Cisco Identity Services Engine Unauthorized Access Vulnerability

Cisco Identity Services Engine versions prior to 2.0 contain a vulnerability that could allow a low-privileged authenticated, remote attacker to access specific web resources that are designed to be accessed only by higher-privileged administrative users. The vulnerability occurs because specific...

Cisco Adaptive Security Appliance Non-DCERPC Traffic Bypass Vulnerability

A vulnerability in the Distributed Computing Environment/Remote Procedure Calls DCERPC Inspection feature of the Cisco Adaptive Security Appliance ASA could allow an unauthenticated, remote attacker to send traffic that is not DCERPC between hosts configured only for DCERPC inspection. The DCERPC...

Cisco Unified Communications Manager SQL Injection Vulnerability

A vulnerability in Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct a blind SQL injection attack on a specific page. The vulnerability is due to a failure to validate user-supplied input used in SQL queries. An attacker could exploit this vulnerability...

Cisco Prime Infrastructure Frame Injection Vulnerability

A vulnerability in the web interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to execute a cross-frame scripting XFS attack. The vulnerability is due to insufficient HTML iframe protection. An attacker could exploit this vulnerability by directing a user to an...

Cisco IOS XR Software OSPF Link State Advertisement PCE Vulnerability

A vulnerability in Open Shortest Path First OSPF Link State Advertisement LSA handling by Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to the number of OSPF Path Computation Elements PCEs that are...

Cisco Jabber STARTTLS Downgrade Vulnerability

A vulnerability in the Cisco Jabber client could allow an unauthenticated, remote attacker to perform a STARTTLS downgrade attack. The vulnerability exists because the client does not verify that an Extensible Messaging and Presence Protocol XMPP connection has been established with Transport Lay...

Cisco IOS XE Software Packet Processing Denial of Service Vulnerability

Cisco IOS XE Software Release 16.1.1 contains a vulnerability that could allow an unauthenticated, adjacent attacker to cause an affected device to reload. The vulnerability is due to incorrect processing of packets that have a source MAC address of 0000:0000:0000. An attacker could exploit this...

Cisco IOS and IOS XE Software IKEv1 State Machine Denial of Service Vulnerability

A vulnerability in the Internet Key Exchange IKEv1 state machine of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to tear down valid IPsec connections, resulting in a partial denial of service DoS condition. The vulnerability is due to insufficient condition...

Cisco Model DPQ3925 Wireless Residential Gateway Information Disclosure Vulnerability

A vulnerability in the HTTP server on the Cisco Model DPQ3925 8x4 DOCSIS 3.0 Wireless Residential Gateway with Embedded Digital Voice Adapter EDVA could allow an unauthenticated, remote attacker to access sensitive information located on the device. The vulnerability is due to insufficient input...

Cisco Prime Network Services Controller Arbitrary Command Execution Vulnerability

A vulnerability in the management of local commands of Cisco Prime Network Services Controller could allow an authenticated, local attacker to perform arbitrary command execution. The vulnerability is due to insufficient validation of local commands. An attacker could exploit this vulnerability b...

Cisco FireSIGHT Management Center SSL HTTP Attack Detection Vulnerability

A vulnerability in HTTP attack detection within decrypted SSL traffic of Cisco FireSIGHT Management Center could allow an unauthenticated, remote attacker to bypass HTTP attack detection. The traffic is SSL and the application is configured to decrypt the SSL connection and detect HTTP-based...

Cisco Application Policy Infrastructure Controller Insecure Credentials Vulnerability

A vulnerability in the boot process of the Cisco Application Policy Infrastructure Controller APIC could allow an authenticated, local attacker to access the APIC as the root user. The vulnerability is due to improper implementation of access controls in the APIC system. An attacker could exploit...

Cisco Unified Communications Manager Web Applications Identity Management Subsystem Denial of Service Vulnerability

A vulnerability in the Identity Management subsystem used by the WebApplications of Cisco Unified Communications Manager Cisco UCM software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to invalid session requests. An attacker...

Cisco IOS XE Software IPv6 Neighbor Discovery Denial of Service Vulnerability

A vulnerability in the IPv6 neighbor discovery ND handling of Cisco IOS XE Software on ASR platforms could allow an unauthenticated, adjacent attacker to cause an affected device to crash. The vulnerability is due to insufficient bounds on internal tables. An attacker could exploit this...

Cisco Unified Communications Manager Web Management Interface Cross-Site Scripting Filter Bypass Vulnerability

A cross-site scripting XSS filter bypass vulnerability in the web management interface of Cisco Unified Communications Manager UCM versions 8.0 through 8.6 could allow an unauthenticated, remote attacker to mount XSS attacks against a user of an affected device. The vulnerability is due to a...

Cisco Integrated Management Controller Denial of Service Vulnerability

A vulnerability in Cisco Integrated Management Controller IMC could allow an authenticated, remote attacker to make the IMC IP interface inaccessible. The vulnerability is due to incomplete sanitization of input for certain parameters. An attacker could exploit this vulnerability by sending a...

Cisco Unified Communications Domain Manager Denial of Service Vulnerability

A vulnerability in Cisco Unified Communications Domain Manager CUCDM could allow an authenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to improper handling of malformed requests by the self-service application on an affected CUCDM device. An...

Cisco FireSIGHT Management Center GET Request Information Disclosure Vulnerability

A vulnerability in the Cisco FireSIGHT Management Center could allow an authenticated, remote attacker to view sensitive information from the underlying operating system. The vulnerability is due to improper sanitation of user-supplied input. An attacker could exploit this vulnerability by sendin...

Cisco Small Business RV Series and SA500 Series Dual WAN VPN Router Generated Key Pair Information Disclosure Vulnerability

A vulnerability in the HTTPS session key exchange process of certain Cisco Small Business RV Series Routers and Cisco SA500 Series Security Appliances could allow an unauthenticated, remote attacker to obtain the key pair used in the Transport Layer Security TLS session from the affected device...

Cisco Hosted Collaboration Mediation Fulfillment SOAP API Sensitive Information Disclosure Vulnerability

A vulnerability in the Simple Object Access Protocol SOAP application programming interface API of the Cisco Hosted Collaboration Mediation Fulfillment application could allow an authenticated, remote attacker to obtain sensitive information that should be restricted. The attacker must authentica...

Cisco Emergency Responder Web Framework Cross-Site Scripting Vulnerability

A vulnerability in the web framework of Cisco Emergency Responder Software could allow an unauthenticated, remote attacker to execute a stored cross-site scripting XSS attack against the user of the web interface. The vulnerability is due to insufficient validation on the input fields of a web...

Cisco Emergency Responder Service Web Framework Cross-Site Request Forgery Vulnerability

A vulnerability in the web framework of Cisco Emergency Responder server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against a user of the web interface. The vulnerability is due to insufficient CSRF protections. An attacker could exploit th...

Cisco Emergency Responder Tools Menu Directory Traversal Vulnerability

A vulnerability in the Tools menu of Cisco Emergency Responder could allow an authenticated, remote attacker to put files in arbitrary locations on an affected device. The vulnerability is due to a failure to properly sanitize user-supplied input that is provided to the Tools menu as part of a...

Cisco Emergency Responder Web Framework Arbitrary File Upload Vulnerability

A vulnerability in the web framework of Cisco Emergency Responder CER could allow an unauthenticated, remote attacker to upload arbitrary files to a restricted location on the filesystem. The vulnerability is due to insufficient parameter validation. An attacker could exploit this vulnerability b...

Cisco TelePresence Video Communication Server Information Disclosure Vulnerability

A vulnerability in the key management of Cisco TelePresence Video Communication Server VCS could allow an unauthenticated, local attacker to read sensitive data. The vulnerability is due to an encryption key that is shared across all the installations of VCS. An attacker could exploit this...

Cisco Unified Email Interaction Manager and Cisco Unified Web Interaction Manager XSS Vulnerability

A vulnerability in the web interface of Cisco Unified Email Interaction Manager and Cisco Unified Web Interaction Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the affected system. The vulnerability is due to insufficient...

Cisco Unified Computing System 6200 Series Fabric Interconnect Series Switch DoS Vulnerability

A vulnerability in the SSH management interface of the Cisco Unified Computing System UCS 6200 Series Fabric Interconnect Series Switch could allow an unauthenticated, remote attacker to cause a denial of service DoS condition because a fabric interconnect interface might not boot completely up o...

Cisco Videoscape Distribution Suite Service Manager Unauthorized Access Vulnerability

A vulnerability in the role-based access control RBAC for certain users of the Cisco Videoscape Distribution Suite Service Manager VDS-SM could allow an authenticated, remote attacker read and write access to an internal database that contains sensitive information. The vulnerability is due to la...

Cisco Unity Connection Cross-Site Request Forgery Vulnerability

A cross-site request forgery CSRF vulnerability in Cisco Unity Connection could allow an unauthenticated, remote attacker to execute unwanted actions. The vulnerability is due to a lack of CSRF protections by an affected device. An attacker could exploit this vulnerability by convincing a user to...

Vulnerability in Java Deserialization Affecting Cisco Products

A vulnerability in the Java deserialization used by the Apache Commons Collections ACC library could allow an unauthenticated, remote attacker to execute arbitrary code. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could explo...

Cisco Prime Collaboration Assurance Default Account Credential Vulnerability

A vulnerability in Cisco Prime Collaboration Assurance PCA Software could allow an unauthenticated, remote attacker to log in to the system shell with the default cmuser user account and access the shell with a limited set of permissions. The vulnerability is due to an undocumented account that h...

Cisco TelePresence Video Communication Server Expressway Web Framework Code Unauthorized Access Vulnerability

A vulnerability in the web framework code of Cisco TelePresence Video Communication Server VCS Expressway could allow an authenticated, remote attacker to install Tandberg Linux Packages TLPs without proper authorization. The vulnerability is due to missing authorization checks on certain...

Cisco FirePOWER Management Center Software Version Information Disclosure Vulnerability

A vulnerability in Cisco FirePOWER Management Center could allow an unauthenticated, remote attacker to obtain information about the version of Cisco FirePOWER Management Center software that is running on an affected system. An attacker could use this information to conduct reconnaissance attack...

Cisco Unified Communications Manager Mobile and Remote Access Services Identity Attack Vulnerability

A vulnerability in edge devices of the Cisco Unified Communications Manager using Mobile and Remote Access MRA services could allow an unauthenticated, remote attacker to perform an identity theft attack. The vulnerability is due to improper identity validation of the edge devices. An attacker...

Multiple Cisco IP Phones Firmware Image Upload Vulnerability

A vulnerability in the TFTP implementation of the Cisco Small Business SPA30X and SPA50X IP Phones could allow an unauthenticated, local attacker to load arbitrary firmware images onto the affected device. The vulnerability is due to insufficient file integrity checks of the firmware image. An...

Cisco DPC3939 (XB3) Router Administrative Web Interface Command Injection Vulnerability

A vulnerability in the administrative web interface of the Cisco DPC3939 XB3 router could allow an authenticated, remote attacker to execute arbitrary commands on the affected system and on the devices managed by the system. The vulnerability is due to improper user input validation. An attacker...

Cisco Wireless Residential Unauthorized Command Vulnerability

A vulnerability with web interface access authentication of the Cisco EPC3928 Wireless Residential Gateway could allow an unauthenticated, remote attacker to issue a subset of commands as the administrator without authenticating to the device. The vulnerability is due to lack of authentication...

Cisco Residential Gateway Devices Cross-Site Request Forgery Vulnerability

A vulnerability in the web interface of Cisco Model DPQ3925 8x4 DOCSIS 3.0 Wireless Residential Gateway with Embedded Digital Voice Adapter EDVA could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against the user of the web interface. The...

Cisco Wireless Residential Gateway Stored Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of the Cisco EPC3928 Wireless Residential Gateway could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the web interface of the affected system. The vulnerability is due to...

Cisco Prime Service Catalog Web Interface Unauthorized Access Vulnerability

A vulnerability in the web interface of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to perform limited configuration changes. The vulnerability is due to missing access controls in some of the web pages that allow configuration changes. An attacker could exploit th...

Multiple Vulnerabilities in OpenSSL (December 2015) Affecting Cisco Products

On December 3, 2015, the OpenSSL Project released a security advisory detailing five vulnerabilities. Multiple Cisco products incorporate a version of the OpenSSL package affected by one or more vulnerabilities that could allow an unauthenticated, remote attacker to cause a denial of service DoS...

Cisco Nexus 5000 Series USB Driver Denial of Service Vulnerability

A vulnerability in the USB driver for Cisco Nexus 5000 Series Switches could allow an unauthenticated, local attacker to cause a denial of service DoS condition due to a kernel crash. The vulnerability is due to insufficient handling of USB input parameters. An attacker could exploit this...

Cisco Unity Connection Cross-Site Scripting Vulnerability

A vulnerability in the HTTP web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of the affected system. The vulnerability is due to insufficient input validation...

Cisco SIP Phone 3905 Resource Limitation Denial of Service Vulnerability

A vulnerability in the Cisco Unified SIP Phone 3905 could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to a resource limitation of the device. An attacker could exploit this vulnerability by sending large...

Cisco WebEx Meetings for Android Custom Permissions Vulnerability

A vulnerability in the custom application permissions handling for Cisco WebEx Meetings for Android could allow an unauthenticated, remote attacker to change platform-specific permissions of a custom application. The vulnerability is due to the way custom application permissions are assigned at...

Cisco Unified Computing System Central Software Cross-Site Scripting Vulnerability

A vulnerability in the HTTP web-based management interface of Cisco Unified Computing System UCS Central Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of the affected system. The vulnerability is due to...

Cisco UCS Central Software Server-Side Request Forgery Vulnerability

A vulnerability in the Cisco Unified Computing System UCS Central software could allow an unauthenticated, remote attacker to bypass access controls and conduct a server-side request forgery SSRF on a targeted system. The vulnerability is due to improper validation of user-supplied input on the...

Cisco Cloud Services Router 1000V Command Injection Vulnerability

A vulnerability in the event manager environment and publish-event function of the Cisco Cloud Services Router 1000V Series could allow an authenticated, local attacker to perform a command injection attack with root-level privileges. The vulnerability is due to a lack of proper input validation ...

Cisco Web Security Appliance Native FTP Denial of Service Vulnerability

A vulnerability in the native passthrough FTP functionality of the Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to cause a partial denial of service DoS condition due to high CPU utilization. The vulnerability occurs when the FTP client terminates the FTP contr...

Cisco IOS XE 3S Platforms Series root Shell License Bypass Vulnerability

A vulnerability in one of the diagnostic commands in the Cisco IOS XE operating system for Cisco IOS XE 3S platforms could allow an authenticated, privileged, local attacker to gain restricted root shell access. The root shell is provided for advanced troubleshooting with Cisco Technical Assistan...