5246 matches found
Cisco Wireless LAN Controller Client Disconnection Vulnerability
A vulnerability in the Web Management GUI of the Cisco Wireless LAN Controller WLC could allow an unauthenticated, remote attacker to trigger client disconnection. The vulnerability is due to a lack of access control to the Cisco WLC Web Management GUI. An attacker could exploit this vulnerabilit...
Cisco ASR 5000 and ASR 5500 TACACS Denial of Service Vulnerability
A vulnerability in the TACACS protocol implementation of the Cisco Aggregation Services Router ASR 5000 and ASR 5500 ASR5K System Software could allow an unauthenticated, remote attacker to cause a partial denial of service DoS condition because the vpnmgr process restarts. The vulnerability is...
Cisco Application Policy Infrastructure Controller Privilege Escalation SSH Key Vulnerability
A vulnerability in SSH key handling for user accounts in Cisco Application Policy Infrastructure Controller APIC could allow an authenticated, local attacker to elevate privileges. The vulnerability is due to improper validation of SSH keys local users add their accounts. An attacker could exploi...
Cisco Prime Renegotiation Request Denial of Service Vulnerability
A vulnerability in Cisco Prime could allow a remote, unauthenticated attacker to cause a denial of service DoS condition. The vulnerability is due to improper handling of SSL renegotiation requests. An unauthenticated, remote attacker could exploit this vulnerability by sending multiple SSL...
Cisco Prime Collaboration Assurance Arbitrary File Retrieval Vulnerability
A vulnerability in the web framework of Cisco Prime Collaboration Assurance PCA could allow an authenticated, remote attacker to retrieve arbitrary files from the underlying file system. The vulnerability is due to incorrect implementation of the access control code. An attacker could exploit thi...
Cisco Prime Collaboration Provisioning SQL Injection Vulnerability
A vulnerability in web framework of Cisco Prime Collaboration Provisioning PCP could allow an authenticated, remote attacker to execute unauthorized SQL queries. The vulnerability is due to a failure to validate user-supplied input used in SQL queries. An attacker could exploit this vulnerability...
Cisco AnyConnect Secure Mobility Client Arbitrary File Move Vulnerability
A vulnerability in interprocess communication IPC channel of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker to move arbitrary files with elevated privileges. The vulnerability is due to missing source path validation in certain IPC commands. An attacker could...
Cisco Prime Collaboration Assurance SQL Injection Vulnerability
A vulnerability in web framework of Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to execute unauthorized SQL queries. The vulnerability is due to a failure to validate user-supplied input that is used in SQL queries. An attacker could exploit this vulnerabilit...
Cisco TelePresence Video Communication Server Expressway File Modification Vulnerability
A vulnerability in the symbolic link operation of the Cisco TelePresence Video Communication Server VCS Expressway could allow an authenticated, local attacker to perform a symbolic link attack on the affected system. The vulnerability is due to insufficient protection of files. An attacker could...
Cisco UCS B-Series Blade Servers Denial of Service Vulnerability
A vulnerability in Cisco Unified Computing System UCS B-Series blade servers could allow an unauthenticated, local attacker to cause the host operating system or Baseboard Management Controller BMC to hang. The vulnerability is due to how the various components communicate across the Inter-IC I2C...
Cisco TelePresence Video Communication Server (VCS) Expressway Privilege Escalation Vulnerability
A vulnerability in the process management code of the Cisco TelePresence Video Communication Server VCS Expressway could allow an authenticated, local attacker to run arbitrary programs with elevated privileges. The vulnerability is due to the failure to protect a supervised process. An attacker...
Cisco Aironet 1850 Access Point Privilege Escalation Vulnerability
A vulnerability in the command-line interface CLI of the Cisco Aironet 1850 Series Access Point device could allow an authenticated, local attacker to obtain elevated privileges to the restricted shell on the device. The vulnerability is due to a lack of proper escape protections when validating...
Cisco IOS Software RADIUS Client Denial of Service Vulnerability
A vulnerability in the RADIUS client feature of Cisco IOS Software could allow an authenticated, remote attacker to cause a reload of the affected device. The vulnerability is due to improper parsing of malformed RADIUS packets returned by a RADIUS server. An attacker could exploit this...
Cisco Unified Communications Manager IM and Presence Service REST API Denial of Service Vulnerability
A vulnerability in the Representational State Transfer REST interface of the Cisco Unified Communications Manager IM and Presence Service could allow an unauthenticated, remote attacker to cause a partial denial of service DoS condition because the Cisco Session Initiation Protocol SIP proxy...
Cisco Wireless LAN Controller Devices 802.11i Management Frame Denial of Service Vulnerability
Cisco Wireless LAN Controller WLC devices contain a denial of service vulnerability that could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition. The vulnerability is due to a failure to properly discard certain malformed values in an 802.11i management frame...
Cisco Nexus 3000 Series Switches SNMP Non-Existent OID Denial of Service Vulnerability
A vulnerability in the Simple Network Management Protocol SNMP interface of the Nexus 3000 N3K Series Switch could allow an authenticated, remote attacker to cause a partial denial of service DoS condition to the SNMP service running on the device. The vulnerability is due to improper handling of...
Cisco Email Security Appliance Max Files Denial of Service Vulnerability
A vulnerability in file descriptor handling of the Cisco Email Security Appliance ESA could allow an authenticated, remote attacker to cause a denial of service DoS condition due to the affected device unexpectedly reloading. The vulnerability is due to failure to release file descriptors when th...
Cisco FirePOWER 7000 and Cisco FirePOWER 8000 Series Inspection Engine Stall Vulnerability
A vulnerability in FireSIGHT System Software for Cisco FirePOWER 7000 Series and Cisco FirePOWER 8000 Series devices could allow an unauthenticated, adjacent attacker to cause the inspection engine to stop processing packets. Depending on the affected system configuration, this may cause traffic...
Cisco AnyConnect Secure Mobility Client for Linux and Mac OS X Privilege Escalation Vulnerability
A vulnerability in the code responsible for the self-updating feature of Cisco AnyConnect Secure Mobility Client for Linux and the Cisco AnyConnect Secure Mobility Client for Mac OS X could allow an authenticated, local attacker to execute an arbitrary executable file of its choosing with...
Cisco IOS and IOS XE Software IPv6 First Hop Security Denial of Service Vulnerabilities
Two vulnerabilities in the IPv6 first hop security feature of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. Cisco has released software updates that address these vulnerabilities. There are no workarounds to mitigate these...
Cisco IOS XE Software Network Address Translation Denial of Service Vulnerability
A vulnerability in the processing of IPv4 packets that require Network Address Translation NAT and Multiprotocol Label Switching MPLS services of Cisco IOS XE Software for Cisco ASR 1000 Series, Cisco ISR 4300 Series, Cisco ISR 4400 Series, and Cisco Cloud Services 1000v Series Routers could allo...
Cisco IOS and IOS XE Software SSH Version 2 RSA-Based User Authentication Bypass Vulnerability
A vulnerability in the SSH version 2 SSHv2 protocol implementation of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to bypass user authentication. Successful exploitation could allow the attacker to log in with the privileges of the user or the privileges configure...
Cisco TelePresence Server Cross-Site Request Forgery Vulnerability
A vulnerability in the web interface of Cisco TelePresence Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against the user of the web interface. The vulnerability is due to insufficient CSRF protections. An attacker could exploit this...
Cisco AnyConnect Secure Mobility Client for Windows Privilege Escalation Vulnerability
A vulnerability in Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to execute an arbitrary executable file with privileges equivalent to the Microsoft Windows operating system SYSTEM account. The vulnerability is due to lack of checks in the code f...
Cisco Spark Mobile Application Man-in-the-Middle Vulnerability
A vulnerability in the Cisco Spark mobile application could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack against the affected device. The vulnerability is due to improper validation of the SSL certificate used to manage the device. An attacker could exploit this...
Cisco Wireless LAN Controller RADIUS Packet of Disconnect Vulnerability
A vulnerability in the RADIUS implementation of the Cisco Wireless LAN Controller WLC could allow an unauthenticated, remote attacker to cause a partial denial of service DoS condition by disconnecting user sessions. The vulnerability is due to a lack of proper input validation of the RADIUS...
Cisco ASR 9000 Series Aggregation Services Routers Denial of Service Vulnerability
A vulnerability in the DHCP version 6 DHCPv6 server implementation of Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to improper handling of certain DHCPv6 packets. An attacker could exploit this...
Cisco Unity Connection Web Interface SQL Injection Vulnerability
A vulnerability in the web interface of Cisco Unity Connection UC could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries. The vulnerability is due to a lack of input validation on user-supplied input in SQL queries. An attacker...
Cisco Secure Access Control Server SSH Login Denial of Service Vulnerability
A vulnerability in the Secure Shell SSH feature of the Cisco Secure Access Control Server ACS could allow an authenticated, remote attacker to cause a partial denial of service DoS condition due to the SSH screen process unexpectedly terminating. The vulnerability is due to improper input...
Cisco IOS Software DHCPv6 Server Implementation Denial of Service Vulnerability
A vulnerability in the DHCP version 6 DHCPv6 server implementation of Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to improper handling of crafted DHCPv6 packets. An attacker could exploit this vulnerabilit...
Cisco Prime Network Registrar Privilege Escalation Vulnerability
A vulnerability in the default configuration of the Cisco Prime Network Registrar CPNR virtual appliance OVA which could allow an authenticated, local attacker to gain root privileges. The vulnerability is due to an insecure default account present on the affected device. A local attacker could...
Cisco IOS XE Cisco Discovery Protocol Packet Processing Denial of Service Vulnerability
A vulnerability in Cisco Catalyst 4500 Series Switches running Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper processing of valid crafted Cisco Discovery Protocol packet...
Cisco Prime Collaboration Assurance Information Disclosure Vulnerability
A vulnerability in the web framework of Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to access information about any device imported into the system database. The vulnerability is due to improper implementation of authorization and access controls. An attacker...
Cisco Nexus 9000 Series Switches Reserved VLAN Number Vulnerability
A vulnerability in the handling of incoming Layer 2 packets tagged with a Cisco Nexus 9000 Series Switch N9K reserved VLAN number could allow an unauthenticated, adjacent attacker to cause a partial denial of service DoS condition due to increased CPU utilization and possible control plane...
Cisco TelePresence Server Denial of Service Vulnerability
Cisco TelePresence Server contains a buffer overflow vulnerability in the Conference Control Protocol API that could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. Cisco has released software updates that address this vulnerability. No workarounds that...
Cisco Prime Collaboration Provisioning Web Framework Access Controls Bypass Vulnerability
A vulnerability in the web framework of Cisco Prime Collaboration Provisioning could allow an authenticated, remote attacker to access higher-privileged functions. An exploit could allow the attacker to access functions, some of which should be accessible only to users who have administrative...
Multiple Vulnerabilities in Cisco Prime Collaboration Assurance
Cisco Prime Collaboration Assurance Software contains the following vulnerabilities: Cisco Prime Collaboration Assurance Web Framework Access Controls Bypass Vulnerability Cisco Prime Collaboration Assurance Information Disclosure Vulnerability Cisco Prime Collaboration Assurance Session ID...
Cisco Web Security Appliance Malformed HTTP Response Denial of Service Vulnerability
A vulnerability in the web interface of the Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to cause a partial denial of service DoS condition due to memory management failures during processing of TCP connections. The vulnerability is due to the improper handling...
Cisco Email Security Appliance Format String Vulnerability
The Cisco Email Security Appliance ESA contains a vulnerability that could allow an unauthenticated, remote attacker to impact the integrity and availability of services and data on the affected device. The impact includes a partial denial of service DoS. In addition, the attacker could override...
Cisco Web Security Appliance DNS Resolution Vulnerability
A vulnerability in the DNS resolution function of the Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to cause a partial denial of service DoS condition due to DNS name resolution failing through the device. The vulnerability is due to the handling of DNS requests...
Cisco Security Management Appliance Log Rollover Denial of Service Vulnerability
A vulnerability in the web interface of the Cisco Security Management Appliance SMA could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on a targeted device. The vulnerability is due to inadequate validation of user credentials for incoming HTTP requests,...
Cisco Application Visibility and Control FlexConnect UDP Vulnerability
A vulnerability in Cisco Application Visibility and Control AVC software for wireless networking could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition. The vulnerability is due to improper validation of UDP packets in the configuration of FlexConnect mode. A...
Cisco TelePresence IX5000 Systems Certificate Information Disclosure Vulnerability
A vulnerability in the directory on the Web Management Interface of Cisco TelePresence IX5000 Systems could allow an unauthenticated, remote attacker to decrypt captured traffic on the affected device or perform a man-in-the-middle attack. The vulnerability is due to the inclusion of the...
Cisco Integrated Management Controller Supervisor and Cisco UCS Director Remote File Overwrite Vulnerability
Cisco Integrated Management Controller IMC Supervisor and Cisco UCS Director contain a remote file overwrite vulnerability that could allow an unauthenticated, remote attacker to overwrite arbitrary system files, resulting in system instability or a denial of service DoS condition. Cisco has...
Cisco NX-OS Malformed ARP Header Denial of Service Vulnerability
A vulnerability in Address Resolution Protocol ARP feature of the Cisco Nexus Operating System NX-OS could allow an unauthenticated, adjacent attacker to cause a partial denial of service DoS condition because the ARP process unexpectedly restarts. The vulnerability is due to improper input...
Cisco TelePresence Video Communication Server Expressway Command Injection Vulnerability
A vulnerability in a local file script in Cisco TelePresence Video Communication Server VCS Expressway could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with elevated privilege. The vulnerability is due to insufficient protection of a...
Cisco ASR 1000 Series Aggregation Services Routers Data-Plane Processing Denial of Service Vulnerability
A vulnerability in the Cisco ASR 1000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to the processing of excessive number of IPv4 packets that require fragmentation and reassembly. An attack...
Cisco Identity Services Engine Guest Portal Unauthorized Access Vulnerability
A vulnerability in the Cisco Identity Services Engine ISE guest portal could allow an unauthenticated, remote attacker to view a customized page on the guest portal. The vulnerability is due to lack of access control for the uploaded HTML files. An attacker could exploit this vulnerability by...
Cisco ACE 4710 and ACE30 Application Control Engine CLI Privilege Escalation Vulnerability
A vulnerability in the command-line interface CLI of Cisco Application Control Engine ACE could allow an authenticated, local attacker to elevate privileges to read and alter the content of files that belong to other contexts. The vulnerability is due to insufficient file access controls. An...
Cisco TelePresence Video Communication Server Expressway TFTP Information Disclosure Vulnerability
A vulnerability in TFTP in Cisco TelePresence Video Communication Server VCS Expressway could allow an authenticated, remote attacker to obtain unauthorized access to configuration files from the device by using TFTP. The vulnerability is due to lack of TFTP authentication and control for the...