Cisco NX-OS Software TACACS+ Command Authorization Vulnerability

A vulnerability in the TACACS+ command authorization feature of Cisco NX-OS Software could allow an authenticated, local attacker to cause the system to reset. The vulnerability is due to incorrect processing of very long command-line interface CLI commands by the TACACS+ command authorization...

Cisco Secure Access Control Server Privilege Escalation Vulnerability

A vulnerability in role-based access control in Cisco Secure Access Control Server ACS could allow an authenticated, remote attacker to take actions with an elevated authorization level. The vulnerability is due to improper privilege validation. An attacker could exploit the vulnerability by...

Cisco MDS 9000 Series Denial of Service Vulnerability

A vulnerability in the high availability HA subsystem of Cisco NX-OS running on MDS 9000 series devices could allow an unauthenticated, remote attacker to cause a denial of device DoS condition. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerabilit...

Cisco IOS XR Software Malformed RSVP Packet Denial of Service Vulnerability

A vulnerability in RSVP processing of Cisco IOS XR could allow an unauthenticated, remote attacker to cause a reload of the RSVP process on the affected device. The vulnerability is due to improper parsing of a malformed RSVP packet. An attacker could exploit this vulnerability by sending a...

Cisco Unified Communications Manager IM and Presence Service Enumeration Vulnerability

A vulnerability in the web framework of the Cisco Unified Communications Manager IM and Presence Service could allow an unauthenticated, remote attacker to enumerate valid user accounts. The vulnerability is due to improper sanitization of a returned message. An attacker could exploit this...

Cisco NX-OS Software SNMP Information Disclosure Vulnerability

A vulnerability in the Simple Network Management Protocol SNMP module of Cisco NX-OS Software could allow an unauthenticated, remote attacker to access sensitive information. The vulnerability is due to a failure to respond to invalid requests in the same manner when specifying a VLAN ID. An...

Cisco Unified Customer Voice Portal Cross-Site Scripting Vulnerability

A vulnerability in the web based administration interface of the Cisco Unified Customer Voice Portal CVP could allow an unauthenticated, remote attacker to perform a cross-site scripting XSS attack against the user of a web interface. The vulnerability is due to insufficient input validation of a...

Cisco Prime Data Center Network Manager Cross-Site Scripting Vulnerability

A vulnerability in the web server hosting the Cisco Prime Data Center Network Manager could allow an unauthenticated, remote attacker to perform a cross-site scripting XSS attack against the user of the web interface. The issue is due to insufficient input validation of parameters by the web...

Cisco WebEx Meetings Server OutlookAction Class Vulnerability

A vulnerability in the OutlookAction Class of Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to enumerate valid user accounts. The vulnerability is due to improper sanitization of a returned message. An attacker could exploit this vulnerability by sending crafted URL...

Cisco WebEx Meetings Server Authenticated Encryption Vulnerability

A vulnerability in the user.php script of Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to view sensitive information. The vulnerability is due to an invalid token timer. An attacker could exploit this vulnerability by submitting crafted URL requests to a vulnerable...

Cisco Intelligent Automation for Cloud Form Data Viewer Utility Vulnerability

A vulnerability in the Form Data Viewer utility of Cisco Intelligent Automation for Cloud could allow an authenticated, remote attacker to view passwords of provisioned systems. The vulnerability is due to the inclusion of passwords in the form data. An attacker could exploit this vulnerability b...

Cisco IOS XE Software Autonomic Networking Infrastructure Overwrite Vulnerability

A vulnerability in the multicast Domain Name System mDNS used for autonomic networking in Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to read or overwrite autonomic networking services discovered via mDNS. The vulnerability is due to unconstrained autonomic networking...

Cisco Broadcast Access Center for Telco and Wireless Cross-Site Scripting Vulnerability

A vulnerability in the web framework of the Cisco Broadcast Access Center for Telco and Wireless BAC-TW could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the Cisco BAC-TW web interface. The vulnerability is due to insufficient input...

Cisco Unified Communications Manager CMIVR Blind SQL Injection Vulnerability

A vulnerability in the Cisco Unified Communications Manager UCM Unified CallManager Interactive Voice Response CMIVR interface could allow an unauthenticated, remote attacker to impact the integrity of the system by executing arbitrary SQL queries. The vulnerability is due to a lack of input...

Cisco Cloud Portal Unauthenticated File Download Vulnerability

A vulnerability in the web interface of Cisco Cloud Portal could allow an unauthenticated, remote attacker to download certain file types from a vulnerable server. The vulnerability is due to insufficient enforcement of access controls for certain file types. An attacker could exploit this...

Cisco Unified IP Phone 8900/9900 Series Insecure File Permissions Vulnerability

A vulnerability in Cisco Unified IP Phone 9951, Cisco Unified IP Phone 9971, and Cisco Unified IP Phone 8961 could allow an authenticated, local attacker to fully compromise the affected device. The vulnerability is due to insecure file permissions on memory block devices. An attacker could explo...

Cisco Adaptive Security Appliance Phone Proxy Database Entry Manipulation Vulnerability

A vulnerability in the phone proxy feature of the Cisco Adaptive Security Appliance ASA could allow an unauthenticated, remote attacker to temporarily insert an invalid entry in the phone proxy connection database. The vulnerability is due to the acceptance of an untrusted certificate. An attacke...

Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability

A vulnerability exists in the Session Initiation Protocol SIP implementation in Cisco IOS Software that could allow an unauthenticated, remote attacker to cause a reload of an affected device or cause memory leaks that may result in system instabilities. To exploit this vulnerability, affected...

Cisco Adaptive Security Appliance Software Clientless SSL VPN Rewriter Denial of Service Vulnerability

A vulnerability in the clientless SSL VPN feature of Cisco Adaptive Security Appliance ASA Software could allow an authenticated, remote attacker to cause an affected system to reload. The vulnerability is due to a stack overflow while browsing internal resources via the clientless SSL VPN portal...

Cisco Unified IP Phones 9900 Series Image Upgrade Command Injection Vulnerability

A vulnerability in the image upgrade facility of Cisco Unified IP Phones 9900 Series could allow an authenticated, local attacker to execute commands within the context of the underlying operating system. The vulnerability is due to insufficient sanitization of input during the image upgrade...

Cisco Firewall Services Module Command Authorization Vulnerability

A vulnerability in the authorization code of the Cisco Firewall Services Module FWSM could allow an authenticated but unprivileged, local attacker to delete, modify, or view the configuration of any other context of the affected system. The vulnerability is due to insufficient authorization...

Cisco Unified Computing System Fabric Interconnect Remote Access Vulnerability

A vulnerability in the high availability service of Cisco Unified Computing System Fabric Interconnect could allow an unauthenticated, remote attacker to gain access to sensitive information and prevent the cluster service from syncing with its peers. The vulnerability is due to improper binding ...

Multiple Cisco Products Common Services ActiveMQ Denial of Service Vulnerability

A vulnerability in the integration of the ActiveMQ component used in products based on Common Services could allow an unauthenticated, remote attacker to consume available memory and cause a denial of service DoS condition. The vulnerability is due to improper handling of multiple TCP requests...

Cisco IOS XR Internet Control Message Protocol Denial of Service Vulnerability

Cisco IOS XR Software is affected by a denial of service DoS vulnerability that could allow an authenticated, local attacker to trigger a reload of the affected device by locally generating certain Internet Control Message Protocol ICMP messages. The vulnerability is due to a combination of Silic...

Cisco Unified IP Conference Station 7937G Denial of Service Vulnerability

A vulnerability in processing network traffic of the Cisco Unified IP Conference Station 7937G could allow an unauthenticated, remote attacker to create a denial of service DoS condition on the affected device. The vulnerability is due to resource constraints in processing a high rate of network...

Cisco Unified Communications Manager Remote Blind SQL Injection Vulnerability

Cisco Unified Communication Manager Unified CM contains a vulnerability that could allow an unauthenticated, remote attacker to execute a blind Structured Query Language SQL injection. The vulnerability is due to improper validation of user-supplied requests by the Cisco Unified CM. An attacker...

Cisco Unified Communications Management Products Cross-Site Scripting Vulnerability

A vulnerability in the web framework of Cisco unified communications management products could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface on the affected system. The vulnerability is due to insufficient input validati...

Cisco TC Software SIP Implementation Vulnerability

A vulnerability in the Session Initiation Protocol SIP implementation used in TC Software could allow an unauthenticated, remoteattacker to cause an endpoint to process unintended SIP NOTIFY messages. The vulnerability is due to errors in the SIP implementation. An attacker could exploit this...

Cisco WebEx Social Cross-Site Request Forgery Vulnerability

A vulnerability in multiple web pages of Cisco WebEx Social could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against the user of the web interface. The vulnerability is due to insufficient CSRF protections. An attacker could exploit this...

Cisco Nexus 1000V VSM/VEM Communication Encryption Bypass Vulnerability

A vulnerability in the implementation of the encryption for the Virtual Supervisor Module VSM to Virtual Ethernet Module VEM communications on the Cisco Nexus 1000V could allow an unauthenticated, remote attacker to to disable encryption and integrity protections on a per-packet basis. The...

Cisco Jabber Extensible Communications Platform Connection Manager Vulnerability

A vulnerability in the Connection Manager component of Cisco Jabber Extensible Communications Platform Jabber XCP could allow an unauthenticated, remote attacker to crash the login connection manager service. The vulnerability is due to insufficient checking of received login data. An attacker...

Cisco Tivoli Business Service Manager Denial of Service Vulnerability

Cisco Tivoli Business Service Manager TBSM, which is part of Cisco Hosted Collaboration Mediation HCM, contains a vulnerability that could allow an unauthenticated, remote attacker to cause a partial denial of service DoS. An attacker could exploit this vulnerability by sending a flood of TCP...

Cisco Unified MeetingPlace Server Cross-Site Scripting Vulnerability

Cisco Unified MeetingPlace Server contains a vulnerability that could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability is due to insufficient sanitization of user-supplied input processed by the Cisco Unified MeetingPlace software. An...

Cisco Secure Access Control System TACACS+ Authentication Bypass Vulnerability

Cisco Secure Access Control System ACS contains a vulnerability that could allow an unauthenticated, remote attacker to bypass TACACS+ based authentication services offered by the affected application. The vulnerability is due to improper validation of user-supplied input processed by the affecte...

Buffer Overflow Vulnerabilities in the Cisco WebEx Player

Multiple buffer overflow vulnerabilities exist in the Cisco WebEx Recording Format WRF player. In some cases, exploitation of the vulnerabilities could allow a remote attacker to execute arbitrary code on the system with the privileges of a targeted user. The Cisco WebEx Players are applications...

Multiple Vulnerabilities in Cisco Unified IP Phones 7900 Series

...

Cisco ASA Adaptive Security Appliance Clientless SSL VPN CIFS and FTP Credential Theft Vulnerability

Cisco ASA Adaptive Security Appliance Software versions prior to 8.0.434, 8.1.225, and 8.2.13 that have been configured to accept Clientless SSL VPN connections contain a vulnerability that could allow an unauthenticated, remote attacker to steal user account credentials. Versions 7.x are not...

Cisco Firewall Services Module HTTPS Request Denial of Service Vulnerability

Cisco Firewall Services Module versions prior to 3.13.18 contain a vulnerability that could allow an unauthenticated, remote attacker to create a temporary denial of service DoS condition. The vulnerability is due to an error when handling malformed HTTPS requests on devices that are configured t...

LDAP Connection Leak in CTI when User Authentication Fails

...

Cisco IOS Command History Release at Login Prompt

...

Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability

A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. This vulnerability exists because the affected software does not properly validate...

Cisco SG350 and SG350X Series Managed Switches SNMP Denial of Service Vulnerability

A vulnerability in the Simple Network Management Protocol SNMP subsystem of Cisco 350 Series Managed Switches SG350 and Cisco 350X Series Stackable Managed Switches SG350X firmware could allow an authenticated, remote attacker to cause a denial of service DoS condition on an affected device. This...

Cisco IOS XE Software HTTP API Command Injection Vulnerability

A vulnerability in the HTTP API subsystem of Cisco IOS XE Software could allow a remote attacker to inject commands that will execute with root privileges into the underlying operating system. This vulnerability is due to insufficient input validation. An attacker with administrative privileges...

Cisco Unified Contact Center Express Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express Unified CCX could allow an authenticated, remote attacker to perform a stored cross-site scripting XSS attack or execute arbitrary code on an affected device. To exploit these vulnerabilities, t...

Cisco Catalyst SD-WAN Manager Stored Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to conduct a stored cross-site scripting attack XSS on an affected system. This vulnerability is due to improper sanitization of use...

Cisco Nexus 3000 and 9000 Series Switches Command Injection Vulnerability

A vulnerability in the software upgrade process of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, local attacker with valid Administrator credentials to execute a command injection attack on the underlying operating...

Cisco Meeting Management Information Disclosure Vulnerability

A vulnerability in the logging subsystem of Cisco Meeting Management could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerability is due to improper storage of sensitive information within the web-based management interface of...

Cisco IOS XE Software IPv4 Fragmentation Reassembly Denial of Service Vulnerability

A vulnerability in the implementation of the IPv4 fragmentation reassembly code in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper management of resources during fragment...

Cisco Identity Services Engine REST API Blind SQL Injection Vulnerabilities

Multiple vulnerabilities in the REST API of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to conduct blind SQL injection attacks. These vulnerabilities are due to insufficient validation of user-supplied input in REST API calls. An attacker could exploit these...

Cisco Crosswork Network Services Orchestrator Privilege Escalation Vulnerability

A vulnerability in the Tail-f High Availability Cluster Communications HCC function pack of Cisco Crosswork Network Services Orchestrator NSO could allow an authenticated, local attacker to elevate privileges to root on an affected device. This vulnerability exists because a user-controlled searc...