Cisco SocialMiner Cross-Site Scripting Vulnerability

A vulnerability in the web framework of Cisco SocialMiner could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation. An attacker could exploit th...

Cisco Remote Expert Manager Virtual Directory Information Disclosure Vulnerability

A vulnerability in the web interface of Cisco Remote Expert Manager Software could allow an unauthenticated, remote attacker to access sensitive information on an affected system. The vulnerability exists because the affected software does not sufficiently protect sensitive data when responding t...

Cisco Prime Optical for Service Providers RADIUS Secret Disclosure Vulnerability

A vulnerability in the web network management interface of Cisco Prime Optical for Service Providers could allow an authenticated, remote attacker to disclose sensitive information in the configuration generated for a device. The attacker must have valid credentials for the device. The...

Cisco Unified Communications Manager Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Communications Manager Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due ...

Cisco ASR 5000 Software ipsecmgr Process IKE Packet Parsing Denial of Service Vulnerability

A vulnerability in the ipsecmgr process of Cisco ASR 5000 Software could allow an unauthenticated, remote attacker to cause the ipsecmgr process to reload. The vulnerability is due to a logical error while parsing IKE packets. An attacker could exploit this vulnerability by submitting malformed I...

Cisco Email Security Appliance SMTP Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Email Security Appliance ESA Switches and Content Security Management Appliance SMA could allow an unauthenticated, remote attacker to conduct a persistent cross-site scripting XSS attack against a user of the affected interface on an...

Cisco ASR 5000 Series ipsecmgr Service Denial of Service Vulnerability

A vulnerability in the IPsec component of StarOS for Cisco ASR 5000 Series routers could allow an unauthenticated, remote attacker to terminate all active IPsec VPN tunnels and prevent new tunnels from establishing, resulting in a denial of service DoS condition. The vulnerability is due to...

Cisco Meeting Server Session Description Protocol Media Lines Buffer Overflow Vulnerability

A vulnerability in the Session Description Protocol SDP parser of Cisco Meeting Server could allow an unauthenticated, remote attacker to execute arbitrary code on an affected system. The vulnerability exists because the affected software performs incomplete input validation of the size of media...

Cisco Hosted Collaboration Mediation Fulfillment Cross-Site Request Forgery Vulnerability

A cross-site request forgery CSRF vulnerability in the web interface of the Cisco Hosted Collaboration Mediation Fulfillment application could allow an unauthenticated, remote attacker to execute unwanted actions. The vulnerability is due to a lack of CSRF protections by an affected device. An...

Cisco Meeting Server Information Disclosure Vulnerability

A vulnerability in Web Bridge for Cisco Meeting Server could allow an unauthenticated, remote attacker to retrieve memory from a connected server. The vulnerability is due to missing bounds checks in the Web Bridge functionality. An attacker could exploit this vulnerability by sending a crafted...

Cisco ASA Software DHCP Relay Denial of Service Vulnerability

A vulnerability in the DHCP Relay feature of Cisco ASA Software could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition by causing an interface wedge. The vulnerability is due to improper handling of resources linked with the DHCP Relay feature. An attacker...

Cisco IOS and IOS XE Software Application-Hosting Framework Unauthorized File Access Vulnerability

A vulnerability in the Cisco application-hosting framework CAF for Cisco IOS and IOS XE Software with the IOx feature set could allow an authenticated, remote attacker to read arbitrary files on a targeted system. The vulnerability is due to insufficient input validation by the affected framework...

Cisco Small Business SPA3x/5x Series Denial of Service Vulnerability

A vulnerability in the HTTP framework of Cisco Small Business SPA300 Series IP Phones, Cisco Small Business SPA500 Series IP Phones, and Cisco SPA51x IP Phones could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is du...

Cisco Firepower Management Center Cross-Site Scripting Vulnerability

A vulnerability in the web framework of Cisco Firepower Management Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation for some of t...

Cisco RV110W, RV130W, and RV215W Routers Static Credential Vulnerability

A vulnerability in the default account when used with a specific configuration of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and the Cisco RV215W Wireless-N VPN Router could allow an authenticated, remote attacker to gain root access to the device...

Cisco WebEx Meetings Server Administrator Interface Cross-Site Request Forgery Vulnerability

A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against the user of the web interface. The vulnerability is due to insufficient CSRF protections. An attacker could exploit this vulnerability by...

Cisco Firepower System Software Static Credential Vulnerability

A vulnerability in Cisco Firepower System Software could allow an unauthenticated, remote attacker to log in to the device with a default account. This account does not have full administrator privileges. The vulnerability is due to a user account that has a default and static password. This...

Cisco Web Security Appliance Connection Denial of Service Vulnerability

A vulnerability in Cisco AsyncOS for the Cisco Web Security Appliance WSA when the software handles a specific HTTP response code could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an appliance because the appliance runs out of system memory. The...

Cisco Wireless LAN Controller Denial of Service Vulnerability

A vulnerability in the Bonjour task manager of Cisco Wireless LAN Controller WLC Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper handling of Bonjour traffic by the affected software. An...

Cisco Policy Suite Confidential Information Disclosure Vulnerability

A vulnerability in password management administration of the Cisco Policy Suite CPS application could allow an unauthenticated, remote attacker to gain read-only access to information that is confidential and should have restricted access. The vulnerability is due to the lack of a proper role-bas...

Cisco Spark Representational State Transfer Interface Denial of Service Vulnerability

A vulnerability in the Representational State Transfer REST interface of Cisco Spark could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to missing authorization checks on certain administrative pages. An...

Cisco Video Communications Server Information Disclosure Vulnerability

Cisco Video Communications Server VCS, when utilized as part of a Jabber Guest deployment, contains an information disclosure vulnerability that could allow and unauthenticated, remote attacker to gain access to potentially sensitive information. The vulnerability exists due to a failure to...

Cisco Application Policy Infrastructure Controller Enterprise Module Cross-Site Scripting Vulnerability

A vulnerability in the web framework of the Cisco Application Policy Infrastructure Controller Enterprise Module APIC-EM could allow an unauthenticated, remote attacker to execute a cross-site scripting XSS attack. The vulnerability is due to insufficient sanitization of HTML entities returned to...

Cisco IOS XR Software OSPF Link State Advertisement PCE Vulnerability

A vulnerability in Open Shortest Path First OSPF Link State Advertisement LSA handling by Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to the number of OSPF Path Computation Elements PCEs that are...

Cisco Unified Communications Manager Web Management Interface Cross-Site Scripting Filter Bypass Vulnerability

A cross-site scripting XSS filter bypass vulnerability in the web management interface of Cisco Unified Communications Manager UCM versions 8.0 through 8.6 could allow an unauthenticated, remote attacker to mount XSS attacks against a user of an affected device. The vulnerability is due to a...

Cisco Unified Communications Domain Manager Denial of Service Vulnerability

A vulnerability in Cisco Unified Communications Domain Manager CUCDM could allow an authenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to improper handling of malformed requests by the self-service application on an affected CUCDM device. An...

Cisco Unity Connection Cross-Site Request Forgery Vulnerability

A cross-site request forgery CSRF vulnerability in Cisco Unity Connection could allow an unauthenticated, remote attacker to execute unwanted actions. The vulnerability is due to a lack of CSRF protections by an affected device. An attacker could exploit this vulnerability by convincing a user to...

Cisco Wireless LAN Controller Client Disconnection Vulnerability

A vulnerability in the Web Management GUI of the Cisco Wireless LAN Controller WLC could allow an unauthenticated, remote attacker to trigger client disconnection. The vulnerability is due to a lack of access control to the Cisco WLC Web Management GUI. An attacker could exploit this vulnerabilit...

Cisco Unified Communications Manager IM and Presence Service REST API Denial of Service Vulnerability

A vulnerability in the Representational State Transfer REST interface of the Cisco Unified Communications Manager IM and Presence Service could allow an unauthenticated, remote attacker to cause a partial denial of service DoS condition because the Cisco Session Initiation Protocol SIP proxy...

Cisco Prime Network Registrar Privilege Escalation Vulnerability

A vulnerability in the default configuration of the Cisco Prime Network Registrar CPNR virtual appliance OVA which could allow an authenticated, local attacker to gain root privileges. The vulnerability is due to an insecure default account present on the affected device. A local attacker could...

Cisco Application Policy Infrastructure Controller Access Control Vulnerability

A vulnerability in the cluster management configuration of the Cisco Application Policy Infrastructure Controller APIC and the Cisco Nexus 9000 Series ACI Mode Switch could allow an authenticated, remote attacker to access the APIC as the root user. The vulnerability is due to improper...

Cisco IOS Software UBR Devices IPv6 to IPv4 Subsystem Denial of Service Vulnerability

A vulnerability in the IPv6 to IPv4 subsystem of Cisco IOS Software could allow an unauthenticated, remote attacker to cause a standby Performance Routing Engine PRE to leak a small portion of memory on a targeted system, resulting in a denial of service DoS condition. The vulnerability is due to...

Cisco Email Security Appliance Anti-Spam Scanner Bypass Vulnerability

A vulnerability in the anti-spam scanner of Cisco AsyncOS for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass the anti-spam functionality of the ESA. The vulnerability is due to improper error handling of a malformed packet in the anti-spam scanner. An...

Cisco Nexus and Cisco Multilayer Director Switches MOTD Telnet Login Reset Vulnerability

A vulnerability in the Message of the Day MOTD or banner functionality of the NX-OS Software could allow an unauthenticated, remote attacker to cause the login process to reset. The vulnerability is due to the MOTD display handling when a certain type of terminal session is requested via Telnet...

Cisco FireSIGHT Management Center Dashboard Deletion Vulnerability

A vulnerability in management interface used to delete VPNs in the Cisco FireSIGHT Management Center could allow an authenticated, remote attacker with limited user permissions to delete another user's VPN dashboard. The vulnerability occurs because the product does not properly validate the...

Cisco IP Phone 7861 Denial of Service Vulnerability

A vulnerability in the Cisco IP Phone 7861 could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper boundary restrictions when user-supplied input to the affected application is processed. An...

Cisco IOS Software Access Control List Bypass Vulnerability

A vulnerability in Cisco IOS Software access control lists ACLs that use object groups could occasionally allow an unauthenticated, remote attacker to bypass the ACL. The vulnerability is due to a race condition between process switching and Cisco Express Forwarding switching while evaluating ACL...

Cisco Prime Infrastructure Cross-Site Request Forgery Vulnerability

A vulnerability in the INSERT page of Cisco Prime Infrastructure PI could allow an unauthenticated, remote attacker to perform a cross-site request forgery CSRF attack against the Cisco PI web interface. The vulnerability is due to insufficient CSRF protections on the Cisco PI web interface. An...

Cisco ASA Software SSL VPN Memory Blocks Exhaustion Vulnerability

A vulnerability in the SSL VPN feature of Cisco ASA Software could allow an unauthenticated, remote attacker to cause the exhaustion of available memory, which could lead to system instability and availability issues on the SSL VPN services. The vulnerability is due to improper implementation of...

Cisco Integrated Management Controller Cross-Site Request Forgery Vulnerability

A vulnerability in the web framework code of Cisco Integrated Management Controller could allow an unauthenticated, remote attacker to perform a cross-site request forgery CSRF attack. The vulnerability is due to insufficient CSRF protections. An attacker could exploit this vulnerability by...

Cisco Unity Connection Information Disclosure Vulnerability

A vulnerability in the Unified Messaging Service UMS of Cisco Unity Connection, could allow an authenticated, remote attacker to access sensitive information. The vulnerability is due to the inclusion of sensitive information in the logs. An attacker could exploit this vulnerability by viewing th...

Cisco IOS XR Software Malformed SNMPv2 Packet Denial of Service Vulnerability

A vulnerability in Simple Network Management Protocol SNMP version 2 SNMPv2 processing of Cisco IOS XR could allow an authenticated, remote attacker to cause a reload of the SNMP daemon snmpd process on an affected device. The vulnerability is due to improper parsing of a malformed SNMPv2 packet...

Cisco IOS XR Software Malformed MPLS Packet Denial of Service Vulnerability

A vulnerability in parsing of malformed Multiprotocol Label Switching MPLS packets in Cisco IOS XR Software for Cisco Network Convergence System 6000 Series Routers could allow an unauthenticated, adjacent attacker to cause a lockup and eventual reload of a network processor unit NPU and a line...

Multiple Vulnerabilities in Cisco NX-OS-Based Products

Cisco Nexus, Cisco Unified Computing System UCS, and Cisco 1000 Series Connected Grid Routers CGR are all based on the Cisco NX-OS operating system. These products are affected by one or more of the following vulnerabilities: Cisco NX-OS Virtual Device Context SSH Privilege Escalation Vulnerabili...

Cisco IOS XE Software SNMP Denial of Service Vulnerability

A vulnerability in the SNMP module of Cisco IOS XE Software could allow an authenticated, remote attacker to cause a reload of the affected device. The vulnerability is due to frequent polling of certain MIBs on an affected device. An attacker could exploit this vulnerability by sending continuou...

Cisco Emergency Responder Cross-Site Scripting Vulnerability

A vulnerability in the Cisco Emergency Responder Cisco ER UserServlet of Cisco ER Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the Cisco ER web interface. The vulnerability is due to insufficient input validation of a...

Cisco AsyncOS Software Code Execution Vulnerability

Cisco AsyncOS Software for Email Security Appliance ESA and Cisco Content Security Management Appliance SMA contain a vulnerability that could allow an authenticated remote attacker to execute arbitrary code with the privileges of the root user. Cisco has released software updates that address th...

Multiple Vulnerabilities in Cisco Secure Access Control System

Cisco Secure Access Control System ACS is affected by the following vulnerabilities: Cisco Secure ACS RMI Privilege Escalation Vulernability Cisco Secure ACS RMI Unauthenticated User Access Vulnerability Cisco Secure ACS Operating System Command Injection Vulnerability Cisco Secure ACS uses the...

Cisco IOS XE Software TFTP Denial of Service Vulnerability

A vulnerability in the flow manager code of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause flow manager to hold UDP sessions in its table. The vulnerability is due to not releasing memory for flows generated by TFTP UDP traffic. An attacker could exploit this...

Cisco AnyConnect Secure Mobility Client VPNAPI COM Buffer Overflow Vulnerability

A vulnerability in the Active Template Library ATL framework used by a component of the Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, remote attacker to execute arbitrary commands with the privilege of the user executing the web browser. The vulnerability is due to...