Cisco Enterprise NFV Infrastructure Software Path Traversal Vulnerability

A vulnerability in the directory permissions of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to perform a directory traversal attack on a limited set of restricted directories. The vulnerability is due to a flaw in the logic that governs directo...

Cisco UCS Manager Software Local Management CLI Denial of Service Vulnerability

A vulnerability in the local management local-mgmt CLI of Cisco UCS Manager Software could allow an authenticated, local attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper handling of CLI command parameters. An attacker could exploit th...

Cisco AnyConnect Secure Mobility Client for Mac OS File Corruption Vulnerability

A vulnerability in the uninstaller component of Cisco AnyConnect Secure Mobility Client for Mac OS could allow an authenticated, local attacker to corrupt the content of any file in the filesystem. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit th...

Cisco IOS XE Software Catalyst 9800 Series Wireless Controllers Denial of Service Vulnerability

A vulnerability in the locally significant certificate LSC provisioning feature of Cisco Catalyst 9800 Series Wireless Controllers that are running Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak that could lead to a denial of service DoS condition. Th...

Cisco Unity Connection Directory Traversal Vulnerability

A vulnerability in the web management interface of Cisco Unity Connection could allow an authenticated remote attacker to overwrite files on the underlying filesystem. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted HTTP...

Cisco Unified Communications Manager Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view sensitive information in the web-based management interface of the affected software. The vulnerability is due to insufficient protection of...

Cisco SD-WAN Solution Command Injection Vulnerability

A vulnerability in the command-line interface CLI in the Cisco SD-WAN Solution could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability ...

Cisco FXOS and NX-OS Software Cisco Fabric Services Arbitrary Code Execution Vulnerability

A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service DoS condition on an affected device. The vulnerability exists because the affected software...

Cisco Small Business 300 and 500 Series Managed Switches Cross-Site Scripting Vulnerability

A vulnerability in the web framework of Cisco Small Business Managed Switches software could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input...

Cisco Integrated Management Controller User Session Hijacking Vulnerability

A vulnerability in the session identification management functionality of the web-based GUI of Cisco Integrated Management Controller IMC could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. The vulnerability exists because the affected software do...

Cisco IOS and IOS XE Software Data in Motion Component Denial of Service Vulnerability

A vulnerability in the Cisco Data in Motion DMo component for Cisco IOS and IOS XE Software with the IOx feature set could allow an unauthenticated, remote attacker to cause a partial denial of service DoS condition for the DMo process on a targeted system. The vulnerability is due to insufficien...

Cisco Wireless LAN Controller HTTP Parsing Denial of Service Vulnerability

A vulnerability in the HTTP URL redirect feature of Cisco Wireless LAN Controller WLC Software could allow an unauthenticated, remote attacker to cause a buffer overflow condition on an affected device, resulting in a denial of service DoS condition. The vulnerability is due to improper handling ...

Cisco Prime Infrastructure and Evolved Programmable Network Manager Privilege Escalation API Vulnerability

A vulnerability in the web application programming interface API of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager EPNM could allow an authenticated, remote attacker to gain elevated privileges. The vulnerability is due to improper role-based access control RBAC when an...

Cisco Prime Infrastructure Log File Remote Code Execution Vulnerability

A vulnerability in the log file handling for Cisco Prime Infrastructure could allow an authenticated, remote attacker to change and modify the system log file. The log file could have executable code added to it that could be executed when the log file is viewed. The vulnerability is due to lack ...

Cisco Firepower 9000 Operating System Command Injection Vulnerability

A vulnerability in a user script supplied with Cisco Firepower 9000 could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system with the privileges of the authenticated user. The script can be accessed via the web interface. The vulnerability is...

Cisco Wireless LAN Controller RADIUS Packet of Disconnect Vulnerability

A vulnerability in the RADIUS implementation of the Cisco Wireless LAN Controller WLC could allow an unauthenticated, remote attacker to cause a partial denial of service DoS condition by disconnecting user sessions. The vulnerability is due to a lack of proper input validation of the RADIUS...

Cisco AnyConnect Secure Mobilty Client Directory Traversal Vulnerability

A vulnerability in the connection establishment process of Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, remote attacker to write or overwrite files in the active user's context. The vulnerability is due to insufficient input validation. An unauthenticated, remote attack...

Cisco Adaptive Security Appliance Software OSPFv2 Denial of Service Vulnerability

A vulnerability in the Open Shortest Path First version 2 OSPFv2 code of Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, adjacent attacker to cause the reload of the affected system. The vulnerability is due to improper handling of OSPFv2 packets. An attacker could...

Cisco FireSIGHT Management Center Cross-Site Request Forgery Vulnerability

A vulnerability in the Cisco FireSIGHT Management Center which could allow an unauthenticated, remote attacker to execute unwanted actions. The vulnerability is due to insufficient cross-site request forgery CSRF protections. An attacker could exploit this vulnerability by tricking the user of a...

Cisco Virtual WSA, ESA, and SMA Default SSH Host Keys Vulnerability

A vulnerability in the remote support functionality of Cisco WSAv, Cisco ESAv, and Cisco SMAv Software could allow an unauthenticated, remote attacker to decrypt and impersonate secure communication between any virtual content security appliances. The vulnerability is due to the presence of...

Cisco Unified Presence Server Cross-Site Scripting Vulnerability

A vulnerability in the Cisco Unified Presence Server could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of the affected system. The vulnerability is due to insufficient input validation of a user-supplied value. An...

Cisco Identity Services Engine and Secure Access Control System Support Bundle Download Vulnerability

A vulnerability in Cisco Identity Services Engine and Secure Access Control System could allow an authenticated, remote attacker to gain unauthorized access to program data. The vulnerability is due to weak authentication and authorization used to control access to support bundles stored on a...

Cisco Unified MeetingPlace Plain Text Password Information Disclosure Vulnerability

A vulnerability in Cisco Unified MeetingPlace could allow an authenticated, remote attacker to view passwords in plain text. The vulnerability is due to the inclusion of sensitive information in the web page source code of the affected software. An attacker could exploit this vulnerability to vie...

Cisco IOS Software UBR Devices SNMP Subsystem Denial of Service Vulnerability

A vulnerability in the SNMP subsystem of Cisco Universal Broadband Router devices could allow an authenticated, remote attacker to cause a crash of the Parallel Express Forwarding PXF process on the Performance Routing Engine PRE module. The vulnerability is due to a memory leak that occurs when...

Cisco IOS XR Software Crafted IPv6 Packet Denial of Service Vulnerability

A vulnerability in the IP version 6 IPv6 processing code of Cisco IOS XR Software for Cisco CRS-3 Carrier Routing System could allow an unauthenticated, remote attacker to trigger an ASIC scan of the Network Processor Unit NPU and a reload of the line card processing an IPv6 packet. The...

Cisco Unified MeetingPlace Session ID Information Disclosure Vulnerability

A vulnerability in the Cisco Unified MeetingPlace application could allow an unauthenticated, remote attacker to obtain sensitive information. The Cisco Unified MeetingPlace application does not always properly validate the session ID in the HTTP URL. This could allow an attacker to obtain...

Multiple Cisco Products TCP Flood Denial of Service Vulnerability

A vulnerability in the TCP module of multiple Cisco products could allow an unauthenticated, remote attacker to disable TCP ports and cause an increase in CPU and memory usage, resulting in a denial of service DoS condition. The vulnerability is due to a lack of rate limiting in the TCP listener...

Cisco Email Security Appliance Cross-Site Scripting Vulnerability

A vulnerability in the Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to perform a cross-site scripting XSS attack. The vulnerability is due to insufficient input validation of some parameters passed via HTTP GET or POST methods. An attacker could exploit this...

Cisco Wide Area Application Services Server Message Block Protocol Module Denial of Service Vulnerability

A vulnerability in the Server Message Block Protocol SMB module of Cisco Wide Area Application Services WAAS could allow an unauthenticated, remote attacker to cause a reload of the SMB module. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by...

Cisco Wireless LAN Controller Wireless Web Authentication Denial of Service Vulnerability

A vulnerability in the wireless web authentication subsystem of Cisco Wireless LAN Controller WLC could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition. The vulnerability exists due to improper input sanitization of a certain value that is supplied by a user...

Cisco FireSIGHT Management Center Web Framework Stored Cross-Site Scripting Vulnerability

A vulnerability in the web framework of Cisco FireSIGHT Management Center MC could allow an authenticated, remote attacker to execute a stored cross-site scripting XSS attack against the user of the web interface. The vulnerability is due to improper sanitization of parameter values. An attacker...

Cisco Unified MeetingPlace Administrative Web Interface Reflected Cross-Site Scripting Vulnerability

A vulnerability in the administrative web interface of Cisco Unified MeetingPlace could allow an unauthenticated, remote attacker to perform a reflected cross-site scripting XSS attack on an affected system. The vulnerability is due to improper validation of user-supplied input by the affected...

Cisco Secure Access Control Server Dashboard Page Cross-Site Request Forgery Vulnerability

A vulnerability in the Dashboard page in the monitoring and report section of Cisco Secure Access Control Server could allow an unauthenticated, remote attacker to perform a cross-site request forgery CSRF attack. The vulnerability is due to the improper generation and validation of the CSRF toke...

Cisco Web Security Appliance Pickle Python Module Arbitrary Code Execution Vulnerability

A vulnerability in the status checking process of support remote access tunnels in the Cisco Web Security Appliance WSA could allow an authenticated, local attacker to execute arbitrary Python code on a targeted system. The vulnerability is due to improper use and handling of the pickle Python...

Cisco ASR1000 Series Routers ESP Module Denial of Service Vulnerability

A vulnerability in the Embedded Services Processor ESP module of Cisco ASR 1000 Series Routers running Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to improper handling of malformed H.323 packets by an...

Cisco Identity Services Engine Portal Privilege Elevation Vulnerability

A vulnerability in the Sponsor Portal of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to access guest accounts created from another sponsor account. The vulnerability is due to a failure to restrict guest accounts across sponsors. An attacker could exploit this...

Cisco Content Services Switch (11500) Unauthenticated Port Forwarding Vulnerability

A vulnerability in the Management Interface of the Cisco Content Services Switch 11500 could allow an unauthenticated, remote attacker to gain unauthorized access to other devices on the network. The vulnerability is due to improper handling of SSH packets. An attacker could exploit this...

Cisco AnyConnect Secure Mobility Client Arbitrary Code Execution Vulnerability

A vulnerability in the inter-process communication IPC channel of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker to execute arbitrary code with elevated privileges. The vulnerability is due to unauthenticated IPC commands which allow software installation as...

Cisco ACE 4710 Application Control Engine and Application Networking Manager Cross-Site Request Forgery Vulnerability

A vulnerability in the web GUI of the Cisco Application Networking Manager ANM and the Device Manager DM in the Cisco ACE 4710 Application Control Engine ACE Appliance could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against the user of the web...

Cisco Web Security Appliance Cross-Site Scripting Vulnerability

A vulnerability in the Administrator report page of the Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by...

Cisco Adaptive Security Appliance WebVPN Content Rewriter Denial of Service Vulnerability

A vulnerability in the WebVPN functionality of Cisco Adaptive Security Appliance ASA could allow an authenticated, remote attacker to cause an affected device to crash. The vulnerability is due to a fault in the Proxy Bypass Content Rewriter implementation. An attacker could exploit this...

Cisco Unified IP Phone 9900 Series Denial of Service Vulnerability

A vulnerability in the Cisco Unified IP Phone 9900 Series could allow an authenticated, local attacker to cause a denial of service DoS condition on the affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted...

Cisco Unified IP Phone 9900 Series Mobility Extension Availability Vulnerability

A vulnerability in the mobility extension support of Cisco Unified IP Phone 9900 Series could allow an unauthenticated, remote attacker to log off the mobility extension user. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability ...

Cisco WebEx Meetings Server User Enumeration Vulnerability

A vulnerability in the web framework of Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to enumerate valid user accounts. The vulnerability is due to improper sanitization of a returned message. An attacker could exploit this vulnerability by sending crafted URL reques...

Cisco AnyConnect User Interface Dialog Rendered When Connecting to Arbitrary Hosts Vulnerability

A vulnerability in Cisco AnyConnect for Android and Mac OS X could allow an unauthenticated, remote attacker to force the rendering of an authentication form in the client. The vulnerability is due to insufficient validation of the type of host to which AnyConnect establishes a connection. An...

Cisco Prime Infrastructure Device Discovery Password Disclosure Vulnerability

A vulnerability in the web interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to view the passwords stored for device discovery. The vulnerability occurs because the Quick Discovery options page contains the stored password in the HMTL page source. An attacker...

Cisco IOS XR Software lighttpd TCP Session Vulnerability

A vulnerability in the lighttpd module of Cisco IOS XR could allow an unauthenticated, remote attacker to cause a reload of the affected lighttpd process. The vulnerability is due to a race condition while handling TCP sessions to the lighttpd module on the affected Cisco IOS XR device. An attack...

Cisco Intrusion Prevention System IP Logging Denial of Service Vulnerability

A vulnerability in the IP logging feature of Cisco Intrusion Prevention System IPS Software could allow an unauthenticated, remote attacker to cause a reload of the affected system. The vulnerability is due to a race condition when writing the IP logging file. An attacker could exploit this...

Cisco Unified Communications Manager CTIManager Vulnerability

A vulnerability in the CTIManager module of Cisco Unified Communications Manager Cisco Unified CM could allow an authenticated, remote attacker to execute arbitrary commands with elevated privileges. The vulnerability is due to a failure to properly validate input contained within Kerberos single...

Cisco Unified Communications Manager Real-Time Monitoring Tool Path Traversal Vulnerability

A vulnerability in the Real-Time Monitoring Tool RTMT of Cisco Unified Communications Manager Cisco Unified CM could allow an authenticated, remote attacker to download files from arbitrary locations on the filesystem. The vulnerability is due to insufficient input validation. An attacker could...