Cisco TelePresence TC and TE Software u-boot Buffer Overflow Vulnerability

A vulnerability in the implementation of executable utilities that use the universal bootloader u-boot compiler of Cisco TelePresence TC and TE Software could allow an authenticated, local attacker to create a buffer overflow and possibly execute arbitrary code on the affected system. The...

Cisco WebEx Meetings Server Cross-Site Request Forgery Vulnerability

A vulnerability in the web framework code of Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to perform a cross-site request forgery CSRF attack. The vulnerability is due to insufficient CSRF protections. An attacker could exploit this vulnerability by convincing the...

Multiple Vulnerabilities in Cisco TelePresence TC and TE Software

Cisco TelePresence TC and TE Software are affected by the following vulnerabilities: Six Session Initiation Protocol SIP denial of service vulnerabilities Cisco TelePresence TC and TE Software DNS Buffer Overflow Vulnerability Cisco TelePresence TC and TE Software Input Validation Vulnerability...

Multiple Vulnerabilities in Cisco TelePresence System MXP Series

Cisco TelePresence System MXP Series Software contains the following vulnerabilities: Three SIP denial of service vulnerabilities Three H.225 denial of service vulnerabilities Successful exploitation of these vulnerabilities may allow an attacker to cause system instability and the affected syste...

Cisco Unified Contact Center Express Arbitrary File Upload Vulnerability

A vulnerability in Document Management of Cisco Unified Contact Center Express could allow an authenticated, remote attacker to upload files to arbitrary locations on the filesystem. The vulnerability is due to insufficient parameter validation. An attacker could exploit this vulnerability by...

Cisco Adaptive Security Appliance DHCPv6 Denial of Service Vulnerability

A vulnerability in the DHCP code of Cisco ASA Software could allow an unauthenticated, adjacent attacker to cause the reload of an affected system. The vulnerability is due to insufficient validation of crafted or malformed DHCP version 6 DHCPv6 packets when DHCPv6 replay feature is enabled. An...

Cisco Unified Communications Manager Arbitrary File Read Vulnerability

A vulnerability in the command-line interface CLI of Cisco Unified Communications Manager Cisco UCM could allow an authenticated, local attacker to read the contents of arbitrary files. The vulnerability is due to incomplete input validation. An attacker could exploit this vulnerability by issuin...

Cisco Unified Communications Manager CDR Management Vulnerability

A vulnerability in Call Detail Records CDR Management of Cisco Unified Communications Manager Cisco Unified CM could allow an authenticated, remote attacker to acquire sensitive information. The vulnerability is due to extraneous information included in the web page. An attacker could exploit thi...

Cisco Unified Communications Manager Sensitive Information Disclosure Vulnerability

A vulnerability in Cisco IP Manager Assistant IPMA of Cisco Unified Communications Manager Cisco Unified CM could allow an unauthenticated, remote attacker to access sensitive information on the affected device. The vulnerability is due to improper validation of user input. An attacker could...

Cisco IOS XE Software Malformed L2TP Packet Vulnerability

A vulnerability in the Layer 2 Tunneling Protocol L2TP module of Cisco IOS XE on Cisco ASR 1000 Series Routers could allow an authenticated, remote attacker to cause a reload of the processing ESP card. The vulnerability occurs during the processing of a malformed L2TP packet. An attacker could...

Cisco Adaptive Security Appliance Software SIP Inspection Memory Leak Vulnerability

A vulnerability in the Session Initiation Protocol SIP inspection engine code could allow an unauthenticated, remote attacker to cause a slow memory leak, which may cause instability on the affected system. The vulnerability is due to improper handling of SIP packets inspected by the Cisco Adapti...

Cisco Network Registrar DHCPv6 Denial of Service Vulnerability

A vulnerability in the DHCPv6 server module of Cisco Network Registrar could allow an unauthenticated, remote attacker to cause a reload of the DHCPv6 server on an affected device. The vulnerability is due to the way certain malformed requests are processed. An attacker could exploit this...

Cisco Adaptive Security Appliance SSL VPN Authentication Bypass Vulnerability

A vulnerability in the SSL VPN code could allow an unauthenticated, remote attacker to access the SSL VPN portal web page. The vulnerability is due to improper handling of authentication cookies when the Cisco ASA SSL VPN feature is enabled. An attacker could exploit this vulnerability by manuall...

Multiple Vulnerabilities in Cisco ASA Software

Cisco Adaptive Security Appliance ASA Software is affected by the following vulnerabilities: Cisco ASA ASDM Privilege Escalation Vulnerability Cisco ASA SSL VPN Privilege Escalation Vulnerability Cisco ASA SSL VPN Authentication Bypass Vulnerability Cisco ASA SIP Denial of Service Vulnerability...

OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Products

Multiple Cisco products incorporate a version of the OpenSSL package affected by a vulnerability that could allow an unauthenticated, remote attacker to retrieve memory in chunks of 64 kilobytes from a connected client or server. The vulnerability is due to a missing bounds check in the handling ...

Cisco ONS 15454 Controller Card Denial of Service Vulnerability

A vulnerability in the session termination function of the Cisco ONS 15454 Controller Cards could allow an authenticated, remote attacker to cause the control card to reset. The vulnerability is due to an uninitialized pointer. An attacker could exploit this vulnerability by closing sessions in a...

Cisco ONS 15454 Controller Card Denial of Service Vulnerability

A vulnerability in the code of the Cisco ONS 15454 Controller Cards could allow an unauthenticated, remote attacker to cause the control card to reset. The vulnerability is due to improper instructions to reload the controller card. A CAL pipe fails to open when the file descriptors are exhausted...

Cisco ONS 15454 Controller Card Denial of Service Vulnerability

A vulnerability in the code of the Cisco ONS 15454 Controller Cards could allow an unauthenticated, remote attacker to prevent system access to the flash memory on the control card. The vulnerability is caused when the file descriptors are exhausted during a FIN attack. An attacker could exploit...

OpenSSL TLS/DTLS Heartbeat Information Disclosure Vulnerability

A vulnerability in the Transport Layer Security TLS/Datagram Transport Layer Security DTLS heartbeat functionality in OpenSSL used in multiple Cisco products could allow an unauthenticated, remote attacker to retrieve memory in chunks of 64 kilobytes from a connected client or server. The...

Cisco ONS 15454 Controller Card Denial of Service Vulnerability

A vulnerability in the web interface of Cisco ONS15454 controller cards could allow an unauthenticated, remote attacker to cause the control card to reset. The vulnerability is due to incorrect parsing of the HTTP URI. An attacker could exploit this vulnerability by sending specific HTTP requests...

Cisco Unity Connection Directory Traversal Vulnerability

A vulnerability in the messaging API of Cisco Unity Connection could allow an authenticated, remote attacker to execute a directory traversal and download arbitrary files that match the allowed MIME types. The vulnerability occurs because there is insufficient input filtering and file types other...

Cisco Emergency Responder Dynamic Content Modification Vulnerability

A vulnerability in the web interface of Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct web page injection attack against a user browser of the Cisco Emergency Responder. The vulnerability is due to insufficient input validation of several parameters. An...

Cisco IOS Software and Cisco IOS XE Software IKE Main Mode Vulnerability

A vulnerability in the Internet Key Exchange IKE module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to delete established security associations on an affected device. The vulnerability is due to improper handling of rogue IKE Main Mode packets. ...

Cisco Emergency Responder Cross-Site Request Forgery Vulnerability

A vulnerability in the CERUserServlet pages of the Cisco Emergency Responder Cisco ER could allow an unauthenticated, remote attacker to perform a cross-site request forgery CSRF attack against the Cisco ER web interface. The vulnerability is due to insufficient CSRF protections on the Cisco ER w...

Cisco Emergency Responder Cross-Site Scripting Vulnerability

A vulnerability in the Cisco Emergency Responder Cisco ER UserServlet of Cisco ER Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the Cisco ER web interface. The vulnerability is due to insufficient input validation of a...

Cisco Emergency Responder Open Redirect Vulnerability

A vulnerability in the web interface of Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct a web page open redirection attack against a user browser of the Cisco Emergency Responder. The vulnerability is due to insufficient input validation of several parameters...

Cisco WSA HTTP Header Injection Vulnerability

A vulnerability in the web framework of Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to inject a crafted HTTP header that could cause a web page redirection to a possible malicious website. The vulnerability is due to insufficient validation of user input befor...

Cisco Security Manager HTTP Header Redirection Vulnerability

A vulnerability in the web framework of Cisco Security Manager could allow an unauthenticated, remote attacker to inject a crafted HTTP header, which will cause a web page redirection to a possible malicious website. The vulnerability is due to insufficient validation of user input before using i...

Cisco Unity Connection Cross-Site Scripting Vulnerability

A vulnerability in Cisco Unity Connection Web Inbox could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack. The vulnerability is due to insufficient input validation of a parameter. An attacker could exploit this vulnerability by persuading a user to access a...

Cisco IOS Software High Priority Queue Denial of Service Vulnerability

A vulnerability in the packet driver code of Cisco IOS Software could allow an unauthenticated, remote attacker to cause a reload of the affected device, resulting in a denial of service DoS condition. The vulnerability is due to how the packet driver code handles packets that belong to protocols...

Cisco Prime Security Manager Cross-Site Scripting Vulnerability

A vulnerability in the web framework of Cisco Prime Security Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface on the affected system. The vulnerability is due to insufficient input validation of several...

Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability

A vulnerability in the Session Initiation Protocol SIP implementation in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device. To exploit this vulnerability, affected devices must be configured to process SIP messages...

Cisco IOS Software Network Address Translation Vulnerabilities

The Cisco IOS Software implementation of the Network Address Translation NAT feature contains two vulnerabilities when translating IP packets that could allow an unauthenticated, remote attacker to cause a denial of service condition. Cisco has released software updates that address these...

Cisco 7600 Series Route Switch Processor 720 with 10 Gigabit Ethernet Uplinks Denial of Service Vulnerability

A vulnerability in the Cisco 7600 Series Route Switch Processor 720 with 10 Gigabit Ethernet Uplinks models RSP720-3C-10GE and RSP720-3CXL-10GE could allow an unauthenticated, remote attacker to cause the route processor to reboot or stop forwarding traffic. The vulnerability is due to an issue i...

Cisco IOS Software Internet Key Exchange Version 2 Denial of Service Vulnerability

A vulnerability in the Internet Key Exchange Version 2 IKEv2 module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of the affected device that would lead to a denial of service DoS condition. The vulnerability is due to how an...

Cisco IOS Software Crafted IPv6 Packet Denial of Service Vulnerability

A vulnerability in the implementation of the IP version 6 IPv6 protocol stack in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause I/O memory depletion on an affected device that has IPv6 enabled. The vulnerability is triggered when an affected...

Cisco IOS Software SSL VPN Denial of Service Vulnerability

A vulnerability in the Secure Sockets Layer SSL VPN subsystem of Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to a failure to process certain types of HTTP requests. To exploit the vulnerability, an attacke...

Cisco IOS Software Sup2T Denial of Service Vulnerability

A vulnerability in Cisco Catalyst 6500 Supervisor Engine 2T Sup2T could allow an unauthenticated, remote attacker to crash the device. The vulnerability is due to incorrect processing multicast traffic by the Sup2T. An attacker could exploit this vulnerability by sending crafted packets to the...

Cisco Hosted Collaboration Solution Denial of Service Vulnerability

A vulnerability in Java code on the Cisco Hosted Collaboration Solution HCS could allow an unauthenticated, remote attacker to close TCP ports used by the system. The vulnerability is due to improper packet processing in the Java code. An exploit could allow the attacker to create a denial of...

Cisco AsyncOS Software Code Execution Vulnerability

Cisco AsyncOS Software for Email Security Appliance ESA and Cisco Content Security Management Appliance SMA contain a vulnerability that could allow an authenticated remote attacker to execute arbitrary code with the privileges of the root user. Cisco has released software updates that address th...

Cisco Hosted Collaboration Solution Memory Leak Vulnerability

A vulnerability in the graphical user interface of the Impact server in the Cisco Hosted Collaboration Solution HCS could allow an unauthenticated, remote attacker to cause a memory leak. The vulnerability is due to improper packet processing in the application. An exploit could allow the attacke...

Cisco Adaptive Security Appliance WebVPN Login Page Cross-Site Scripting Vulnerability

A vulnerability in the WebVPN login page of Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of WebVPN on the Cisco ASA. The vulnerability is due to insufficient input validation of a...

Cisco Intelligent Automation for Cloud Cryptographic Implementation Issues

Issues in the cryptographic implementation of Cisco Intelligent Automation for Cloud Cisco IAC may allow an unauthenticated, remote attacker to recover cryptographic material used in all Cisco IAC installations. The issues are due to the inclusion of fixed cryptographic material in the product...

Cisco Small Business Router Password Disclosure Vulnerability

A vulnerability in the web management interface of the Cisco RV110W Wireless-N VPN Firewall, the Cisco RV215W Wireless-N VPN Router, and the Cisco CVR100W Wireless-N VPN Router could allow an unauthenticated, remote attacker to gain administrative-level access to the web management interface of t...

Multiple Vulnerabilities in Cisco Wireless LAN Controllers

The Cisco Wireless LAN Controller WLC product family is affected by the following vulnerabilities: Cisco Wireless LAN Controller Denial of Service Vulnerability Cisco Wireless LAN Controller Unauthorized Access to Associated Access Points Vulnerability Cisco Wireless LAN Controller IGMP Version 3...

Cisco IPS MainApp SNMP Denial of Service Vulnerability

A vulnerability in the SNMP code of Cisco Intrusion Prevention System IPS Software could allow an unauthenticated, remote attacker to cause the MainApp process to become unresponsive. This creates a denial of service DoS condition because the Cisco IPS sensor is not able to execute several critic...

Cisco Unified Communications Domain Manager Cross-Site Scripting Vulnerability

A vulnerability in the web framework of Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface on the affected system. The vulnerability is due to insufficient input validation of...

Cisco Unified Contact Center Express Serviceability Page CSRF Vulnerability

A vulnerability in the Cisco Unified Serviceability component of Cisco Unified Contact Center Express Cisco Unified CCX could allow an unauthenticated, remote attacker to perform a cross-site request forgery CSRF attack. The vulnerability is due to insufficient CSRF protections. An attacker could...

Cisco Unified Contact Center Express DRS Sensitive Information Disclosure Vulnerability

A vulnerability in the disaster recovery system DRS of Cisco Unified Contact Center Express Cisco Unified CCX could allow an authenticated, remote attacker to acquire sensitive information about DRS-related devices. The vulnerability is due to extraneous information included in the web page. An...

Cisco Unified Contact Center Express CCMConfig Sensitive Information Disclosure Vulnerability

A vulnerability in the CCMConfig page of Cisco Unified Contact Center Express Cisco Unified CCX could allow an authenticated, remote attacker to access sensitive information. The vulnerability is due to the presence of sensitive information in the CCMConfig page. An attacker could exploit this...