause high CPU utilization, which may affect the performance of the system and make some services unavailable. The vulnerability is due to insufficient implementatio...

Cisco Unified Computing System B-Series Servers Privilege Escalation Vulnerability

Cisco Unified Computing System B-Series Blade Servers could allow an authenticated, local attacker to gain shell-level access to the affected device. The vulnerability is due to improper input validation in the ping6 and the traceroute6 commands. An attacker could exploit this vulnerability by...