Cisco Email Security Appliance Malformed DMARC Policy Records File Modification Vulnerability

A vulnerability in the Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to generate malformed Domain-Based Message Authentication, Reporting, and Conformance DMARC policy records to the targeted system. The vulnerability occurs because the affected ESA is not abl...

Cisco Videoscape Delivery System Denial of Service Vulnerability

A vulnerability in the HTTP processing module of the Cisco Videoscape Distribution Suite for Internet Streaming VDS-IS and Cisco Videoscape Distribution Suite Service Broker VDS-SB could allow an unauthenticated, remote attacker to cause a reload of the affected device. The vulnerability is due t...

Cisco Packet Data Network Gateway GTPv2 Tunnel Vulnerability

A vulnerability in the GPRS Tunneling Protocol for Version 2 GTPv2 of the Cisco Packet Data Network Gateway PGW could allow an unauthenticated, remote attacker to cause partial availability of the GTPv2 service. The vulnerability is due to lack of input validation of the incoming GTPv2 packet...

Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability

A vulnerability in the web framework of Cisco Identity Services Engine could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against the user of the web interface. The vulnerability is due to insufficient CSRF protections. An attacker could exploit th...

Cisco Packet Data Network Gateway IP Stack Denial of Service Vulnerability

A vulnerability in the IP stack of the Cisco Packet Data Network Gateway PGW could allow an unauthenticated, remote attacker to cause a partial denial of service DoS of the Session Manager service when a malformed IP packet is received. The vulnerability is due to improper input validation of...

Cisco Adaptive Security Appliance Message Authentication Code Checking Vulnerability

A vulnerability in the Transport Layer Security TLS code on the Cisco Adaptive Security Appliance ASA could allow an unauthenticated, remote attacker to modify the contents of an encrypted TLS packet without detection of the modifications. The vulnerability is due to an error on the firmware of t...

Cisco Identity Services Engine Cross-Frame Scripting Vulnerability

A vulnerability in the web interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to execute a cross-frame scripting XFS attack. This vulnerability is due to insufficient HTML iframe protection. An attacker could exploit this vulnerability by directing a...

Cisco TelePresence Integrator C Series Multiple Request Parameter Vulnerability

A vulnerability in Cisco TelePresence Integrator C Series could allow an unauthenticated, remote attacker to bypass authentication. The vulnerability is due to insufficient validation of user-supplied values. An attacker could exploit this vulnerability by sending multiple request parameters to a...

Cisco Unified Communications Manager Denial of Service Vulnerability

A vulnerability in the Tomcat service throttling mechanism of the Cisco Unified Communications Manager could allow an authenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to sending multiple authenticated requests to Cisco Unified Communications...

Cisco FireSIGHT Management Center Cross-Site Scripting Vulnerabilities

Multiple vulnerabilities in Cisco FireSIGHT Management Center could allow an unauthenticated, remote attacker to perform reflected cross-site scripting XSS attacks. The vulnerabilities are due to insufficient validation of user-supplied input by the affected software. An attacker could exploit...

Cisco Unified Communications Manager ccmivr Page Cross-Site Scripting Vulnerability

A vulnerability in several parameters of the ccmivr page of Cisco Unified Communications Manager, formerly known as CallManager, could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface on an affected system. The vulnerabilit...

Cisco Identity Services Engine Cross-Site Scripting Vulnerability

A vulnerability in the Cisco Identity Services Engine ISE Infra Admin UI could allow an unauthenticated, remote attacker to perform a cross-site scripting XSS attack. The vulnerability is due to insufficient input validation of some parameters passed via HTTP GET or POST methods. An attacker coul...

Cisco Mobility Services Engine Control And Provisioning Information Disclosure Vulnerability

A vulnerability in the Control And Provisioning of the Cisco Mobility Services Engine MSE could allow an authenticated, remote attacker to have read access to sensitive information stored on an affected system. The vulnerability is due to the inclusion of sensitive information in certain log file...

OpenSSL Alternative Chains Certificate Forgery Vulnerability (July 2015) Affecting Cisco Products

On July 9, 2015, the OpenSSL Project released a security advisory detailing a vulnerability affecting applications that verify certificates, including SSL/Transport Layer Security TLS/Datagram Transport Layer Security DTLS clients and SSL/TLS/DTLS servers using client authentication. Multiple Cis...

Cisco AsyncOS for Cisco Email Security Appliance and Cisco Web Security Appliance Cluster Denial of Service Vulnerability

A vulnerability in the clustering component of Cisco AsyncOS for Cisco Email Security Appliance ESA and Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to cause the device to become unresponsive on the clustering and SSH configured ports. The vulnerability is due ...

Cisco TelePresence Advanced Media Gateway Cross-Site Request Forgery Vulnerability

A vulnerability in the Cisco TelePresence Advanced Media Gateway Series could allow and unauthenticated, remote attacker to execute unwanted actions. The vulnerability is due to insufficient cross-site request forgery CSRF protection. An attacker could exploit this vulnerability by tricking the...

Cisco TelePresence IP VCR Cross-Site Request Forgery Vulnerability

A vulnerability in the Cisco TelePresence IP VCR Series could allow an unauthenticated, remote attacker to execute unwanted actions. The vulnerability is due to insufficient cross-site request forgery CSRF protection. An attacker could exploit this vulnerability by tricking the user of a web...

Cisco Hosted Collaboration Solution Cross-Site Scripting Vulnerability

A vulnerability in Cisco Hosted Collaboration Solution could allow an unauthenticated, remote attacker to perform cross-site scripting XSS attacks. The vulnerability is due to insufficient validation of a user-supplied value. An attacker could exploit this vulnerability by convincing a user to...

Cisco ASR 5000 Series Software Local Command Injection Vulnerability

A vulnerability in the boot process of the Cisco ASR5000 and ASR5500 ASK5K System Software could allow an authenticated, local attacker to cause commands to be executed during the boot process. The vulnerability is due to improper reading of a local file on Compact Flash CF during the boot proces...

Cisco TelePresence Serial Gateway Cross-Site Request Forgery Vulnerability

A vulnerability in the Cisco TelePresence Serial Gateway Series could allow an unauthenticated, remote attacker to execute unwanted actions. The vulnerability is due to insufficient cross-site request forgery CSRF protection. An attacker could exploit this vulnerability by tricking the user of a...

Cisco Unified Computing System C-Series Servers Man-in-the-Middle Vulnerability

A vulnerability in the Cisco Integrated Management Controller of the Cisco Unified Computing System UCS C-Series Servers could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack against the affected device. The vulnerability is due to improper validation of the SSL...

Cisco TelePresence ISDN Gateway Software Cross-Site Request Forgery Vulnerability

A vulnerability in the Cisco TelePresence ISDN Gateway could allow an unauthenticated, remote attacker to execute unwanted actions. The vulnerability is due to insufficient cross-site request forgery CSRF protection. An attacker could exploit this vulnerability by tricking the user of a web...

Cisco TelePresence MCU 4500 Cross-Site Request Forgery Vulnerability

A vulnerability in the Cisco TelePresence MCU 4500 Series could allow an unauthenticated, remote attacker to execute unwanted actions. The vulnerability is due to insufficient cross-site request forgery CSRF protection. An attacker could exploit this vulnerability by tricking the user of a web...

Cisco TelePresence MSE 8000 Series Cross-Site Request Forgery Vulnerability

A vulnerability in the Cisco TelePresence MSE 8000 Series could allow an unauthenticated, remote attacker to execute unwanted actions. The vulnerability is due to insufficient cross-site request forgery CSRF protection. An attacker could exploit this vulnerability by tricking the user of a web...

Cisco TelePresence IP Gateway Cross-Site Request Forgery Vulnerability

A vulnerability in the Cisco TelePresence IP Gateway Series could allow an unauthenticated, remote attacker to execute unwanted actions. The vulnerability is due to insufficient cross-site request forgery CSRF protection. An attacker could exploit this vulnerability by tricking the user of a web...

Cisco Adaptive Security Appliance Software OSPFv2 Denial of Service Vulnerability

A vulnerability in the Open Shortest Path First version 2 OSPFv2 code of Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, adjacent attacker to cause the reload of the affected system. The vulnerability is due to improper handling of OSPFv2 packets. An attacker could...

Cisco IP Communicator Web Access Denial of Service Vulnerability

A vulnerability in the web interface of Cisco IP Communicator could allow an unauthenticated, remote attacker to take the web service offline. The vulnerability is due to access of a specific HTTP URL. An attacker could exploit this vulnerability by sending an HTTP GET request to the specific...

Cisco FireSIGHT Management Center Cross-Site Request Forgery Vulnerability

A vulnerability in the Cisco FireSIGHT Management Center which could allow an unauthenticated, remote attacker to execute unwanted actions. The vulnerability is due to insufficient cross-site request forgery CSRF protections. An attacker could exploit this vulnerability by tricking the user of a...

Cisco IOS XE for Cisco 1000 Series ASR Routers Denial of Service Vulnerability

A vulnerability in PPP over Ethernet PPPoE processing on Cisco IOS XE for Cisco 1000 Series ASR routers could allow an unauthenticated, adjacent attacker to cause a reload of the affected device. The vulnerability is due to improper processing of malformed PPPoE Active Discovery Request PADR...

Cisco Adaptive Security Appliance Software OSPFv2 Denial of Service Vulnerability

A vulnerability in the Open Shortest Path First version 2 OSPFv2 code of Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, adjacent attacker to cause the reload of the affected system. The vulnerability is due to improper handling of OSPFv2 packets. An attacker could...

Cisco Digital Content Manager Message Processing Denial of Service Vulnerability

A vulnerability in Cisco Digital Content Manager DCM could allow an unauthenticated, remote attacker to crash the system mainboard. The vulnerability is due to the DCM receiving malformed ad messages from the ad server, which could trigger a system reboot. An attacker could exploit this...

Cisco Nexus Operating System Devices Command Line Interface Local Privilege Escalation Vulnerability

A vulnerability in the Command Line Interface CLI parser of Cisco Nexus Operating System NX-OS devices could allow an authenticated, local attacker to perform a privilege escalation. The vulnerability is due to improper input validation of special characters within filenames. An attacker could...

Cisco Adaptive Security Appliance SNMP Denial of Service Vulnerability

A vulnerability in the Simple Network Management Protocol SNMP code of Cisco Adaptive Security Appliance ASA Software could allow an authenticated, remote attacker to cause a reload of the affected system. The vulnerability is due to improper handling of SNMP packets. An attacker could exploit th...

Cisco Unified Communications Domain Manager Default Static Privileged Account Credentials

A vulnerability in the Cisco Unified Communications Domain Manager Platform Software could allow an unauthenticated, remote attacker to login with the privileges of the root user and take full control of the affected system. The vulnerability occurs because a privileged account has a default and...

Cisco Nexus Devices Python Subsystem Local Privilege Escalation Vulnerabilities

Multiple privilege escalation vulnerabilities in the Python subsystem of Cisco Nexus devices running Cisco NX-OS Software could allow an authenticated, local attacker to gain elevated privileges. The vulnerabilities are due to insufficient hardening of the operating system on which NX-OS is...

Cisco Unified MeetingPlace SQL Injection Vulnerability

A vulnerability in Cisco Unified MeetingPlace could allow an authenticated, remote attacker to impact the confidentiality, integrity, and availability of the affected system by executing arbitrary SQL queries. The vulnerability is due to failure to validate user-supplied input used in SQL queries...

Cisco Nexus 7000 Devices Virtual Device Context Privilege Escalation Vulnerability

A privilege escalation vulnerability in the Python scripting subsystem of Cisco Nexus 7000 devices that have been configured with multiple virtual device contexts VDCs could allow an authenticated, local attacker to delete files owned by a different VDC on the device. The vulnerability exists due...

Cisco Nexus Devices NX-OS Software Command-Line Interpreter Local Privilege Escalation Vulnerability

A local privilege escalation vulnerability in the command-line interpreter of Cisco Nexus devices could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with user privileges. The vulnerability exists due to insufficient input sanitization of...

Cisco Unified Communications Domain Manager Information Disclosure Vulnerability

A vulnerability in the web framework of Cisco Unified Communications Domain Manager Application Software could allow an unauthenticated, remote attacker to access content in the bvsmweb directory. The vulnerability is due to insufficient access controls. An attacker could exploit this vulnerabili...

Cisco Unified IP Phones 9900 Series Denial of Service Vulnerability

A vulnerability in the packet storing capabilities of Cisco 9900 Series IP Phones could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to how the phone decoder handles certain real-time transport protocol RTP packets. An attacker...

Cisco Headend System Releases Denial of Service Vulnerability

A vulnerability in Cisco Headend System Releases could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to the software's inability to recover memory after certain usage situations. An attacker could exploit this vulnerability by...

Cisco Headend System Releases Denial of Service Vulnerability

A vulnerability in Cisco Headend System Releases could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to the software's inability to recover memory after certain usage situations. An attacker could exploit this vulnerability by...

Cisco Application Policy Infrastructure Controller Unauthorized Access Vulnerability

A vulnerability in the role-based access control RBAC of the Cisco Application Policy Infrastructure Controller Cisco APIC could allow an authenticated, remote attacker to have read access to certain information stored in the affected system. The vulnerability is due to improper handling of RBAC...

Cisco Virtual WSA, ESA, and SMA Default SSH Host Keys Vulnerability

A vulnerability in the remote support functionality of Cisco WSAv, Cisco ESAv, and Cisco SMAv Software could allow an unauthenticated, remote attacker to decrypt and impersonate secure communication between any virtual content security appliances. The vulnerability is due to the presence of...

Multiple Default SSH Keys Vulnerabilities in Cisco Virtual WSA, ESA, and SMA

Cisco Web Security Virtual Appliance WSAv, Cisco Email Security Virtual Appliance ESAv, and Cisco Security Management Virtual Appliance SMAv are affected by the following vulnerabilities: Cisco Virtual WSA, ESA, and SMA Default Authorized SSH Key Vulnerability Cisco Virtual WSA, ESA, and SMA...

Cisco Wireless LAN Controller Command Injection Vulnerability

A vulnerability in the command-line interface CLI processor of the Cisco Wireless LAN Controller WLC could allow an authenticated, local attacker to inject arbitrary commands that are executed with elevated privileges on the underlying operating system. The vulnerability is due to insufficient...

Cisco Unified Presence Server Cross-Site Scripting Vulnerability

A vulnerability in the Cisco Unified Presence Server could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of the affected system. The vulnerability is due to insufficient input validation of a user-supplied value. An...

Cisco IM and Presence Service Leaked Encrypted Passwords Privilege Escalation Vulnerability

A vulnerability in the Cisco IM and Presence Service could allow an authenticated, remote attacker to gain elevated privileges. The vulnerability is due to improper web page restrictions imposed by the affected software. An authenticated, remote attacker could exploit this vulnerability to access...

Cisco IM and Presence Service SQL Injection Vulnerability

A vulnerability in the database of Cisco IM and Presence Service could allow an authenticated, remote attacker to impact the confidentiality, integrity, and availability of the affected system by executing arbitrary SQL queries. The vulnerability is due to a failure to validate user-supplied inpu...

Cisco IOS XR MPLS LDP Packet Processing Denial of Service Vulnerability

A vulnerability in the Multiprotocol Label Switching MPLS Label Distribution Protocol LDP packet processing feature of Cisco IOS XR could allow an unauthenticated, remote attacker to cause a reload of the MPLS LDP process on the affected device. The vulnerability is due to improper processing of...