5245 matches found
Cisco Server Provisioner Web Interface Information Disclosure Vulnerability
A vulnerability in the web interface of Cisco Server Provisioner could allow an unauthenticated, remote attacker to access some pages directly that should require authentication. The vulnerability is due to a failure to enforce access controls for the vulnerable pages. An attacker could exploit...
Cisco Nexus 1000V Series Switches Arbitrary Command Execution Vulnerability
A vulnerability in the license installation module of the Cisco Nexus 1000V could allow an authenticated, local attacker to execute arbitrary shell commands. The vulnerability is due to a failure of the install all iso command to properly validate user-supplied input. An attacker could exploit th...
Cisco Services Portal File Download Vulnerability
A vulnerability in the ''Files Available for Download'' window of Cisco Intelligent Automation for Cloud could allow an authenticated, remote attacker to download arbitrary files from the system. The vulnerability is due to a failure to perform sufficient server-side validation of user-supplied...
Cisco Unified Communications Manager Arbitrary File Read/Write Vulnerability
A vulnerability in a command-line utility of Cisco Unified Communications Manager Cisco Unified CM could allow an authenticated, local attacker to read or write data to arbitrary locations on the filesystem. The vulnerability is due to insufficient input validation. An attacker could exploit this...
Cisco Enterprise License Manager Path Traversal Vulnerability
A vulnerability in the license upload interface of the Cisco Enterprise License Manager ELM could allow an authenticated, remote attacker to upload files to arbitrary locations on the filesystem. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerabili...
Cisco IOS Software SSL VPN Interface Queue Wedge Denial of Service Vulnerability
A vulnerability in the Datagram Transport Layer Security DTLS function of the Cisco IOS Software SSL VPN feature could allow an authenticated, remote attacker to cause the SSL VPN gateway interface to stop processing traffic when the queue is full, resulting in a denial of service DoS condition...
Cisco Wireless LAN Controller HTTP Request Denial of Service Vulnerability
A vulnerability in the web framework of the Cisco Wireless LAN Controller WLC could allow an authenticated, remote attacker to create a denial of service DoS condition. The vulnerability is due to improper input validation of configuration parameters. An attacker could exploit this vulnerability ...
Cisco Unified IP Phone 8900/9900 Series Insecure File Permissions Vulnerability
A vulnerability in Cisco Unified IP Phone 9951, Cisco Unified IP Phone 9971, and Cisco Unified IP Phone 8961 could allow an authenticated, local attacker to fully compromise the affected device. The vulnerability is due to insecure file permissions on memory block devices. An attacker could explo...
Cisco Nexus 4000 Series Switches IPv6 Denial of Service Vulnerability
A vulnerability in the IP version 6 IPv6 packet handling routine of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a device to stop responding to neighbor solicitation NS requests, causing a limited denial of service DoS condition. The vulnerability is due to...
Cisco Content Services Gateway Traffic Bypass Vulnerability
A vulnerability in the parse error drop function of the Cisco Content Services Gateway CSG could allow an unauthenticated, remote attacker to bypass configured policies. The vulnerability is due to invalid processing in the parse error drop function. An attacker could exploit this vulnerability b...
Cisco Adaptive Security Appliance IPv6 NAT Denial of Service Vulnerability
A vulnerability in the function that performs IP version 6 IPv6 Network Address Translation NAT for Cisco ASA Software could allow an unauthenticated, remote attacker to cause a reload of an affected system. The vulnerability is due to improper implementation of the logic that performs NAT when t...
Cisco Adaptive Security Appliance Auto-Update Denial of Service Vulnerability
A vulnerability in the auto-update feature of the Cisco Adaptive Security Appliance ASA could allow an unauthenticated, remote attacker to cause a reload of the ASA. The vulnerability is due to insufficient input validation of auto-update data. An attacker could exploit this vulnerability by...
Cisco Adaptive Security Appliance Phone Proxy Database Entry Manipulation Vulnerability
A vulnerability in the phone proxy feature of the Cisco Adaptive Security Appliance ASA could allow an unauthenticated, remote attacker to temporarily insert an invalid entry in the phone proxy connection database. The vulnerability is due to the acceptance of an untrusted certificate. An attacke...
Cisco IOS XR Software OSPFv3 Denial of Service Vulnerability
A vulnerability in the Open Shortest Path First version 3 OSPFv3 implementation in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a crash of the OSPFv3 process on an affected device. The vulnerability is due to improper parsing of malformed type 1 link-state...
Cisco MDS 9000 NX-OS Software Denial of Service Vulnerability
A vulnerability in the supervisor of the Cisco MDS Family could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to improper handling of Virtual Router Redundancy Protocol VRRP frames. An attacker could exploit this vulnerability by...
Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability
A vulnerability exists in the Session Initiation Protocol SIP implementation in Cisco IOS Software that could allow an unauthenticated, remote attacker to cause a reload of an affected device or cause memory leaks that may result in system instabilities. To exploit this vulnerability, affected...
Cisco WAAS Mobile Remote Code Execution Vulnerability
Cisco Wide Area Application Services WAAS Mobile contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the Cisco WAAS Mobile server with the privileges of the Microsoft Internet Information Services IIS web server. Cisco has released software...
Cisco TelePresence VX Clinical Assistant Administrative Password Reset Vulnerability
A vulnerability in the WIL-A module of Cisco TelePresence VX Clinical Assistant could allow an unauthenticated, remote attacker to log in as the admin user of the device using a blank password. The vulnerability is due to a coding error that resets the password for the admin user to a blank...
Cisco Prime Central for Hosted Collaboration Solution Denial of Service Vulnerability
A vulnerability in the ITM web server interface of the Cisco Prime Central for Hosted Collaboration Solution HCS could allow an unauthenticated, remote attacker to cause a denial of service on the targeted device. The vulnerability is due to the ITM port being unable to deal with a TCP flood. An...
Cisco Prime Central for Hosted Collaboration Solution Denial of Service Vulnerability
A vulnerability in the Impact server Java process of Cisco Prime Central for Hosted Collaboration Solution HCS could allow an unauthenticated, remote attacker to crash the Impact server Java process. The vulnerability is due to the Impact server Java process consuming available resources. An...
Cisco ASA CX Safe Search Policy Bypass Vulnerability
A vulnerability in the Safe Search enforcement component of Cisco ASA CX Context-Aware Security could allow an unauthenticated, remote attacker to bypass security policy enforced by the affected component. The vulnerability is due to improper implementation of the logic that should perform the...
Cisco AnyConnect Secure Mobility Client VPNAPI COM Buffer Overflow Vulnerability
A vulnerability in the Active Template Library ATL framework used by a component of the Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, remote attacker to execute arbitrary commands with the privilege of the user executing the web browser. The vulnerability is due to...
Cisco IOS Software Internet Key Exchange Version 2 Anti-replay Protection Disabled Vulnerability
A vulnerability in the implementation of the Cisco IOS Software Internet Key Exchange version 2 IKEv2 protocol may cause the anti-replay capabilities of IPsec to be disabled. This issue occurs only when using the Advanced Encryption Standard Galois/Counter Mode AES-GCM or the AES Galois Message...
Cisco Adaptive Security Appliance Software Clientless SSL VPN Rewriter Denial of Service Vulnerability
A vulnerability in the clientless SSL VPN feature of Cisco Adaptive Security Appliance ASA Software could allow an authenticated, remote attacker to cause an affected system to reload. The vulnerability is due to a stack overflow while browsing internal resources via the clientless SSL VPN portal...
Cisco Unified Communications Manager Denial of Service Vulnerability
A vulnerability in Cisco Unified Communications Manager Unified CM could allow an unauthenticated, remote attacker to create a denial of service DoS condition. The vulnerability is due to improper parsing of a SIP message. An attacker could exploit this vulnerability by sending a specific SIP...
Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
Cisco IOS XE Software for 1000 Series Aggregation Services Routers ASR contains the following denial of service DoS vulnerabilities: Cisco IOS XE Software Malformed ICMP Packet Denial of Service Vulnerability Cisco IOS XE Software PPTP Traffic Denial of Service Vulnerability Cisco IOS XE Software...
Cisco Identity Services Engine Guest User Account Exhaustion Vulnerability
A vulnerability in Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to exhaust guest user account resources. The vulnerability is due to a guest account creation page that allows unlimited guest accounts to be created upon refreshing the page. An attacker could...
Cisco Catalyst 3750-X Series Switch Default Credentials Vulnerability
A vulnerability in the Service Module for Cisco Catalyst 3750-X Series Switches could allow an authenticated, local attacker to gain root access to the kernel running on the Cisco Service Module. The vulnerability is due to default credentials on the Cisco Service Module. An attacker could exploi...
Cisco WSA, ESA, and SMA Management GUI Denial of Service Vulnerability
A vulnerability in the GUI function in the web framework code could allow an unauthenticated, remote attacker to cause the GlassFish process to become unresponsive, resulting in a partial denial of service DoS condition. The vulnerability is due to improper handling, processing, and termination o...
Cisco ISE Support Information Download Authentication Bypass Vulnerability
A vulnerability in the implementation of the authentication code that is used to validate requests to download a product support bundle could allow an unauthenticated, remote attacker to download a full product support bundle. The vulnerability is due to an error in the logic that is used to...
Cisco Secure Access Control System Distributed Deployment Denial of Service Vulnerability
A vulnerability in the firewall modules of Cisco Secure Access Control System ACS could allow an unauthenticated, remote attacker to cause certain internal processes to crash. The vulnerability is due to improper implementation of the firewall rule to limit incoming packets. An attacker could...
Cisco IOS XR Software Route Processor Denial of Service Vulnerability
Cisco IOS XR Software Releases 3.3.0 to 4.2.0 contain a vulnerability when handling fragmented packets that could result in a denial of service DoS condition of the Cisco CRS Route Processor cards listed in the "Affected Products" section of this advisory. The vulnerability is due to improper...
Multiple Vulnerabilities in Cisco Identity Services Engine
Cisco Identity Services Engine ISE contains the following vulnerabilities: Cisco ISE Authenticated Arbitrary Command Execution Vulnerability Cisco ISE Support Information Download Authentication Bypass Vulnerability These vulnerabilities are independent of each other; a release that is affected b...
Apache Struts 2 Command Execution Vulnerability in Multiple Cisco Products
Multiple Cisco products include an implementation of the Apache Struts 2 component that is affected by a remote command execution vulnerability. The vulnerability is due to insufficient sanitization of user-supplied input. An attacker could exploit this vulnerability by sending crafted requests...
Cisco ASA VPN Denial of Service Vulnerability
A vulnerability in the VPN authentication code that handles parsing of the username from the certificate on the Cisco ASA firewall could allow an unauthenticated, remote attacker to cause a reload of the affected device. The vulnerability is due to parallel processing of a large number of Interne...
Cisco Unified Computing System Fabric Interconnect Man-In-The-Middle Vulnerability
A vulnerability in the Fabric Interconnect KVM module of Cisco Unified Computing System could allow an unauthenticated, remote attacker to execute a man-in-the-middle attack. The vulnerability is due to the virtual KVM sending video data unencrypted. An attacker could exploit this vulnerability b...
Cisco Unified Computing System Fabric Interconnect Denial of Service Vulnerability
A vulnerability in the fabric interconnect of Cisco Unified Computing System could allow an authenticated, local attacker to cause a denial of service DoS condition. The vulnerability is due to improper filtering of user-supplied parameters. An attacker could exploit this vulnerability by executi...
Cisco Unified Computing System Fabric Interconnect Man-In-The-Middle Vulnerability
A vulnerability in the Fabric Interconnect of Cisco Unified Computing System could allow an unauthenticated, remote attacker to execute a man-in-the-middle attack. The vulnerability is due to improper verification of the server SSL certificate. An attacker could exploit this vulnerability by...
Cisco Unified Computing System Fabric Interconnect Information Disclosure Vulnerability
A vulnerability in the Fabric Interconnect of Cisco Unified Computing System could allow an unauthenticated, remote attacker to capture KVM media connection credentials. The vulnerability is due to improperly securing the KVM media traffic between the server and the client. An attacker could...
Cisco Unified Computing System Fabric Interconnect Information Disclosure Vulnerability
A vulnerability in the Fabric Interconnect of Cisco Unified Computing System could allow an unauthenticated, remote attacker to capture or modify KVM virtual media traffic. The vulnerability is due to improperly securing the KVM virtual media traffic between the server and the client. An attacker...
Cisco Unity Connection Directory Traversal Vulnerability
A vulnerability in the attachment service of Cisco Unity Connection, known as Cisco Unity Web Service or as Voice Message Web Service VMWS, could allow an authenticated, remote attacker to place files in arbitrary locations on an affected device. The vulnerability is due to a failure to properly...
Cisco Unified Computing System Fabric Interconnect Arbitrary File Read Vulnerability
A vulnerability in the fabric interconnect of the Cisco Unified Computing System could allow an authenticated, local attacker to view arbitrary files on the underlying filesystem. The vulnerability is due to improper filtering of user-supplied parameters. An attacker could exploit this...
Cisco Unified Computing System Baseboard Management Controller Command Injection Vulnerability
A vulnerability in the Baseboard Management Controller BMC of the Cisco Unified Computing System could allow an authenticated, local attacker to inject arbitrary commands on the underlying operating system with elevated privileges. The vulnerability is due to improper filtering of user-supplied...
Cisco Identity Services Engine Untrusted File Upload Vulnerability
A vulnerability in the file upload dialog of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to upload potentially malicious files. The vulnerability is due to insufficient filtering and validation of uploaded files. An attacker could exploit this vulnerability by...
Cisco Identity Services Engine Sponsor Portal File Access Vulnerability
A vulnerability in the Sponsor Portal of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to access files uploaded to the Sponsor Portal. The vulnerability is due to insufficient file permissions. An attacker could exploit this vulnerability by accessing the URL...
Cisco Identity Services Engine File Space Denial of Service Vulnerability
A vulnerability in the file upload management of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to upload multiple files to a specific location of the filesystem and exhaust disk space. The vulnerability is due to insufficient management of filesystem free space...
Cisco Identity Services Engine Upload Filename Validation Vulnerability
A vulnerability in the file upload filename parsing routine of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to upload a file with a malicious filename. The vulnerability is due to insufficient validation of uploaded filenames. An attacker could exploit this...
Cisco WebEx Meetings Server Deployment Passphrase Bypass Vulnerability
A vulnerability in the deployment module of Cisco WebEx Meeting Center could allow an unauthenticated, remote attacker to bypass the passphrase check during the deployment of a virtual machine. The vulnerability is due to a flaw in the validation of the passphrase. An attacker could exploit this...
Cisco Video Surveillance 4000 Series IP Camera Default Credential Vulnerability
A vulnerability in the analytics page of the Cisco Video Surveillance 4000 Series IP Camera could allow an unauthenticated, remote attacker to gain access to the analytics pages of a Cisco Video Surveillance 4000 Series IP Camera. The vulnerability is due to an undocumented user account with a...
Cisco Unified Computing System Fabric Interconnect Arbitrary File Creation Vulnerability
A vulnerability in the fabric interconnect of the Cisco Unified Computing System could allow an authenticated, local attacker to execute commands with elevated privileges. The vulnerability is due to improper filtering of user-supplied parameters. An attacker could exploit this vulnerability by...