alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2015-0649 (published 2015-03-26)
Cisco IOS 12.2, 12.4, 15.0, 15.2, and 15.3 allows remote attackers to cause a denial of service (device reload) via malformed Common Industrial Protocol (CIP) TCP packets, aka Bug ID CSCun63514.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Weakness: CWE-20
Affected vendors: cisco
Affected products: ios
CVE-2015-0650 (published 2015-03-26)
The Service Discovery Gateway (aka mDNS Gateway) in Cisco IOS 12.2, 12.4, 15.0, 15.1, 15.2, 15.3, and 15.4 and IOS XE 3.9.xS and 3.10.xS before 3.10.4S, 3.11.xS before 3.11.3S, 3.12.xS before 3.12.2S, and 3.13.xS before 3.13.1S allows remote attackers to cause a denial of service (device reload) by sending malformed mDNS UDP packets over (1) IPv4 or (2) IPv6, aka Bug ID CSCup70579.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Weakness: CWE-20
Affected vendors: cisco
Affected products: ios, ios_xe
CVE-2015-0651 (published 2015-02-27)
Cross-site request forgery (CSRF) vulnerability in the web GUI in Cisco Application Networking Manager (ANM), and Device Manager (DM) on Cisco 4710 Application Control Engine (ACE) appliances, allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuo99753.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-352
Affected vendors: cisco
Affected products: application_networking_manager
CVE-2015-0652 (published 2015-03-13)
The Session Description Protocol (SDP) implementation in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway before X8.2 and Cisco TelePresence Conductor before XC2.4 allows remote attackers to cause a denial of service (mishandled exception and device reload) via a crafted media description, aka Bug IDs CSCus96593 and CSCun73192.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Weakness: CWE-20
Affected vendors: cisco
Affected products: expressway_software, telepresence_conductor, telepresence_video_communication_server_software
CVE-2015-0653 (published 2015-03-13)
The management interface in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway before X7.2.4, X8 before X8.1.2, and X8.2 before X8.2.2 and Cisco TelePresence Conductor before X2.3.1 and XC2.4 before XC2.4.1 allows remote attackers to bypass authentication via crafted login parameters, aka Bug IDs CSCur02680 and CSCur05556.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-287
Affected vendors: cisco
Affected products: expressway_software, telepresence_conductor, telepresence_video_communication_server_software
CVE-2015-0654 (published 2015-03-13)
Race condition in the TLS implementation in MainApp in the management interface in Cisco Intrusion Prevention System (IPS) Software before 7.3(3)E4 allows remote attackers to cause a denial of service (process hang) by establishing many HTTPS sessions, aka Bug ID CSCuq40652.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:N/A:C)
Weakness: CWE-362
Affected vendors: cisco
Affected products: intrusion_prevention_system
CVE-2015-0655 (published 2015-02-28)
Cross-site scripting (XSS) vulnerability in Unified Web Interaction Manager in Cisco Unified Web and E-Mail Interaction Manager allows remote attackers to inject arbitrary web script or HTML via vectors related to a POST request, aka Bug ID CSCus74184.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: unified_web_and_e-mail_interaction_manager
CVE-2015-0656 (published 2015-03-04)
Cross-site scripting (XSS) vulnerability in the login page in Cisco Network Analysis Module (NAM) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCum81269.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: network_analysis_module_2304, network_analysis_module_2320, network_analysis_module_firmware
CVE-2015-0657 (published 2015-03-06)
Cisco IOS XR allows remote attackers to cause a denial of service (RSVP process reload) via a malformed RSVP packet, aka Bug ID CSCur69192.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Weakness: CWE-20
Affected vendors: cisco
Affected products: ios_xr
CVE-2015-0658 (published 2015-03-28)
The DHCP implementation in the PowerOn Auto Provisioning (POAP) feature in Cisco NX-OS does not properly restrict the initialization process, which allows remote attackers to execute arbitrary commands as root by sending crafted response packets on the local network, aka Bug ID CSCur14589.
Severity: HIGH (CVSS 2.0 vector: AV:A/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-20
Affected vendors: cisco
Affected products: nexus_3016, nexus_3048, nexus_3064, nexus_3132q, nexus_3164q, nexus_3172, nexus_3524, nexus_3548, nexus_5010, nexus_5020, nexus_5548p, nexus_5548up, nexus_5596t, nexus_5596up, nexus_56128p, nexus_5624q, nexus_5648q, nexus_5672up, nexus_5696q, nexus_6001, nexus_6004, nexus_7000, nexus_7700, nexus_93120tx, nexus_93128tx
CVE-2015-0659 (published 2015-03-06)
The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS allows remote attackers to trigger self-referential adjacencies via a crafted Autonomic Networking (AN) message, aka Bug ID CSCup62157.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Affected vendors: cisco
Affected products: ios
CVE-2015-0660 (published 2015-03-14)
Cisco Virtual TelePresence Server Software does not properly restrict use of the serial port, which allows local users to execute arbitrary OS commands as root by leveraging vSphere controller administrative privileges, aka Bug ID CSCus61123.
Severity: HIGH (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-284
Affected vendors: cisco
Affected products: telepresence_server_software
CVE-2015-0661 (published 2015-03-06)
The SNMPv2 implementation in Cisco IOS XR allows remote authenticated users to cause a denial of service (snmpd daemon reload) via a malformed SNMP packet, aka Bug ID CSCur25858.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:N/I:N/A:P)
Weakness: CWE-20
Affected vendors: cisco
Affected products: ios_xr
CVE-2015-0662 (published 2015-03-17)
Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier allows local users to gain privileges via crafted IPC messages that trigger use of root privileges for a software-package installation, aka Bug ID CSCus79385.
Severity: HIGH (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-264
Affected vendors: cisco
Affected products: anyconnect_secure_mobility_client
CVE-2015-0663 (published 2015-03-17)
Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier does not properly implement access control for IPC messages, which allows local users to write to arbitrary files via crafted messages, aka Bug ID CSCus79392.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:N/I:C/A:C)
Weakness: CWE-264
Affected vendors: cisco
Affected products: anyconnect_secure_mobility_client
CVE-2015-0664 (published 2015-03-18)
The IPC channel in Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier allows local users to write to arbitrary userspace memory locations, and consequently gain privileges, via crafted messages, aka Bug ID CSCus79195.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:L/Au:S/C:P/I:P/A:P)
Weakness: CWE-20
Affected vendors: cisco
Affected products: anyconnect_secure_mobility_client
CVE-2015-0665 (published 2015-03-17)
The Hostscan module in Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier allows local users to write to arbitrary files via crafted IPC messages, aka Bug ID CSCus79173.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:N/I:C/A:C)
Weakness: CWE-22
Affected vendors: cisco
Affected products: anyconnect_secure_mobility_client
CVE-2015-0666 (published 2015-04-03)
Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) before 7.1(1) allows remote attackers to read arbitrary files via a crafted pathname, aka Bug ID CSCus00241.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: cisco
Affected products: prime_data_center_network_manager
Added to CISA KEV catalog: 2022-03-25
KEV required action: Apply updates per vendor instructions.
CVE-2015-0667 (published 2015-03-18)
The Management Interface on Cisco Content Services Switch (CSS) 11500 devices 8.20.4.02 and earlier allows remote attackers to bypass intended restrictions on local-network device access via crafted SSH packets, aka Bug ID CSCut14855.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Weakness: CWE-284
Affected vendors: cisco
Affected products: content_services_switch_11500, content_services_switch_11500_firmware
CVE-2015-0668 (published 2015-03-20)
Cross-site scripting (XSS) vulnerability in the administration portal in Cisco WebEx Meetings Server 2.5 and 2.5.99.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCuq66737.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: webex_meetings_server
CVE-2015-0669 (published 2015-03-21)
The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS 15.4S and 15.4(3)S allows remote attackers to modify configuration settings or cause a denial of service (partial service outage) by sending crafted Autonomic Networking (AN) messages on an intranet network, aka Bug ID CSCup62167.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:P/A:P)
Weakness: CWE-20
Affected vendors: cisco
Affected products: ios
CVE-2015-0670 (published 2015-03-21)
The default configuration of Cisco Small Business IP phones SPA 300 7.5.5 and SPA 500 7.5.5 does not properly support authentication, which allows remote attackers to read audio-stream data or originate telephone calls via a crafted XML request, aka Bug ID CSCuo52482.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:N)
Weakness: CWE-287
Affected vendors: cisco
Affected products: spa300_firmware, spa500_firmware, spa_301_1_line_ip_phone, spa_302d, spa_302dkit, spa_303_3_line_ip_phone, spa_501g_8-line_ip_phone, spa_502g_1-line_ip_phone, spa_504g_4-line_ip_phone, spa_508g_8-line_ip_phone, spa_509g_12-line_ip_phone, spa_512g_1-line_ip_phone, spa_514g_4-line_ip_phone, spa_525g2_5-line_ip_phone, spa_525g_5-line_ip_phone
CVE-2015-0671 (published 2015-03-20)
The DNS implementation in Cisco Videoscape Distribution Suite for Internet Streaming (VDS-IS) 3.2(1) allows remote attackers to cause a denial of service (CPU consumption and network-resource consumption) via crafted packets, aka Bug ID CSCun15911.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Weakness: CWE-399
Affected vendors: cisco
Affected products: videoscape_delivery_system_for_internet_streamer
CVE-2015-0672 (published 2015-03-26)
The DHCPv4 server in Cisco IOS XR 5.2.2 on ASR 9000 devices allows remote attackers to cause a denial of service (service outage) via a flood of crafted DHCP packets, aka Bug ID CSCup67822.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Weakness: CWE-399
Affected vendors: cisco
Affected products: asr_9001, asr_9006, asr_9010, asr_9904, asr_9912, asr_9922, ios_xr
CVE-2015-0673 (published 2015-03-26)
Cisco Mobility Services Engine (MSE) 8.0(110.0) allows remote authenticated users to discover the passwords of arbitrary users by (1) reading log files or (2) using an unspecified GUI feature, aka Bug ID CSCut24792.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: cisco
Affected products: mobility_services_engine
CVE-2015-0674 (published 2017-07-25)
Cross-site scripting (XSS) vulnerability in the Alert Service of Cisco Cloud Web Security base revision allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: cloud_web_security
CVE-2015-0675 (published 2015-04-13)
The failover ipsec implementation in Cisco Adaptive Security Appliance (ASA) Software 9.1 before 9.1(6), 9.2 before 9.2(3.3), and 9.3 before 9.3(3) does not properly validate failover communication messages, which allows remote attackers to reconfigure an ASA device, and consequently obtain administrative control, by sending crafted UDP packets over the local network to the failover interface, aka Bug ID CSCur21069.
Severity: HIGH (CVSS 2.0 vector: AV:A/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-284
Affected vendors: cisco
Affected products: adaptive_security_appliance_software
CVE-2015-0676 (published 2015-04-13)
The DNS implementation in Cisco Adaptive Security Appliance (ASA) Software 7.2 before 7.2(5.16), 8.2 before 8.2(5.57), 8.3 before 8.3(2.44), 8.4 before 8.4(7.28), 8.5 before 8.5(1.24), 8.6 before 8.6(1.17), 8.7 before 8.7(1.16), 9.0 before 9.0(4.33), 9.1 before 9.1(6.1), 9.2 before 9.2(3.4), and 9.3 before 9.3(3) allows man-in-the-middle attackers to cause a denial of service (memory consumption or device outage) by triggering outbound DNS queries and then sending crafted responses to these queries, aka Bug ID CSCuq77655.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:N/A:C)
Weakness: CWE-20
Affected vendors: cisco
Affected products: adaptive_security_appliance_software
CVE-2015-0677 (published 2015-04-13)
The XML parser in Cisco Adaptive Security Appliance (ASA) Software 8.4 before 8.4(7.28), 8.6 before 8.6(1.17), 9.0 before 9.0(4.33), 9.1 before 9.1(6), 9.2 before 9.2(3.4), and 9.3 before 9.3(3), when Clientless SSL VPN, AnyConnect SSL VPN, or AnyConnect IKEv2 VPN is used, allows remote attackers to cause a denial of service (VPN outage or device reload) via a crafted XML document, aka Bug ID CSCus95290.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Weakness: CWE-20
Affected vendors: cisco
Affected products: adaptive_security_appliance_software
CVE-2015-0678 (published 2015-04-11)
The virtualization layer in Cisco ASA FirePOWER Software before 5.3.1.2 and 5.4.x before 5.4.0.1 and ASA Context-Aware (CX) Software before 9.3.2.1-9 allows remote attackers to cause a denial of service (device reload) by rapidly sending crafted packets to the management interface, aka Bug IDs CSCus11007 and CSCun56954.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Weakness: CWE-20
Affected vendors: cisco
Affected products: asa_cx_context-aware_security_software, asa_with_firepower_services
CVE-2015-0679 (published 2015-03-28)
The web-authentication functionality on Cisco Wireless LAN Controller (WLC) devices 7.3(103.8) and 7.4(110.0) allows remote attackers to cause a denial of service (device reload) via a malformed password, aka Bug ID CSCui57980.
Severity: MEDIUM (CVSS 2.0 vector: AV:A/AC:L/Au:N/C:N/I:N/A:C)
Weakness: CWE-20
Affected vendors: cisco
Affected products: wireless_lan_controller_software
CVE-2015-0680 (published 2015-03-28)
Cisco Unified Call Manager (CM) 9.1(2.1000.28) does not properly restrict resource requests, which allows remote authenticated users to read arbitrary files via unspecified vectors, aka Bug ID CSCuq44439.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: cisco
Affected products: unified_callmanager
CVE-2015-0681 (published 2015-07-24)
The TFTP server in Cisco IOS 12.2(44)SQ1, 12.2(33)XN1, 12.4(25e)JAM1, 12.4(25e)JAO5m, 12.4(23)JY, 15.0(2)ED1, 15.0(2)EY3, 15.1(3)SVF4a, and 15.2(2)JB1 and IOS XE 2.5.x, 2.6.x, 3.1.xS, 3.2.xS, 3.3.xS, 3.4.xS, and 3.5.xS before 3.6.0S; 3.1.xSG, 3.2.xSG, and 3.3.xSG before 3.4.0SG; 3.2.xSE before 3.3.0SE; 3.2.xXO before 3.3.0XO; 3.2.xSQ; 3.3.xSQ; and 3.4.xSQ allows remote attackers to cause a denial of service (device hang or reload) via multiple requests that trigger improper memory management, aka Bug ID CSCts66733.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:N/A:C)
Weakness: CWE-399
Affected vendors: cisco
Affected products: ios, ios_xe
CVE-2015-0682 (published 2015-04-03)
Cisco Unified Communications Domain Manager 8.1(4) allows remote authenticated users to execute arbitrary code by visiting a "deprecated page," aka Bug ID CSCup90168.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
Weakness: CWE-264
Affected vendors: cisco
Affected products: unified_communications_domain_manager
CVE-2015-0683 (published 2015-04-03)
Cisco Unified Communications Domain Manager 8.1(4) allows remote authenticated users to obtain sensitive information via a file-inclusion attack, aka Bug ID CSCup94744.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: cisco
Affected products: unified_communications_domain_manager
CVE-2015-0684 (published 2015-04-03)
SQL injection vulnerability in the Image Management component in Cisco Unified Communications Domain Manager 8.1(4) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuq52515.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
Weakness: CWE-89
Affected vendors: cisco
Affected products: unified_communications_domain_manager
CVE-2015-0685 (published 2015-04-03)
Cisco IOS XE before 3.7.5S on ASR 1000 devices does not properly handle route adjacencies, which allows remote attackers to cause a denial of service (device hang) via crafted IP packets, aka Bug ID CSCub31873.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Weakness: CWE-20
Affected vendors: cisco
Affected products: ios_xe
CVE-2015-0686 (published 2015-04-03)
The SNMP implementation in Cisco NX-OS 6.1(2)I2(3) on Nexus 9000 devices, when a Reset High Availability (HA) policy is configured, allows remote authenticated users to cause a denial of service (device reload) via unspecified vectors, aka Bug ID CSCuq92240.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:N/A:C)
Weakness: CWE-399
Affected vendors: cisco
Affected products: nexus_9000, nexus_93120tx, nexus_93128tx, nexus_9332pq, nexus_9336pq_aci_spine, nexus_9372px, nexus_9372tx, nx-os
CVE-2015-0687 (published 2015-04-03)
The SNMP implementation in Cisco IOS 15.1(2)SG4 on Catalyst 4500 devices, when single-switch Virtual Switching System (VSS) is configured, allows remote authenticated users to cause a denial of service (device crash) by performing SNMP polling, aka Bug ID CSCuq04574.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:N/A:C)
Weakness: CWE-399
Affected vendors: cisco
Affected products: catalyst_4503, catalyst_4503-e, catalyst_4506-e, catalyst_4507r-e, catalyst_4507r\+e, catalyst_4510r-e, catalyst_4510r\+e, ios
CVE-2015-0688 (published 2015-04-04)
Cisco IOS XE 3.10.2S on an ASR 1000 device with an Embedded Services Processor (ESP) module, when NAT is enabled, allows remote attackers to cause a denial of service (module crash) via malformed H.323 packets, aka Bug ID CSCup21070.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:N/A:C)
Weakness: CWE-399
Affected vendors: cisco
Affected products: asr_1001, asr_1001-x, asr_1002, asr_1002-x, asr_1004, asr_1006, asr_1013, ios_xe
CVE-2015-0689 (published 2017-09-19)
Cisco Cloud Web Security before 3.0.1.7 allows remote attackers to bypass intended filtering protection mechanisms by leveraging improper handling of HTTP methods, aka Bug ID CSCut69743.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-19
Affected vendors: cisco
Affected products: cloud_web_security
CVE-2015-0690 (published 2015-04-07)
Cross-site scripting (XSS) vulnerability in the HTML help system on Cisco Wireless LAN Controller (WLC) devices before 8.0 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCun95178.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: wireless_lan_controller_software
CVE-2015-0691 (published 2015-04-17)
A certain Cisco JAR file, as distributed in Cache Cleaner in Cisco Secure Desktop (CSD), allows remote attackers to execute arbitrary commands via a crafted web site, aka Bug ID CSCup83001.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-78
Affected vendors: cisco
Affected products: secure_desktop
CVE-2015-0692 (published 2015-04-11)
Cisco Web Security Appliance (WSA) devices with software 8.5.0-ise-147 do not properly restrict use of the pickle Python module during certain tunnel-status checks, which allows local users to execute arbitrary Python code and gain privileges via crafted serialized objects, aka Bug ID CSCut39230.
Severity: HIGH (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-264
Affected vendors: cisco
Affected products: web_security_appliance
CVE-2015-0693 (published 2015-04-15)
Cisco Web Security Appliance (WSA) devices with software 8.5.0-ise-147 do not properly restrict use of the pickle Python module during certain tunnel-status checks, which allows local users to execute arbitrary Python code and gain privileges via a crafted pickle file, aka Bug ID CSCut39259.
Severity: HIGH (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-20
Affected vendors: cisco
Affected products: web_security_appliance
CVE-2015-0694 (published 2015-04-11)
Cisco ASR 9000 devices with software 5.3.0.BASE do not recognize that certain ACL entries have a single-host constraint, which allows remote attackers to bypass intended network-resource access restrictions by using an address that was not supposed to have been allowed, aka Bug ID CSCur28806.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Weakness: CWE-284
Affected vendors: cisco
Affected products: asr_9001, asr_9006, asr_9010, asr_9904, asr_9912, asr_9922, ios_xr
CVE-2015-0695 (published 2015-04-17)
Cisco IOS XR 4.3.4 through 5.3.0 on ASR 9000 devices, when uRPF, PBR, QoS, or an ACL is configured, does not properly handle bridge-group virtual interface (BVI) traffic, which allows remote attackers to cause a denial of service (chip and card hangs and reloads) by triggering use of a BVI interface for IPv4 packets, aka Bug ID CSCur62957.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Weakness: CWE-19
Affected vendors: cisco
Affected products: asr_9001, asr_9006, asr_9010, asr_9904, asr_9912, asr_9922, ios_xr
CVE-2015-0696 (published 2015-04-15)
Cross-site scripting (XSS) vulnerability in the login page in Cisco TC Software before 7.1.0 on Cisco TelePresence Collaboration Desk and Room Endpoints devices allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCuq94977.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: telepresence_tc_software
CVE-2015-0697 (published 2015-04-15)
Open redirect vulnerability in the login page in Cisco TC Software before 6.3-26 and 7.x before 7.3.0 on Cisco TelePresence Collaboration Desk and Room Endpoints devices allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka Bug ID CSCuq94980.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:N)
Weakness: CWE-601
Affected vendors: cisco
Affected products: telepresence_tc_software
CVE-2015-0698 (published 2015-04-15)
Multiple cross-site scripting (XSS) vulnerabilities in filter search forms in admin web pages on Cisco Web Security Appliance (WSA) devices with software 8.5.0-497 allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCut39213.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: web_security_appliance
CVE-2015-0699 (published 2015-04-15)
SQL injection vulnerability in the Interactive Voice Response (IVR) component in Cisco Unified Communications Manager (UCM) 10.5(1.98991.13) allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCut21563.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-89
Affected vendors: cisco
Affected products: unified_communications_domain_manager
CVE-2015-0700 (published 2015-04-17)
Cross-site request forgery (CSRF) vulnerability in the Dashboard page in the monitoring-and-report section in Cisco Secure Access Control Server Solution Engine before 5.5(0.46.5) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj62924.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-352
Affected vendors: cisco
Affected products: secure_access_control_server_solution_engine
CVE-2015-0701 (published 2015-05-07)
Cisco UCS Central Software before 1.3(1a) allows remote attackers to execute arbitrary commands via a crafted HTTP request, aka Bug ID CSCut46961.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-20
Affected vendors: cisco
Affected products: unified_computing_system_central_software
CVE-2015-0702 (published 2015-04-21)
Unrestricted file upload vulnerability in the Custom Prompts upload implementation in Cisco Unified MeetingPlace 8.6(1.9) allows remote authenticated users to execute arbitrary code by using the languageShortName parameter to upload a file that provides shell access, aka Bug ID CSCus95712.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:C/I:C/A:C)
Weakness: CWE-20
Affected vendors: cisco
Affected products: unified_meetingplace
CVE-2015-0703 (published 2015-04-21)
Cross-site scripting (XSS) vulnerability in the administrative web interface in Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCus95857.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: unified_meetingplace
CVE-2015-0704 (published 2015-04-22)
Multiple cross-site request forgery (CSRF) vulnerabilities in API features in Cisco Unified MeetingPlace 8.6(1.9) allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus95884.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-352
Affected vendors: cisco
Affected products: unified_meetingplace
CVE-2015-0705 (published 2015-04-22)
Cross-site request forgery (CSRF) vulnerability in the SOAP API endpoints of the web-services directory in Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts, aka Bug ID CSCus97494.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-352
Affected vendors: cisco
Affected products: unified_meetingplace
CVE-2015-0706 (published 2015-04-23)
Open redirect vulnerability in Cisco FireSIGHT System Software 5.3.1.1, 5.3.1.2, and 6.0.0 in FireSIGHT Management Center allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted HTTP header, aka Bug IDs CSCut06060, CSCut06056, and CSCus98966.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:N)
Affected vendors: cisco
Affected products: firesight_system_software
CVE-2015-0707 (published 2015-04-23)
Cross-site scripting (XSS) vulnerability in Cisco FireSIGHT System Software 5.3.1.1 and 6.0.0 in FireSIGHT Management Center allows remote authenticated users to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCus85425.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: firesight_system_software
CVE-2015-0708 (published 2015-04-29)
Cisco IOS 15.4S, 15.4SN, and 15.5S and IOS XE 3.13S and 3.14S allow remote attackers to cause a denial of service (device crash) by including an IA_NA option in a DHCPv6 Solicit message on the local network, aka Bug ID CSCur29956.
Severity: MEDIUM (CVSS 2.0 vector: AV:A/AC:L/Au:N/C:N/I:N/A:C)
Weakness: CWE-399
Affected vendors: cisco
Affected products: ios, ios_xe
CVE-2015-0709 (published 2015-04-29)
Cisco IOS 15.5S and IOS XE allow remote authenticated users to cause a denial of service (device crash) by leveraging knowledge of the RADIUS secret and sending crafted RADIUS packets, aka Bug ID CSCur21348.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:N/I:N/A:C)
Weakness: CWE-399
Affected vendors: cisco
Affected products: ios, ios_xe
CVE-2015-0710 (published 2015-04-29)
The Overlay Transport Virtualization (OTV) implementation in Cisco IOS XE 3.10S allows remote attackers to cause a denial of service (device reload) via a series of packets that are considered oversized and trigger improper fragmentation handling, aka Bug IDs CSCup37676 and CSCup30335.
Severity: MEDIUM (CVSS 2.0 vector: AV:A/AC:L/Au:N/C:N/I:N/A:C)
Weakness: CWE-399
Affected vendors: cisco
Affected products: ios_xe
CVE-2015-0711 (published 2015-04-29)
The hamgr service in the IPv6 Proxy Mobile (PM) implementation in Cisco StarOS 18.1.0.59776 on ASR 5000 devices allows remote attackers to cause a denial of service (service reload and call-processing outage) via malformed PM packets, aka Bug ID CSCut94711.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Weakness: CWE-399
Affected vendors: cisco
Affected products: asr_5000, asr_5500, asr_5700, staros
CVE-2015-0712 (published 2015-05-01)
The session-manager service in Cisco StarOS 12.0, 12.2(300), 14.0, and 14.0(600) on ASR 5000 devices allows remote attackers to cause a denial of service (service reload and packet loss) via malformed HTTP packets, aka Bug ID CSCud14217.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Weakness: CWE-399
Affected vendors: cisco
Affected products: asr_5000, asr_5500, asr_5700, staros
CVE-2015-0713 (published 2015-05-25)
The web framework in Cisco TelePresence Advanced Media Gateway Series Software before 1.1(1.40), Cisco TelePresence IP Gateway Series Software, Cisco TelePresence IP VCR Series Software before 3.0(1.27), Cisco TelePresence ISDN Gateway Software before 2.2(1.94), Cisco TelePresence MCU Software before 4.4(3.54) and 4.5 before 4.5(1.45), Cisco TelePresence MSE Supervisor Software before 2.3(1.38), Cisco TelePresence Serial Gateway Series Software before 1.0(1.42), Cisco TelePresence Server Software for Hardware before 3.1(1.98), and Cisco TelePresence Server Software for Virtual Machine before 4.1(1.79) allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors, aka Bug IDs CSCul55968, CSCur08993, CSCur15803, CSCur15807, CSCur15825, CSCur15832, CSCur15842, CSCur15850, and CSCur15855.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:C/I:C/A:C)
Weakness: CWE-264
Affected vendors: cisco
Affected products: telepresence_advanced_media_gateway, telepresence_ip_gateway, telepresence_ip_vcr_1.0_converter, telepresence_ip_vcr_2.4, telepresence_ip_vcr_3.0, telepresence_isdn_gw_3241, telepresence_mcu_software, telepresence_serial_gateway, telepresence_server_software, telepresence_supervisor_mse_8050_software
CVE-2015-0714 (published 2015-05-02)
Multiple cross-site scripting (XSS) vulnerabilities in Cisco Finesse Server 10.0(1), 10.5(1), 10.6(1), and 11.0(1) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCut53595.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: finesse
CVE-2015-0715 (published 2015-05-07)
SQL injection vulnerability in the administrative web interface in Cisco Unified Communications Manager 11.0(0.98000.225) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug IDs CSCut33447 and CSCut33608.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
Weakness: CWE-89
Affected vendors: cisco
Affected products: unity_connection
CVE-2015-0716 (published 2015-05-07)
Cross-site request forgery (CSRF) vulnerability in the CUCReports page in Cisco Unity Connection 11.0(0.98000.225) and 11.0(0.98000.332) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut33659.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-352
Affected vendors: cisco
Affected products: unity_connection
CVE-2015-0717 (published 2015-05-16)
Cisco Unified Communications Manager 10.0(1.10000.12) allows local users to gain privileges via a command string in an unspecified parameter, aka Bug ID CSCut19546.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-20
Affected vendors: cisco
Affected products: unified_communications_manager
CVE-2015-0718 (published 2016-03-03)
Cisco NX-OS 4.0 through 6.1 on Nexus 1000V 3000, 4000, 5000, 6000, and 7000 devices and Unified Computing System (UCS) platforms allows remote attackers to cause a denial of service (TCP stack reload) by sending crafted TCP packets to a device that has a TIME_WAIT TCP session, aka Bug ID CSCub70579.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-399
Affected vendors: cisco, netgear, samsung, sun, zyxel, zzinc
Affected products: gs1900-10hp_firmware, jr6150_firmware, keymouse_firmware, nx-os, opensolaris, unified_computing_system, x14j_firmware
CVE-2015-0721 (published 2016-10-06)
Cisco NX-OS 4.0 through 7.3 on Multilayer Director and Nexus 1000V, 2000, 3000, 3500, 4000, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 devices allows remote authenticated users to bypass intended AAA restrictions and obtain privileged CLI access via crafted parameters in an SSH connection negotiation, aka Bug IDs CSCum35502, CSCuw78669, CSCuw79754, and CSCux88492.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-264
Affected vendors: cisco
Affected products: nexus_1000v_for_microsoft_hyper-v, nexus_1000v_for_vmware_vsphere, nexus_3016, nexus_3048, nexus_31108pc-v, nexus_31108tc-v, nexus_31128pq, nexus_3132q, nexus_3132q-v, nexus_3164q, nexus_3172, nexus_3232c, nexus_3264q, nexus_3524, nexus_3548, nexus_4001i, nexus_5010, nexus_5020, nexus_5548p, nexus_5548up, nexus_5596t, nexus_5596up, nexus_56128p, nexus_5624q, nexus_5648q
CVE-2015-0722 (published 2015-05-25)
The network drivers in Cisco TelePresence T, Cisco TelePresence TE, and Cisco TelePresence TC before 7.3.2 allow remote attackers to cause a denial of service (process restart or device reload) via a flood of crafted IP packets, aka Bug ID CSCuj68952.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Weakness: CWE-399
Affected vendors: cisco
Affected products: telepresence_tc_software, telepresence_te_software
CVE-2015-0723 (published 2015-05-16)
The wireless web-authentication subsystem on Cisco Wireless LAN Controller (WLC) devices 7.5.x and 7.6.x before 7.6.120 allows remote attackers to cause a denial of service (process crash and device restart) via a crafted value, aka Bug ID CSCum03269.
Severity: MEDIUM (CVSS 2.0 vector: AV:A/AC:L/Au:N/C:N/I:N/A:C)
Weakness: CWE-399
Affected vendors: cisco
Affected products: wireless_lan_controller_software
CVE-2015-0724 (published 2015-05-15)
Multiple cross-site scripting (XSS) vulnerabilities in dncs 7.0.0.12 in Cisco Headend Digital Broadband Delivery System allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET or (2) POST request, aka Bug ID CSCur25604.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: headend_digital_broadband_delivery_system
CVE-2015-0725 (published 2015-07-16)
Cisco Videoscape Distribution Suite Service Broker (aka VDS-SB), when a VDSM configuration on UCS is used, and Videoscape Distribution Suite for Internet Streaming (aka VDS-IS or CDS-IS) before 3.3.1 R7 and 4.x before 4.0.0 R4 allow remote attackers to cause a denial of service (device reload) via a crafted HTTP request, aka Bug IDs CSCus79834 and CSCuu63409.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Weakness: CWE-20
Affected vendors: cisco
Affected products: videoscape_distribution_suite_for_internet_streaming, videoscape_distribution_suite_service_broker
CVE-2015-0726 (published 2015-05-16)
The web administration interface on Cisco Wireless LAN Controller (WLC) devices before 7.0.241, 7.1.x through 7.4.x before 7.4.122, and 7.5.x and 7.6.x before 7.6.120 allows remote authenticated users to cause a denial of service (device crash) via unspecified parameters, aka Bug IDs CSCum65159 and CSCum65252.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:N/I:N/A:C)
Weakness: CWE-20
Affected vendors: cisco
Affected products: wireless_lan_controller_software
CVE-2015-0727 (published 2015-05-15)
Cross-site scripting (XSS) vulnerability in the HTTP module in Cisco Security Manager (CSM) 4.7(0)SP1(1) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCut27789.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: security_manager
CVE-2015-0728 (published 2015-05-15)
Cross-site scripting (XSS) vulnerability in Cisco Access Control Server (ACS) 5.5(0.1) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuu11002.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: secure_access_control_system
CVE-2015-0729 (published 2015-05-16)
Cross-site scripting (XSS) vulnerability in Cisco Secure Access Control Server Solution Engine (ACSE) 5.5(0.1) allows remote attackers to inject arbitrary web script or HTML via a file-inclusion attack, aka Bug ID CSCuu11005.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: secure_access_control_server
CVE-2015-0730 (published 2015-05-16)
The SMB module in Cisco Wide Area Application Services (WAAS) 6.0(1) allows remote attackers to cause a denial of service (module reload) via an invalid field in a Negotiate Protocol request, aka Bug ID CSCuo75645.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Weakness: CWE-20
Affected vendors: cisco
Affected products: wide_area_application_services
CVE-2015-0731 (published 2015-05-16)
The ISDN implementation in Cisco IOS 15.3S allows remote attackers to cause a denial of service (device reload) via malformed Q931 SETUP messages, aka Bug ID CSCut37890.
Severity: MEDIUM (CVSS 2.0 vector: AV:A/AC:L/Au:N/C:N/I:N/A:C)
Weakness: CWE-399
Affected vendors: cisco
Affected products: ios
CVE-2015-0732 (published 2015-07-29)
Cross-site scripting (XSS) vulnerability in Cisco AsyncOS on the Web Security Appliance (WSA) 9.0.0-193; Email Security Appliance (ESA) 8.5.6-113, 9.1.0-032, 9.1.1-000, and 9.6.0-000; and Content Security Management Appliance (SMA) 9.1.0-033 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug IDs CSCuu37430, CSCuu37420, CSCut71981, and CSCuv50167.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: content_security_management_virtual_appliance, email_security_appliance_firmware, web_security_appliance
CVE-2015-0733 (published 2015-05-30)
CRLF injection vulnerability in the HTTP Header Handler in Digital Broadband Delivery System in Cisco Headend System Release allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks, via a crafted request, aka Bug ID CSCur25580.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-113
Affected vendors: cisco
Affected products: headend_digital_broadband_delivery_system
CVE-2015-0734 (published 2015-05-15)
Multiple cross-site scripting (XSS) vulnerabilities on the Cisco Email Security Appliance (ESA) 8.5.6-106 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET or (2) POST request, aka Bug ID CSCut87743.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: email_security_appliance_firmware
CVE-2015-0735 (published 2015-05-17)
Cross-site request forgery (CSRF) vulnerability in Cisco Unified Customer Voice Portal (CVP) 10.5(1) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut93970.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-352
Affected vendors: cisco
Affected products: unified_customer_voice_portal
CVE-2015-0736 (published 2015-05-16)
Cross-site request forgery (CSRF) vulnerability in Cisco MediaSense 10.5(1) and earlier allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu16728.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-352
Affected vendors: cisco
Affected products: mediasense
CVE-2015-0737 (published 2015-06-12)
Multiple cross-site scripting (XSS) vulnerabilities in Cisco FireSIGHT System Software 5.3.1.1 allow remote attackers to inject arbitrary web script or HTML via a crafted (1) GET or (2) POST parameter, aka Bug ID CSCuu11099.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: firesight_system_software
CVE-2015-0738 (published 2015-05-17)
Cross-site scripting (XSS) vulnerability in the Web Tracking Report page on Cisco Web Security Appliance (WSA) devices 8.5.0-497 allows remote attackers to inject arbitrary web script or HTML via an unspecified field, aka Bug ID CSCuu16008.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: web_security_appliance
CVE-2015-0739 (published 2015-05-19)
The Lights-Out Management (LOM) implementation in Cisco FireSIGHT System Software 5.3.0 on Sourcefire 3D Sensor devices allows remote authenticated users to perform arbitrary Baseboard Management Controller (BMC) file uploads via unspecified vectors, aka Bug ID CSCus87938.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)
Weakness: CWE-20
Affected vendors: cisco
Affected products: firesight_system_software, sourcefire_3d1000_sensor, sourcefire_3d2000_sensor, sourcefire_3d2100_sensor, sourcefire_3d2500_sensor, sourcefire_3d3500_sensor, sourcefire_3d4500_sensor, sourcefire_3d500_sensor, sourcefire_3d6500_sensor, sourcefire_3d9900_sensor
CVE-2015-0740 (published 2015-05-20)
Cross-site request forgery (CSRF) vulnerability in Cisco Unified Intelligence Center 10.6(1) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus28826.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-352
Affected vendors: cisco
Affected products: unified_intelligence_center
CVE-2015-0741 (published 2015-05-21)
Multiple cross-site request forgery (CSRF) vulnerabilities in Cisco Prime Central for Hosted Collaboration Solution (PC4HCS) 10.6(1) and earlier allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut04596.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-352
Affected vendors: cisco
Affected products: hosted_collaboration_solution
CVE-2015-0742 (published 2015-05-21)
The Protocol Independent Multicast (PIM) application in Cisco Adaptive Security Appliance (ASA) Software 9.2(0.0), 9.2(0.104), 9.2(3.1), 9.2(3.4), 9.3(1.105), 9.3(2.100), 9.4(0.115), 100.13(0.21), 100.13(20.3), 100.13(21.9), and 100.14(1.1) does not properly implement multicast-forwarding registration, which allows remote attackers to cause a denial of service (forwarding outage) via a crafted multicast packet, aka Bug ID CSCus74398.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Weakness: CWE-399
Affected vendors: cisco
Affected products: adaptive_security_appliance_software
CVE-2015-0743 (published 2015-05-30)
Cisco Headend System Release allows remote attackers to cause a denial of service (DHCP and TFTP outage) via a flood of crafted UDP traffic, aka Bug ID CSCus04097.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Weakness: CWE-399
Affected vendors: cisco
Affected products: headend_digital_broadband_delivery_system, headend_system_release
CVE-2015-0744 (published 2015-05-30)
Cisco DTA Control System (DTACS) 4.0.0.9 and Cisco Headend System Release allow remote attackers to cause a denial of service (CPU and memory consumption, and TCP service outage) via (1) a SYN flood or (2) another type of TCP traffic flood, aka Bug IDs CSCus50642, CSCus50662, CSCus50625, CSCus50657, and CSCus68315.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Weakness: CWE-399
Affected vendors: cisco
Affected products: dta_control_system, headend_digital_broadband_delivery_system, headend_system_release
CVE-2015-0745 (published 2015-05-30)
Cisco Headend System Release allows remote attackers to read temporary script files or archive files, and consequently obtain sensitive information, via a crafted header in an HTTP request, aka Bug ID CSCus44909.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: cisco
Affected products: headend_digital_broadband_delivery_system, headend_system_release
CVE-2015-0746 (published 2015-05-22)
The REST API in Cisco Access Control Server (ACS) 5.5(0.46.2) allows remote attackers to cause a denial of service (API outage) by sending many requests, aka Bug ID CSCut62022.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Weakness: CWE-254
Affected vendors: cisco
Affected products: secure_access_control_server
CVE-2015-0747 (published 2015-05-30)
Cisco Conductor for Videoscape 3.0 and Cisco Headend System Release allow remote attackers to inject arbitrary cookies via a crafted HTTP request, aka Bug ID CSCuh25408.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-20
Affected vendors: cisco
Affected products: headend_digital_broadband_delivery_system, headend_system_release, videoscape_conductor
CVE-2015-0749 (published 2020-02-19)
A vulnerability in Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on the affected software. The vulnerabilities is due to improper input validation of certain parameters passed to the affected software. An attacker could exploit this vulnerability by convincing a user to follow a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected site or allow the attacker to access sensitive browser-based information.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: unified_communications_manager
CVE-2015-0750 (published 2015-05-23)
The administrative web interface in Cisco Hosted Collaboration Solution (HCS) 10.6(1) and earlier allows remote authenticated users to execute arbitrary commands via crafted input to unspecified fields, aka Bug ID CSCut02786.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
Weakness: CWE-264
Affected vendors: cisco
Affected products: hosted_collaboration_solution
CVE-2015-0751 (published 2015-05-29)
Cisco IP Phone 7861, when firmware from Cisco Unified Communications Manager 10.3(1) is used, allows remote attackers to cause a denial of service via crafted packets, aka Bug ID CSCus81800.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Weakness: CWE-20
Affected vendors: cisco
Affected products: ip_phone_7861, unified_communications_manager
CVE-2015-0752 (published 2015-05-29)
Cross-site scripting (XSS) vulnerability in Cisco TelePresence Video Communication Server (VCS) X8.5.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCut27635.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: telepresence_video_communication_server
CVE-2015-0753 (published 2015-05-29)
SQL injection vulnerability in Cisco Unified Email Interaction Manager (EIM) and Unified Web Interaction Manager (WIM) 9.0(2) allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuu30028.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-20
Affected vendors: cisco
Affected products: unified_web_and_e-mail_interaction_manager