Cisco Hybrid Meeting Server Web Interface Cross-Site Request Forgery Vulnerability

A vulnerability in Cisco Hybrid Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against the user of the web interface. The vulnerability is due to insufficient CSRF protections. An attacker could exploit this vulnerability by...

Cisco WebEx Meetings Player Arbitrary Code Execution Vulnerability

A vulnerability in Cisco WebEx Meetings Player could allow an unauthenticated, remote attacker to execute arbitrary code. The vulnerability is due to improper handling of user-supplied files. An attacker could exploit this vulnerability by persuading a user to open a malicious WRF file by using t...

Cisco Web Security Appliance HTTP POST Denial of Service Vulnerability

A vulnerability that occurs when parsing an HTTP POST request with Cisco AsyncOS for Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to cause a denial of service DoS vulnerability due to the proxy process becoming unresponsive. The vulnerability is due to a lack o...

Cisco Application Policy Infrastructure Controller Enterprise Module SNMP Hostname Cross-Site Scripting Vulnerability

A vulnerability in the Simple Network Management Protocol SNMP query process of the Cisco Application Policy Infrastructure Controller Enterprise Module APIC-EM could allow an unauthenticated, remote attacker to perform a cross-site scripting XSS attack. The vulnerability is due to insufficient...

Cisco Adaptive Security Appliance Non-DCERPC Traffic Bypass Vulnerability

A vulnerability in the Distributed Computing Environment/Remote Procedure Calls DCERPC Inspection feature of the Cisco Adaptive Security Appliance ASA could allow an unauthenticated, remote attacker to send traffic that is not DCERPC between hosts configured only for DCERPC inspection. The DCERPC...

Cisco Prime Collaboration Assurance Arbitrary File Retrieval Vulnerability

A vulnerability in the web framework of Cisco Prime Collaboration Assurance PCA could allow an authenticated, remote attacker to retrieve arbitrary files from the underlying file system. The vulnerability is due to incorrect implementation of the access control code. An attacker could exploit thi...

Cisco TelePresence Video Communication Server Expressway Access Vulnerability

A vulnerability in the Password Change functionality in the Administrative Web Interface of the Cisco TelePresence Video Communication Server VCS Expressway could allow an authenticated, remote attacker to make unauthorized changes to user passwords. The vulnerability is due to insufficient...

Cisco Unified MeetingPlace Unauthorized Password Change Vulnerability

The password change functionality in the Cisco Unified MeetingPlace Web Conferencing application could allow an unauthenticated remote, attacker to change the passwords of arbitrary users. The vulnerability is due to the following: Users are not required to enter the previous password during a...

Cisco Headend System Releases Denial of Service Vulnerability

A vulnerability in Cisco Headend System Releases could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to the software's inability to recover memory after certain usage situations. An attacker could exploit this vulnerability by...

Cisco Edge 340 Privilege Escalation Vulnerability

A vulnerability in the system configuration of Cisco Edge 340 could allow an authenticated, local attacker to run arbitrary programs with elevated privileges. The vulnerability is due to insufficient access control protections. An attacker could exploit this vulnerability by logging in to the...

Cisco Finesse XML Processing Denial of Service Vulnerability

A vulnerability in Cisco Finesse could allow an authenticated, remote attacker to gain access to sensitive information or cause a denial of service DoS condition. The vulnerability is due to improper processing of XML files by an affected device. An authenticated, remote attacker could exploit th...

Cisco MediaSense Cross-Site Request Forgery Vulnerability

A vulnerability in Cisco MediaSense could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against the user of the web interface. The vulnerability is due to insufficient CSRF protections on the Cisco MediaSense web interface. An attacker could exploit...

Cisco Wireless LAN Controller Wireless Web Authentication Denial of Service Vulnerability

A vulnerability in the wireless web authentication subsystem of Cisco Wireless LAN Controller WLC could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition. The vulnerability exists due to improper input sanitization of a certain value that is supplied by a user...

Cisco Unity Connection CUCReports Page Cross-Site Request Forgery Vulnerability

A vulnerability in the CUCReports page of Cisco Unity Connection could allow an unauthenticated, remote attacker to perform a cross-site request forgery CSRF attack against the CUCReports web interface. The vulnerability is due to insufficient CSRF protections on the Cisco Unity Connection web...

Cisco Nexus 9000 Series Denial of Service Vulnerability

A vulnerability in the SNMP subsystem of Cisco Nexus 9000 software could allow an authenticated, remote attacker to cause a denial of service DoS condition. The vulnerability occurs when the High Availability HA policy is set to Reset in the affected software. An authenticated, remote attacker...

Cisco Mobility Service Engine Password Information Disclosure Vulnerability

A vulnerability in the Cisco Mobility Services Engine MSE could allow an authenticated, remote attacker to gain access to sensitive information. The vulnerability is due to insufficient security restrictions imposed by the affected software. An authenticated, remote attacker could exploit this...

Cisco IOS Software Authentication Proxy Bypass Vulnerability

A vulnerability in the Authentication Proxy feature of Cisco IOS Software could allow a remote attacker to bypass the authentication. The vulnerability is due to the incorrect processing of unsupported Authentication, Authorization, and Accounting AAA return codes from the AAA feature by the...

Cisco AsyncOS Software Uuencoded Email Filtering Bypass Vulnerability

A vulnerability in the uuencode inspection engine of Cisco AsyncOS for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass engine protection and deliver a malicious file as an email attachment. The vulnerability is due to improper implementation of the log...

Cisco Unified IP Phone 9900 Series Arbitrary File Upload Vulnerability

A vulnerability in the web framework of Cisco Unified IP Phone 9900 Series could allow an unauthenticated, remote attacker to upload arbitrary files to the phone. The vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafte...

Cisco WebEx Meetings Server Password Encryption Vulnerability

A vulnerability in the OutlookAction LI of Cisco WebEx Meetings Server could allow an authenticated, remote attacker to generate sensitive encrypted values. The vulnerability is due to the return of a user's encrypted password. An attacker could exploit this vulnerability by generating these...

Cisco Jabber Guest Server HTML5 Response Disclosure

A vulnerability in Cisco Jabber Guest Server could allow an unauthenticated, remote attacker to disclose sensitive information on the targeted system. The vulnerability is due to missing encryption on sensitive data passed via HTTP GET or POST methods by the affected software. An attacker could...

Cisco Integrated Management Controller Privilege Escalation Vulnerability

Cisco Integrated Management Controller contains a vulnerability that could allow an authenticated, local attacker to gain shell-level access to the affected device. The vulnerability is due to improper input validation in the map-nfs command. An attacker could exploit this vulnerability by sendin...

Cisco Unified Communications Manager Service Interface Reflected Cross-Site Scripting Vulnerability

A vulnerability in the CCM Service interface of the Cisco Unified Communications Manager Server contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of the affected system. The vulnerabilit...

Cisco Unified Communications Manager Admin Interface Reflected Cross-Site Scripting Vulnerability

A vulnerability in the CCM admin interface of the Cisco Unified Communications Manager Server contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of the affected system. The vulnerability ...

Cisco WebEx MeetMeNow Server Directory Traversal Vulnerability

A vulnerability in a PHP file in the Cisco WebEx MeetMeNow Server could allow an authenticated, remote attacker to obtain the contents of arbitrary files on an affected device. The vulnerability is due to improper sanitization of user input. An exploit could allow the attacker to view the content...

Cisco WebEx Meetings Server User Enumeration Vulnerability

A vulnerability in the web framework of Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to enumerate valid user accounts. The vulnerability is due to improper sanitization of a returned message. An attacker could exploit this vulnerability by sending crafted URL reques...

Cisco Unified Contact Center Express Arbitrary File Upload Vulnerability

A vulnerability in Document Management of Cisco Unified Contact Center Express could allow an authenticated, remote attacker to upload files to arbitrary locations on the filesystem. The vulnerability is due to insufficient parameter validation. An attacker could exploit this vulnerability by...

Cisco Unified Communications Manager Sensitive Information Disclosure Vulnerability

A vulnerability in Cisco IP Manager Assistant IPMA of Cisco Unified Communications Manager Cisco Unified CM could allow an unauthenticated, remote attacker to access sensitive information on the affected device. The vulnerability is due to improper validation of user input. An attacker could...

Cisco Network Registrar DHCPv6 Denial of Service Vulnerability

A vulnerability in the DHCPv6 server module of Cisco Network Registrar could allow an unauthenticated, remote attacker to cause a reload of the DHCPv6 server on an affected device. The vulnerability is due to the way certain malformed requests are processed. An attacker could exploit this...

Cisco Unified Communications Manager CAPF CSR Arbitrary File Read/Write Vulnerability

A vulnerability in the Certificate Authority Proxy Function CAPF command-line function for Certificate Signing Request CSR management of Cisco Unified Communications Manager Cisco Unified CM could allow an authenticated, local attacker to read or write arbitrary files to the underlying operating...

Cisco Unified Computing System Central Software Privilege Escalation Vulnerability

A vulnerability in the local-mgmt context in Cisco Unified Computing System Central Software could allow an authenticated, local attacker to gain shell-level access to the affected device. The vulnerability is due to improper input validation in the copy command. An attacker could exploit this...

Multiple Vulnerabilities in Cisco IPS Software

Cisco Intrusion Prevention System IPS Software is affected by the following vulnerabilities: Cisco IPS Analysis Engine Denial of Service Vulnerability Cisco IPS Control-Plane MainApp Denial of Service Vulnerability Cisco IPS Jumbo Frame Denial of Service Vulnerability The Cisco IPS Analysis Engin...

Cisco NX-OS Software TACACS+ Command Authorization Vulnerability

A vulnerability in the TACACS+ command authorization code of Cisco NX-OS Software could allow an authenticated, local attacker to execute certain commands without TACACS+ server authorization. The vulnerability is due to the processing of certain commands when executed in a sequence. An attacker...

Cisco ISE Support Information Download Authentication Bypass Vulnerability

A vulnerability in the implementation of the authentication code that is used to validate requests to download a product support bundle could allow an unauthenticated, remote attacker to download a full product support bundle. The vulnerability is due to an error in the logic that is used to...

Cisco Unified Computing System Fabric Interconnect Man-In-The-Middle Vulnerability

A vulnerability in the Fabric Interconnect KVM module of Cisco Unified Computing System could allow an unauthenticated, remote attacker to execute a man-in-the-middle attack. The vulnerability is due to the virtual KVM sending video data unencrypted. An attacker could exploit this vulnerability b...

Cisco WebEx Meetings Server Deployment Passphrase Bypass Vulnerability

A vulnerability in the deployment module of Cisco WebEx Meeting Center could allow an unauthenticated, remote attacker to bypass the passphrase check during the deployment of a virtual machine. The vulnerability is due to a flaw in the validation of the passphrase. An attacker could exploit this...

Cisco Nexus 1000V License Installation Command Injection Vulnerability

A vulnerability in the license installation module of Cisco Nexus 1000V could allow an authenticated, local attacker to execute arbitrary shell commands. The vulnerability is due to a failure of the install license command to properly validate user-supplied input. An attacker could exploit this...

Cisco ASA Clientless SSL VPN CIFS Denial of Service Vulnerability

A vulnerability in the implementation of the rewriter module of the Cisco Adaptive Security Appliance ASA Clientless SSL VPN could allow an authenticated, remote attacker to cause a reload of the affected system. The vulnerability is due to a race condition while accessing resources via the Commo...

Cisco Emergency Responder Remote Denial of Service Vulnerability

Cisco Emergency Responder contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on a targeted system. The vulnerability is due to the improper handling of malformed UDP packets by the affected software. An unauthenticated, remote...

CiscoWorks Common Services Arbitrary Code Execution Vulnerability

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES TH...

Cisco Unified Communications Manager Session Initiation Protocol Denial of Service Vulnerabilities

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES TH...

Sudo sudoedit Local Command Privilege Escalation Vulnerability

Sudo contains a vulnerability that could allow an authenticated, local attacker to execute arbitrary commands with elevated privileges. This vulnerability exists due to an error in the affected software while matching commands due to incorrect path resolution. A local attacker with privileges to...

Cisco IOS Software Border Gateway Protocol 4-Byte Autonomous System Number Vulnerabilities

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES TH...

Multiple Vulnerabilities in Cisco PIX and Cisco ASA

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES TH...

Cisco Service Control Engine Denial of Service Vulnerabilities

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES TH...

Wireless ARP Storm Vulnerabilities

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES TH...

Cisco Secure Access Control Server Accounting-Request Buffer Overflow Vulnerability

Cisco Secure Access Control Server for Windows and Cisco Secure Access Control Server Solution Engine contain a vulnerability that could allow an authenticated, remote attacker to cause a denial of service DoS condition or execute arbitrary code. The vulnerability exists due to insufficient input...

IOS HTTP Server Command Injection Vulnerability

A vulnerability exists in the IOS HTTP server in which HTML code inserted into dynamically generated output, such as the output from a show buffers command, will be passed to the browser requesting the page. This HTML code could be interpreted by the client browser and potentially execute malicio...

Cisco Secure ACS Unix Acme.server Information Disclosure Vulnerability

...

Cisco IOS XE Software TLS Memory Exhaustion Denial of Service Vulnerability

A vulnerability in the TLS library of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to exhaust the available memory of an affected device. This vulnerability is due to improper management of memory resources during TLS connection setup. An attacker could exploit this...