5246 matches found
Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms CLI Privilege Escalation Vulnerability
A vulnerability in command execution from the command line-interface CLI of Cisco Access Point AP platforms could allow an authenticated, local attacker to perform privilege escalation to root-level privileges. The vulnerability occurs because user input is not properly sanitized for certain...
Cisco Identity Services Engine Admin Dashboard Page Cross-Site Scripting Vulnerability
A vulnerability in the web framework code of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack. The vulnerability is due to insufficient input validation of some parameters passed to the web server. An attacker could...
Cisco Application Policy Infrastructure Controller Enterprise Module Remote Code Execution Vulnerability
A vulnerability in the Grapevine update process of the Cisco Application Policy Infrastructure Controller Enterprise Module APIC-EM could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system with the privileges of the root user. The vulnerabilit...
Cisco Firepower Management Center Remote Command Execution Vulnerability
A vulnerability in the web-based GUI of Cisco Firepower Management Center and Cisco Adaptive Security Appliance ASA 5500-X Series with FirePOWER Services could allow an authenticated, remote attacker to perform unauthorized remote command execution on the affected device. The vulnerability is due...
Cisco IP Phone 8800 Series Denial of Service Vulnerability
A vulnerability in the web server of the Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to improper validation of user-supplied input by the affected software. An attacker could exploit this...
Cisco Firepower Management Center Cross-Site Scripting Vulnerability
A vulnerability in the web framework of Cisco Firepower Management Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation for some of t...
Cisco Firepower Management Center Privilege Escalation Vulnerability
A vulnerability in the web-based GUI of Cisco Firepower Management Center and Cisco Adaptive Security Appliance ASA 5500-X Series with FirePOWER Services could allow an authenticated, remote attacker to elevate the privileges of user accounts on the affected device. The vulnerability is due to...
Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms AMPDU Denial of Service Vulnerability
A vulnerability in the Aggregated MAC Protocol Data Unit AMPDU implementation in Cisco Access Point AP platforms could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition. The vulnerability is due to incomplete input validation of the AMPDU packet header. An...
Cisco WebEx Meetings Server Information Disclosure Vulnerability
A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to access sensitive data. The vulnerability is due to lack of proper authentication controls. An attacker could exploit this vulnerability to learn sensitive information about the application. Cisco has...
Cisco Connected Streaming Analytics Unauthorized Access Vulnerability
A vulnerability in the administrative web interface of Cisco Connected Streaming Analytics could allow an authenticated, remote attacker to obtain sensitive information. The vulnerability is due to the inclusion of sensitive information in a server response when certain pages of the administrativ...
Cisco IP Phone 8800 Series Cross-Site Scripting Vulnerability
A vulnerability in the web application of the Cisco IP Phone 8800 Series could allow an authenticated, remote attacker to perform a stored, cross-site scripting XSS attack. The vulnerability is due to insufficient sanitization of parameter values. An attacker could exploit this vulnerability by...
Cisco IOS XR Software for Cisco ASR 9001 Aggregation Services Routers Fragmented Packet Denial of Service Vulnerability
A vulnerability in the driver processing functions of Cisco IOS XR Software for Cisco ASR 9001 Aggregation Services Routers could allow an unauthenticated, remote attacker to cause a memory leak on the route processor RP of an affected device, which could cause the device to drop all control-plan...
Cisco IOS and IOS XE Software Crafted Network Time Protocol Packets Denial of Service Vulnerability
A vulnerability in the processing of Network Time Protocol NTP packets by Cisco IOS and Cisco IOS XE could allow an unauthenticated, remote attacker to cause an interface wedge and an eventual denial of service DoS condition on the affected device. The vulnerability is due to insufficient checks ...
Cisco RV110W, RV130W, and RV215W Routers Command Shell Injection Vulnerability
A vulnerability in the command-line interface CLI command parser of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an authenticated, local attacker to inject arbitrary shell commands that are executed ...
Cisco TelePresence Video Communication Server Expressway Command Injection Vulnerability
A vulnerability in the administrative web interface of Cisco TelePresence Video Communication Server Expressway could allow an authenticated, remote attacker to execute arbitrary commands on the affected system. The vulnerability is due to the failure to properly sanitize user input passed to the...
Cisco RV110W, RV130W, and RV215W Routers Static Credential Vulnerability
A vulnerability in the default account when used with a specific configuration of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and the Cisco RV215W Wireless-N VPN Router could allow an authenticated, remote attacker to gain root access to the device...
Cisco Prime Infrastructure Cross-Frame Scripting Vulnerability
A vulnerability in the web interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to execute a cross-frame scripting XFS attack. This vulnerability is due to insufficient HTML iframe protection. An attacker could exploit this vulnerability by directing a user to a...
Cisco Unified Communications Manager IM and Presence Service SIP Packet Processing Denial of Service Vulnerability
A vulnerability in Session Initiation Protocol SIP processing functions of the Cisco Unified Communications Manager Instant Messaging IM and Presence Service could allow an unauthenticated, remote attacker to cause the Cisco SIP Proxy Daemon sipd process to restart unexpectedly, resulting in a...
Cisco RV180 VPN and RV180W Wireless-N Multifunction VPN Routers Unauthorized Access Vulnerability
A vulnerability in the web interface of the Cisco RV180 VPN Router and Cisco RV180W Wireless-N Multifunction VPN Router could allow an unauthenticated, remote attacker to access arbitrary files on the system. This vulnerability allows the attacker to perform directory traversal. The vulnerability...
Cisco RV180 VPN and RV180W Wireless-N Multifunction VPN Routers Remote Code Execution Vulnerability
A vulnerability in the web interface of the Cisco RV180 VPN Router and Cisco RV180W Wireless-N Multifunction VPN Router could allow an authenticated, remote attacker to execute arbitrary commands with root-level privileges. The vulnerability is due to improper input validation of HTTP requests. A...
Cisco Email Security Appliance File Type Filtering Vulnerability
A vulnerability in the email message filtering feature of Cisco AsyncOS for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to cause an ESA to fail to detect and act upon a specific type of file that is attached to an email message. The vulnerability is due to...
Cisco Prime Service Catalog Reflected Cross-Site Scripting Vulnerability
A vulnerability in the HTTP web-based management interface of the Cisco Prime Service Catalog PSC could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web interface of the affected system. The vulnerability is due to...
Cisco Wireless LAN Controller Denial of Service Vulnerability
A vulnerability in wireless frame management service of the Cisco Wireless LAN Controller WLC could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition on the affected device. The vulnerability is due to insufficient handling of wireless management frames. An...
Cisco FireSIGHT System Software Snort Rule Bypass Vulnerability
A vulnerability in Snort rule detection in Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass configured rules that use Snort detection. The vulnerability is due to improper handling of HTTP header parameters. An attacker could exploit this vulnerability by...
Cisco Nexus 1000v Application Virtual Switch Cisco Discovery Protocol Packet Processing Denial of Service Vulnerability
A vulnerability in Cisco Discovery Protocol packet processing for the Cisco Nexus 1000v Application Virtual Switch AVS could allow an unauthenticated, remote attacker to cause the ESXi hypervisor to crash and display a purple diagnostic screen, resulting in a denial of service DoS condition. The...
Cisco Videoscape Session Resource Manager Denial of Service Vulnerability
A vulnerability in system resource management in the Cisco Videoscape Session Resource Manager VSRM could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition because the device unexpectedly restarts. The vulnerability occurs because the VSRM is not installed usi...
Vulnerability in Objective Systems ASN1C Compiler Affecting Cisco Products
A vulnerability in the ASN1C compiler by Objective Systems affects Cisco ASR 5000 devices running StarOS and Cisco Virtualized Packet Core VPC systems. The vulnerability could allow an unauthenticated, remote attacker to create a denial of service DoS condition or potentially execute arbitrary...
Cisco Unified Computing System Performance Manager Input Validation Vulnerability
A vulnerability in the web framework of Cisco Unified Computing System UCS Performance Manager could allow an authenticated, remote attacker to execute arbitrary commands. The vulnerability is due to insufficient input validation performed on parameters that are passed via an HTTP GET request. An...
Cisco IOS and IOS XE Software Border Gateway Protocol Message Processing Denial of Service Vulnerability
A vulnerability in Border Gateway Protocol BGP message processing functions of Cisco IOS and IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload. The vulnerability is due to improper processing of crafted BGP attributes. An attacker could exploit th...
Cisco Meeting Server Persistent Cross-Site Scripting Vulnerability
A vulnerability in the web bridge that offers video via a web interface of Cisco Meeting Server Software, formerly Acano Conferencing Server, could allow an unauthenticated, remote attacker to conduct a persistent cross-site scripting XSS attack against a user of the web interface of an affected...
Cisco WebEx Meetings Server Reflected Cross-Site Scripting Vulnerability
A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to perform reflected cross-site scripting XSS attacks. The vulnerability is due to insufficient validation of user-supplied input by the affected software. An attacker could exploit this vulnerability b...
Cisco WebEx Meetings Server Administrator Interface Cross-Site Request Forgery Vulnerability
A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against the user of the web interface. The vulnerability is due to insufficient CSRF protections. An attacker could exploit this vulnerability by...
Cisco WebEx Meetings Server Command Injection Vulnerability
A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to perform a command injection attack. The vulnerability occurs due to the expectation of a certain file type during an upload. An attacker could exploit this vulnerability by using crafted command...
Cisco WebEx Meetings Server Administrator Interface Reflected Cross-Site Scripting Vulnerability
A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct reflected cross-site scripting XSS attacks. The vulnerability is due to insufficient sanitization of user-supplied input by the affected software. An unauthenticated, remote attacker could...
Cisco WebEx Meetings Server Administrator Interface SQL Injection Vulnerability
A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries. The vulnerability is due to a lack of input validation on user-supplied input in SQL queries. An attacker could exploit this...
Cisco IOS XR Software Command Injection Vulnerability
A vulnerability in the command-line utility of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary commands on the host operating system with elevated privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this...
Cisco ASR 5000 Series SNMP Community String Disclosure Vulnerability
A vulnerability in SNMP configuration management in the Cisco ASR 5000 Series could allow an unauthenticated, remote attacker to read and modify the device configuration using an SNMP read-write community string. The vulnerability occurs because the configured SNMP community string is not...
Cisco IOS XR for NCS 6000 Packet Timer Leak Denial of Service Vulnerability
A vulnerability in the management of system timer resources in Cisco IOS XR for Cisco Network Convergence System 6000 NCS 6000 Series Routers could allow an unauthenticated, remote attacker to cause a leak of system timer resources, leading to a nonoperational state and an eventual reload of the...
Cisco Adaptive Security Appliance Access Control List ICMP Echo Request Code Filtering Vulnerability
A vulnerability in the Cisco Adaptive Security Appliance ASA Software implementation of access control list ACL permit and deny filters for ICMP echo reply messages could allow an unauthenticated, remote attacker to bypass ACL configurations for an affected device. ICMP traffic that should be...
Cisco AMP Threat Grid Unauthorized Clean IP Access Vulnerability
A vulnerability in the virtual network stack of the Cisco AMP Threat Grid Appliance could allow an unauthenticated, remote attacker to access internal interfaces within the appliance. The vulnerability is due to insufficient isolation between the sandbox and other internal components. An attacker...
Cisco Prime Infrastructure Administrative Web Interface HTML Injection Vulnerability
A vulnerability in the administrative web interface of Cisco Prime Infrastructure PI could allow an authenticated, remote attacker to execute arbitrary commands on the affected system and on the devices managed by the system. The vulnerability is due to improper user input validation. An attacker...
Cisco Video Communication Server and Expressway Trusted Certificate Authentication Bypass Vulnerability
A vulnerability in certificate management and validation for the Mobile and Remote Access MRA feature for Cisco Expressway Series and TelePresence Video Communication Server VCS could allow an unauthenticated, remote attacker to bypass authentication and access internal HTTP system resources. The...
Cisco Configuration Assistant Request Processing Unauthorized Access Vulnerability
A vulnerability in Cisco Configuration Assistant CCA could allow an unauthenticated, remote attacker to access sensitive file systems and administrative endpoints without user authentication. The vulnerability is due to lack of controller mechanisms and input validation checks. An attacker could...
Cisco Prime Collaboration Provisioning Lightweight Directory Access Protocol Authentication Bypass Vulnerability
A vulnerability in the Lightweight Directory Access Protocol LDAP authentication for Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to bypass authentication. The attacker could be granted full administrator privileges. The vulnerability is due to...
Cisco Prime Infrastructure and Evolved Programmable Network Manager Authentication Bypass API Vulnerability
A vulnerability in the application programming interface API of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager EPNM could allow an unauthenticated, remote attacker to access and control the API resources. The vulnerability is due to improper input validation of HTTP...
Cisco Firepower System Software Static Credential Vulnerability
A vulnerability in Cisco Firepower System Software could allow an unauthenticated, remote attacker to log in to the device with a default account. This account does not have full administrator privileges. The vulnerability is due to a user account that has a default and static password. This...
Cisco Prime Infrastructure and Evolved Programmable Network Manager Authenticated Remote Code Execution Vulnerability
A vulnerability in the web interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager EPNM could allow an authenticated, remote attacker to upload arbitrary files and execute commands as the prime web user. The prime web user does not have the full privileges of root...
Cisco Web Security Appliance Native FTP Denial of Service Vulnerability
A vulnerability in the native pass-through FTP functionality of the Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to cause a partial denial of service DoS condition due to high CPU utilization. The vulnerability is due to how the FTP client terminates the FTP...
Cisco Email Security Appliance .zip File Scanning Security Bypass Vulnerability
A vulnerability in the Message Filter and Content Filter of the Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass the filtering functionality of an affected system. The vulnerability is due to improper handling of content in .zip files. An attacker could...
Cisco Unified Contact Center Enterprise Web-Based Management Interface Cross-Site Scripting Vulnerability
A vulnerability in the HTTP web-based management interface of Cisco Unified Contact Center Enterprise Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of an affected system. The vulnerability is due to...