5313 matches found
Cisco NX-OS System Software CLI Command Injection Vulnerability
A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient input validation of command arguments to the CLI parser. An attacker could exploit this vulnerability by injecting...
Cisco SPA300 and SPA500 Series IP Phones Cross-Site Request Forgery Vulnerability
A vulnerability in Cisco SPA300 and SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute unwanted actions on an affected device. The vulnerability is due to a lack of cross-site request forgery CSRF protection. An attacker could exploit this vulnerability by tricking...
Cisco Firepower Management Center Cross-Site Scripting Vulnerability
A vulnerability in the web framework of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of the affected software. The vulnerability is due to insufficient validation of user-supplied...
Cisco Elastic Services Controller Configuration Files Information Disclosure Vulnerability
A vulnerability in Cisco Elastic Services Controller ESC could allow an authenticated, remote attacker to view sensitive information. The vulnerability is due to insufficient protection of sensitive data. An attacker could exploit this vulnerability by authenticating to the application and...
Cisco TelePresence Video Communication Server Denial of Service Vulnerability
A vulnerability in the Session Initiation Protocol SIP on the Cisco TelePresence Video Communication Server VCS could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on the targeted appliance. The vulnerability is due to excessive SIP traffic sent to the devic...
Cisco Elastic Services Controller Unauthorized Access Vulnerability
A vulnerability in the Play Framework of Cisco Elastic Services Controller ESC could allow an unauthenticated, remote attacker to gain full access to the affected system. The vulnerability is due to static, default credentials for the Cisco ESC UI that are shared between installations. An attacke...
Cisco StarOS for ASR 5000 Series Routers IPsec VPN Tunnel Denial of Service Vulnerability
A vulnerability in the IPsec component of Cisco StarOS for Cisco ASR 5000 Series Routers could allow an unauthenticated, remote attacker to terminate all active IPsec VPN tunnels and prevent new tunnels from establishing, resulting in a denial of service DoS condition. The vulnerability is due to...
Cisco Ultra Services Framework Element Manager Insecure Default Password Vulnerability
A vulnerability in Cisco Ultra Services Framework Element Manager could allow an authenticated, remote attacker with access to the management network to log in to the affected device using default credentials present on the system. The vulnerability is due to weak, hard-coded credentials present ...
Cisco IP Phone 8800 Series SIP Denial of Service Vulnerability
A vulnerability in Session Initiation Protocol SIP call handling of Cisco IP Phone 8800 Series devices could allow an unauthenticated, remote attacker to cause a denial of service DoS condition due to the SIP process unexpectedly restarting. All active phone calls are dropped as the SIP process...
Cisco Unified Communications Manager Denial of Service Vulnerability
A vulnerability in the Session Initiation Protocol SIP UDP throttling process of Cisco Unified Communications Manager Cisco Unified CM could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient rate...
Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms Shell Bypass Vulnerability
A vulnerability in login authentication management in Cisco Aironet 1800, 2800, and 3800 Series Access Point platforms could allow an authenticated, local attacker to gain unrestricted root access to the underlying Linux operating system. The root Linux shell is provided for advanced...
Cisco UCS Director Virtual Machine Information Disclosure Vulnerability
A vulnerability in the role-based resource checking functionality of Cisco Unified Computing System UCS Director could allow an authenticated, remote attacker to view unauthorized information for any virtual machine in a UCS domain. The vulnerability is due to improper role-based user checks. An...
Cisco WebEx Meetings Server XML External Entity Vulnerability
A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to have read access to part of the information stored in the affected system. The vulnerability is due to improper handling of an XML External Entity XXE when parsing an XML file. An attacker could exploi...
Cisco cBR Series Converged Broadband Routers List Headers Denial of Service Vulnerability
A vulnerability in the handling of list headers in Cisco cBR Series Converged Broadband Routers could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service DoS condition. The vulnerability is due to memory corruption. An attacker could exploit...
Cisco Adaptive Security Appliance CX Context-Aware Security Denial of Service Vulnerability
A vulnerability in the data plane IP fragment handler of the Adaptive Security Appliance ASA CX Context-Aware Security module could allow an unauthenticated, remote attacker to cause the CX module to be unable to process further traffic, resulting in a denial of service DoS condition. The...
Cisco IOS and Cisco IOx Software Information Disclosure Vulnerability
A vulnerability in the web-based management interface of Cisco IOS and Cisco IOx Software could allow an unauthenticated, remote attacker to view confidential information that is displayed without authenticating to the device. The vulnerability is due to lack of proper input validation of the...
Cisco Identity Services Engine Cross-Site Scripting Vulnerability
Cisco Identity Services Engine ISE contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of the affected system. The vulnerability is due to insufficient input validation of some parameters...
Cisco IOS XR Software HTTP 2.0 Request Handling Event Service Daemon Denial of Service Vulnerability
A vulnerability in the HTTP 2.0 request handling code of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the Event Management Service daemon emsd to crash, resulting in a denial of service DoS condition. The vulnerability is due to improper handling of HTTP requests...
Cisco TelePresence Endpoints Local Command Injection Vulnerability
Cisco TelePresence endpoints running either CE or TC software contain a vulnerability that could allow an authenticated, local attacker to execute a local shell command injection. The vulnerability is due to incomplete input sanitization of some commands. An attacker could exploit this...
Cisco Unified Intelligence Center (CUIC) Software Cross-Site Request Forgery Vulnerability
A vulnerability in Cisco Unified Intelligence Center CUIC Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against the user of the web interface. The vulnerability is due to insufficient CSRF protections. An attacker could exploit this...
Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms 802.11 Protocol Denial of Service Vulnerability
A vulnerability in the 802.11 wireless LAN protocol for Cisco Access Point AP platforms could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition when the device unexpectedly reloads. The vulnerability is due to rate limiting of 802.11 traffic. An attacker could...
Cisco IOS and IOS XE Software Border Gateway Protocol Message Processing Denial of Service Vulnerability
A vulnerability in Border Gateway Protocol BGP message processing functions of Cisco IOS and IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload. The vulnerability is due to improper processing of crafted BGP attributes. An attacker could exploit th...
Cisco Meeting Server Persistent Cross-Site Scripting Vulnerability
A vulnerability in the web bridge that offers video via a web interface of Cisco Meeting Server Software, formerly Acano Conferencing Server, could allow an unauthenticated, remote attacker to conduct a persistent cross-site scripting XSS attack against a user of the web interface of an affected...
Cisco Prime Network Analysis Module Unauthenticated Remote Code Execution Vulnerability
A vulnerability in the web interface of Cisco Network Analysis Modules could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of the affected device with the privileges of the web server. The vulnerability is due to a failure to properly...
Cisco IOS XR Software LPTS Denial of Service Vulnerability
A vulnerability in the Local Packet Transport Services LPTS network stack of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a limited denial of service DoS condition on an affected platform. The vulnerability is due to improper handling of flow base entries by LPTS...
Cisco FirePOWER System Software Packet Processing Denial of Service Vulnerability
A vulnerability in the packet processing functions of Cisco FirePOWER System Software could allow an unauthenticated, remote attacker to cause an affected system to stop inspecting and processing packets, resulting in a denial of service DoS condition. The vulnerability is due to improper packet...
Cisco TelePresence Video Communication Server Denial of Service Vulnerability
A vulnerability in the Session Initiation Protocol SIP message handling process of Cisco TelePresence Video Communication Server VCS could allow an authenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to incorrect processing of specific incoming SIP...
Cisco Integrated Management Controller Denial of Service Vulnerability
A vulnerability in Cisco Integrated Management Controller IMC could allow an authenticated, remote attacker to make the IMC IP interface inaccessible. The vulnerability is due to incomplete sanitization of input for certain parameters. An attacker could exploit this vulnerability by sending a...
Cisco Application Policy Infrastructure Controller Unauthorized Access Vulnerability
A vulnerability in the role-based access control RBAC of the Cisco Application Policy Infrastructure Controller Cisco APIC could allow an authenticated, remote attacker to have read access to certain information stored in the affected system. The vulnerability is due to improper handling of RBAC...
Cisco AnyConnect Secure Mobility Client Privilege Escalation Vulnerability
A vulnerability in the code of Cisco AnyConnect Secure Mobility Client for Linux could allow an authenticated, local attacker to elevate privileges to those of the root user. The vulnerability is due to improper implementation of some internal functions. An attacker could exploit this vulnerabili...
Cisco Identity Services Engine Privilege Escalation Vulnerability
A vulnerability in the Posture module of the Cisco Identity Services Engine ISE could allow an authenticated, local attacker to run arbitrary programs with elevated privileges. The vulnerability is due to insufficient access control protections. An attacker could exploit this vulnerability by...
Cisco Mobility Service Engine Password Information Disclosure Vulnerability
A vulnerability in the Cisco Mobility Services Engine MSE could allow an authenticated, remote attacker to gain access to sensitive information. The vulnerability is due to insufficient security restrictions imposed by the affected software. An authenticated, remote attacker could exploit this...
Cisco Web Security Appliance Cross-Site Scripting Vulnerability
A vulnerability in the Administrator report page of the Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by...
Cisco Adaptive Security Appliance WebVPN Embedded Web Server Denial of Service Vulnerability
A vulnerability in the WebVPN feature of Cisco Adaptive Security Appliance ASA could allow an unauthenticated, remote attacker to force the ASA to stop accepting new SSL connections. The vulnerability is due to a memory leak in the WebVPN embedded web server. An attacker could exploit this...
Cisco Unified Communications Manager SQL Injection Vulnerability
A vulnerability in Cisco Unified Communications Manager could allow an authenticated, remote attacker to perform SQL injection. This could allow the attacker to obtain information the affected application can access. The vulnerability is due to a failure to properly sanitize user-supplied input...
Cisco ASR901 Crafted IPv4 Packet Denial of Service Vulnerability
A vulnerability in Internet Protocol version 4 IPv4 packet processing of the Cisco ASR901 could allow an unauthenticated, remote attacker to flood packets to the ASR901 CPU. The vulnerability is due to punting crafted IPv4 packets to the CPU for processing. An attacker could exploit this...
Cisco WebEx Meetings Server Authenticated Encryption Vulnerability
A vulnerability in the user.php script of Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to view sensitive information. The vulnerability is due to an invalid token timer. An attacker could exploit this vulnerability by submitting crafted URL requests to a vulnerable...
Cisco WebEx Meetings Server Stack Trace Vulnerability
A vulnerability in the ProfileAction controller of Cisco WebEx Meetings Server CWMS could allow an unauthenticated, remote attacker to view sensitive information. The vulnerability is due to improper sanitization of returned messages. An attacker could exploit this vulnerability by submitting...
Cisco Unified Communications Manager DNA Path Traversal Vulnerability
A vulnerability in the /dna/viewfilecontents.do URL of the Cisco Unified Communications Manager Dialed Number Analyzer DNA could allow an authenticated, remote attacker to view files from specific locations on the filesystem. The vulnerability is due to insufficient input validation. An attacker...
Cisco Intelligent Automation for Cloud MyServices Vulnerabilities
A vulnerability in the MyServices action of Cisco Intelligent Automation for Cloud could allow an authenticated, remote attacker to acquire sensitive information. The vulnerability is due to the inclusion of sensitive information in URLs. An attacker could exploit this vulnerability by viewing...
Multiple Vulnerabilities in Cisco Unified Communications Domain Manager
Cisco Unified Communications Domain Manager Cisco Unified CDM is affected by the following vulnerabilities: Cisco Unified Communications Domain Manager Privilege Escalation Vulnerability Cisco Unified Communications Domain Manager Default SSH Key Vulnerability Cisco Unified Communications Domain...
Cisco Security Manager Cross-Site Scripting Vulnerability
A vulnerability in the web framework of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface. The vulnerability is due to insufficient input validation of a parameter. An attacker could exploit this...
Cisco IOS Software Link Layer Discovery Protocol Denial of Service Vulnerability
A vulnerability in Link Layer Discovery Protocol LLDP in Cisco switches could allow an unauthenticated, adjacent attacker to cause a reload of the affected device. The vulnerability is due to incorrect handling of malformed LLDP packets. An attacker could exploit this vulnerability by sending a...
Cisco Emergency Responder Dynamic Content Modification Vulnerability
A vulnerability in the web interface of Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct web page injection attack against a user browser of the Cisco Emergency Responder. The vulnerability is due to insufficient input validation of several parameters. An...
Cisco Emergency Responder Open Redirect Vulnerability
A vulnerability in the web interface of Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct a web page open redirection attack against a user browser of the Cisco Emergency Responder. The vulnerability is due to insufficient input validation of several parameters...
Cisco IOS Software Network Address Translation Vulnerabilities
The Cisco IOS Software implementation of the Network Address Translation NAT feature contains two vulnerabilities when translating IP packets that could allow an unauthenticated, remote attacker to cause a denial of service condition. Cisco has released software updates that address these...
Cisco 7600 Series Route Switch Processor 720 with 10 Gigabit Ethernet Uplinks Denial of Service Vulnerability
A vulnerability in the Cisco 7600 Series Route Switch Processor 720 with 10 Gigabit Ethernet Uplinks models RSP720-3C-10GE and RSP720-3CXL-10GE could allow an unauthenticated, remote attacker to cause the route processor to reboot or stop forwarding traffic. The vulnerability is due to an issue i...
Cisco Hosted Collaboration Solution Memory Leak Vulnerability
A vulnerability in the graphical user interface of the Impact server in the Cisco Hosted Collaboration Solution HCS could allow an unauthenticated, remote attacker to cause a memory leak. The vulnerability is due to improper packet processing in the application. An exploit could allow the attacke...
Cisco Intelligent Automation for Cloud Cryptographic Implementation Issues
Issues in the cryptographic implementation of Cisco Intelligent Automation for Cloud Cisco IAC may allow an unauthenticated, remote attacker to recover cryptographic material used in all Cisco IAC installations. The issues are due to the inclusion of fixed cryptographic material in the product...
Cisco Third-Generation IP Phone CTL Trust Chain Enforcement Vulnerability
A vulnerability in Certificate Trust List CTL authentication of Cisco third-generation IP phones could allow an unauthenticated, remote attacker to inject a crafted CTL file to the IP phone. The vulnerability is due to insufficient authentication of the CTL file. An attacker could exploit this...