Cisco Unified MeetingPlace Server Multiple State Changing URL API Functionalities Cross-Site Request Forgery Vulnerability

A vulnerability in multiple-state-changing URL application programming interface API functionalities within the Cisco Unified MeetingPlace Server could allow an unauthenticated, remote attacker to perform cross-site request forgery CSRF attacks. The vulnerability is due to insufficient CSRF...

Cisco Unified MeetingPlace Web Services Directory SOAP API Endpoints Cross-Site Request Forgery Vulnerability

A vulnerability in the SOAP application programming interface API endpoints of the web services directory of Cisco Unified MeetingPlace could allow an unauthenticated, remote attacker to perform a cross-site request forgery CSRF attack. The vulnerability is due to insufficient CSRF protections in...

Cisco Unified MeetingPlace Custom Prompts languageShortName Parameter Arbitrary Code Execution Vulnerability

A vulnerability in the languageShortName parameter of the Custom Prompts upload feature of Cisco Unified MeetingPlace could allow an authenticated, remote attacker to execute arbitrary code. The vulnerability is due to insufficient validation of input parameters by an affected system. An attacker...

Cisco Unified MeetingPlace Administrative Web Interface Reflected Cross-Site Scripting Vulnerability

A vulnerability in the administrative web interface of Cisco Unified MeetingPlace could allow an unauthenticated, remote attacker to perform a reflected cross-site scripting XSS attack on an affected system. The vulnerability is due to improper validation of user-supplied input by the affected...

Cisco Secure Access Control Server Dashboard Page Cross-Site Request Forgery Vulnerability

A vulnerability in the Dashboard page in the monitoring and report section of Cisco Secure Access Control Server could allow an unauthenticated, remote attacker to perform a cross-site request forgery CSRF attack. The vulnerability is due to the improper generation and validation of the CSRF toke...

Cisco Secure Desktop Cache Cleaner Command Execution Vulnerability

A vulnerability in a Cisco-signed Java Archive JAR executable Cache Cleaner component of Cisco Secure Desktop could allow an unauthenticated, remote attacker to execute arbitrary commands on the client host where the affected .jar file is executed. Command execution would occur with the privilege...

Cisco IOS XR Software BVI Routed Packet Denial of Service Vulnerability

A vulnerability in the packet-processing code of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers ASR could allow an unauthenticated, remote attacker to cause a lockup and eventual reload of a network processor chip and the line card that is processing traffic. Only...

Cisco Unified Communications Manager Interactive Voice Response Interface SQL Injection Vulnerability

A vulnerability in the Interactive Voice Response IVR interface of Cisco Unified Communications Manager UCM could allow an unauthenticated, remote attacker to conduct SQL injection attacks. The vulnerability is due to a lack of input validation on user-supplied input within SQL queries. An attack...

Cisco Web Security Appliance Cross-Site Scripting Vulnerability

A vulnerability in filter search forms of certain admin webpages of the Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to perform cross-site scripting XSS attacks. The vulnerability is due to insufficient input validation by an affected device. An unauthenticated...

Cisco TelePresence Collaboration Desk and Room Endpoints HTML Redirect Vulnerability

A vulnerability within the login page of the web user interface of Cisco TelePresence Collaboration Desk and Room Endpoints devices running TC Software could allow an unauthenticated, remote attacker to conduct HTML redirection attacks. The vulnerability is due to improper input validation of...

Multiple Cisco TelePresence Products Cross-Site Scripting Vulnerability

A vulnerability within the login page of the web user interface of Cisco TelePresence Collaboration Desk and Room Endpoints devices running TC Software could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability is due to improper input validation of...

Cisco Web Security Appliance Python File Processing Privilege Escalation Vulnerability

A vulnerability in the status-checking process of remote access tunnels for supporting Cisco Web Security Appliances WSA could allow an authenticated, local attacker to execute arbitrary Python code on the affected system. The vulnerability is due to improper usage and handling of the pickle Pyth...

Cisco Web Security Appliance Pickle Python Module Arbitrary Code Execution Vulnerability

A vulnerability in the status checking process of support remote access tunnels in the Cisco Web Security Appliance WSA could allow an authenticated, local attacker to execute arbitrary Python code on a targeted system. The vulnerability is due to improper use and handling of the pickle Python...

Cisco Aggregate Services Router 9000 ASR9K Security Bypass Vulnerability

A vulnerability in the Object-ACL matching process of Cisco Aggregation Services Router 9000 ASR9K could allow an unauthenticated, remote attacker to bypass the protection offered by a configured access control list ACL on an affected device. The vulnerability is due to ASR9K incorrectly handling...

Network Time Protocol Daemon MAC Checking Failure Authentication Bypass Vulnerability

A vulnerability in the Network Time Protocol NTP daemon could allow an unauthenticated, adjacent attacker to bypass authentication mechanisms and access an affected system. The vulnerability is due to incorrect validation of the message authentication code MAC field. An attacker could exploit thi...

Network Time Protocol Daemon Symmetric Mode Packet Processing Denial of Service Vulnerability

A vulnerability in ntpd could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition on an affected system. The vulnerability is due to improper processing of Network Time Protocol NTP packets when handling symmetric key authentication failures. An attacker could...

Multiple Vulnerabilities in ntpd (April 2015) Affecting Cisco Products

Multiple Cisco products incorporate a version of the ntpd package. Versions of this package are affected by one or more vulnerabilities that could allow an unauthenticated, remote attacker to bypass authentication controls or to create a denial of service DoS condition. On April 7, 2015, NTP.org...

Multiple Vulnerabilities in Cisco ASA Software

Cisco Adaptive Security Appliance ASA Software is affected by the following vulnerabilities: Cisco ASA Failover Command Injection Vulnerability Cisco ASA DNS Memory Exhaustion Vulnerability Cisco ASA VPN XML Parser Denial of Service Vulnerability Successful exploitation of the Cisco ASA Failover...

Cisco ASA FirePOWER Services and Cisco ASA CX Services Crafted Packets Denial of Service Vulnerability

A vulnerability in the virtualization layer of the Cisco ASA FirePOWER Services and Cisco ASA Context Aware CX Services could allow an unauthenticated, remote attacker to cause the a reload of the affected system. Cisco has released software updates that address this vulnerability. The resolution...

Cisco Wireless LAN Controller HTML Help Cross-Site Scripting Vulnerability

A vulnerability in the HTML help system of Cisco Wireless LAN Controller WLC devices could allow an unauthenticated, remote attacker conduct cross-site scripting attacks. An unauthenticated, remote attacker who can convince a user of an affected system to follow a malicious link or visit an...

Cisco ASR1000 Series Routers ESP Module Denial of Service Vulnerability

A vulnerability in the Embedded Services Processor ESP module of Cisco ASR 1000 Series Routers running Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to improper handling of malformed H.323 packets by an...

Cisco Nexus 9000 Series Denial of Service Vulnerability

A vulnerability in the SNMP subsystem of Cisco Nexus 9000 software could allow an authenticated, remote attacker to cause a denial of service DoS condition. The vulnerability occurs when the High Availability HA policy is set to Reset in the affected software. An authenticated, remote attacker...

Cisco Catalyst 4500 SNMP Polling Denial of Service Vulnerability

A vulnerability in the Simple Network Management Protocol SNMP code of Cisco Catalyst 4500 devices running Cisco IOS Software could allow an authenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to an unspecified condition that exists during SNMP...

Cisco Identity Services Engine Portal Privilege Elevation Vulnerability

A vulnerability in the Sponsor Portal of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to access guest accounts created from another sponsor account. The vulnerability is due to a failure to restrict guest accounts across sponsors. An attacker could exploit this...

Cisco Prime Data Center Network Manager File Information Disclosure Vulnerability

Cisco Prime Data Center Network Manager DCNM contains a file information disclosure vulnerability that could allow an unauthenticated, remote attacker to retrieve arbitrary files from the underlying operating system. Cisco has released software updates that address this vulnerability. Workarounds...

Multiple Vulnerabilities in Cisco Unity Connection

Cisco Unity Connection contains multiple vulnerabilities, when it is configured with Session Initiation Protocol SIP trunk integration. The vulnerabilities described in this advisory are denial of service vulnerabilities impacting the availability of Cisco Unity Connection for processing SIP...

Cisco ASR1000 Series Routers Incomplete or Glean Adjacencies Denial of Service Vulnerability

A vulnerability in Cisco ASR 1000 Series software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to improper processing of route adjacencies. An attacker could exploit this vulnerability by sending malicious IP packets to an...

Cisco Unified Communications Domain Manager Application Software Information Disclosure Vulnerability

A vulnerability in Cisco Unified Communications Domain Manager Application Software could allow an authenticated, remote attacker to gain access to sensitive information. The vulnerability is due to unspecified condition within the affected software that could allow local file inclusion. An...

Cisco Unified Communications Domain Manager Application Software SQL Injection Vulnerability

A vulnerability in the Image Management functionality of Cisco Unified Communications Domain Manager Application Software could allow an authenticated, remote attacker to conduct SQL injection attacks. The vulnerability is due to insufficient validation of user-supplied input by the affected...

Cisco Unified Communications Domain Manager Application Software Remote Code Execution Vulnerability

A vulnerability in a deprecated page in Cisco Unified Communications Domain Manager Application Software could allow an authenticated, remote attacker to execute arbitrary code. The vulnerability is due to insufficient security restrictions imposed by the affected software that could allow...

Cisco Unified Call Manager Arbitrary File Retrieval Vulnerability

A vulnerability in Cisco Unified Call Manager Cisco Unified CM could allow an authenticated, remote attacker to retrieve arbitrary files. The vulnerability is due to improper security restrictions by the affected application while handling requests for resources. An authenticated, remote attacker...

Cisco NX-OS Software DHCP Options Command Injection Vulnerability

A vulnerability in DHCP code used with PowerOn Auto Provisioning POAP of Cisco NX-OS could allow an unauthenticated, adjacent attacker to inject arbitrary commands into the Cisco NX-OS device. The vulnerability is due to insufficient input validation of the DHCP options returned as a result of...

Cisco Wireless LAN Controller Task Name aaaQueueReader Denial of Service Vulnerability

A vulnerability in the web authentication feature of Cisco Wireless LAN Controller WLC could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition. The vulnerability is due to the improper handling of ill-formed passwords by the web authentication feature used by...

Multiple Vulnerabilities in Cisco IOS Software and IOS XE Software Autonomic Networking Infrastructure

The Autonomic Networking Infrastructure ANI feature of Cisco IOS Software and IOS XE Software has multiple vulnerabilities which could allow an unauthenticated, remote attacker to cause a denial of service DoS condition or gain limited command and control of the device. Autonomic Networking...

Multiple Vulnerabilities in Cisco IOS Software Common Industrial Protocol

The Cisco IOS Software implementation of the Common Industrial Protocol CIP feature contains the following vulnerabilities when processing crafted CIP packets that could allow an unauthenticated, remote attacker to cause a denial of service DoS condition: Cisco IOS Software UDP CIP Denial of...

Cisco IOS Software Virtual Routing and Forwarding ICMP Queue Wedge Vulnerability

A vulnerability within the virtual routing and forwarding VRF subsystem of Cisco IOS software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to a failure to properly process malicious ICMP version 4 ICMPv4 messages received on ...

Cisco IOS Software and IOS XE Software TCP Packet Memory Leak Vulnerability

A vulnerability in the TCP input module of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak and eventual reload of the affected device. The vulnerability is due to improper handling of certain crafted packet sequences used in establishing ...

Cisco IOS Software and IOS XE Software mDNS Gateway Denial of Service Vulnerability

A vulnerability in the multicast DNS mDNS gateway function of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to reload the vulnerable device. The vulnerability is due to improper validation of mDNS packets. An attacker could exploit this vulnerability...

Multiple Vulnerabilities in Cisco IOS XE Software for Cisco ASR 1000 Series, Cisco ISR 4400 Series, and Cisco Cloud Services 1000v Series Routers

Cisco IOS XE Software for Cisco ASR 1000 Series Aggregation Services Routers ASR, Cisco 4400 Series Integrated Services Routers ISR, and Cisco Cloud Services Routers CSR 1000v Series contains the following vulnerabilities: Cisco IOS XE Software Fragmented Packet Denial of Service Vulnerability...

Cisco IOS Software and IOS XE Software Internet Key Exchange Version 2 Denial of Service Vulnerabilities

Devices running Cisco IOS Software or IOS XE Software contain vulnerabilities within the Internet Key Exchange IKE version 2 subsystem that could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerabilities are due to how an affected device processes...

Cisco Mobility Service Engine Password Information Disclosure Vulnerability

A vulnerability in the Cisco Mobility Services Engine MSE could allow an authenticated, remote attacker to gain access to sensitive information. The vulnerability is due to insufficient security restrictions imposed by the affected software. An authenticated, remote attacker could exploit this...

Cisco IOS XR Software DHCPv4 Server Denial of Service Vulnerability

A vulnerability in the DHCP process of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to improper processing of crafted DHCP messages on a targeted...

Multiple Vulnerabilities in OpenSSL (March 2015) Affecting Cisco Products

Multiple Cisco products incorporate a version of the OpenSSL package affected by one or more vulnerabilities that could allow an unauthenticated, remote attacker to cause a denial of service DoS condition or corrupt portions of OpenSSL process memory. On March 19, 2015, the OpenSSL Project releas...

Cisco Small Business SPA300 and SPA500 Series IP Phones Unauthenticated Remote Dial Vulnerability

A vulnerability in the firmware of the Cisco Small Business SPA 300 and 500 series IP phones could allow an unauthenticated, remote attacker to listen to the audio stream of an IP phone. The vulnerability is due to improper authentication settings in the default configuration. An attacker could...

Cisco Videoscape Distribution Suite for Internet Streaming Denial of Service Vulnerability

A vulnerability in the DNS subsystem of the Cisco Videoscape Distribution Suite for Internet Streaming VDS-IS used by Cisco services routers could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to insufficient validation of specific...

Cisco WebEx Meetings Server Administrative Portal Cross-Site Scripting Vulnerability

A vulnerability in the administration portal page of the Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct cross-site scripting XSS attacks. The vulnerability is due to insufficient validation of user-supplied input submitted to the administration portal page ...

Cisco IOS Software Autonomic Networking Infrastructure Overwrite Vulnerability

A vulnerability in the Autonomic Networking Infrastructure ANI feature of Cisco IOS software could allow an unauthenticated, remote attacker to overwrite some configuration values received via ANI. The vulnerability is due to insufficient validation of received Autonomic Networking AN messages. A...

Cisco Content Services Switch (11500) Unauthenticated Port Forwarding Vulnerability

A vulnerability in the Management Interface of the Cisco Content Services Switch 11500 could allow an unauthenticated, remote attacker to gain unauthorized access to other devices on the network. The vulnerability is due to improper handling of SSH packets. An attacker could exploit this...

Cisco Virtual TelePresence Server Serial Console Privileged Access Vulnerability

A vulnerability in Cisco Virtual TelePresence Server Software could allow an authenticated, local attacker to access the shell of the underlying operating system with the privilege level of the root user. The vulnerability is due to undocumented privileged access through the serial connection,...

Cisco AnyConnect Secure Mobility Client Arbitrary Code Execution Vulnerability

A vulnerability in the inter-process communication IPC channel of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker to execute arbitrary code with elevated privileges. The vulnerability is due to unauthenticated IPC commands which allow software installation as...