CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Cisco : Security Vulnerabilities (CVSS score between 5 and 5.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2015-0591 399 DoS 2015-01-15 2015-01-27
5.0
None Remote Low Not required None None Partial
Cisco Unified Communications Domain Manager (UCDM) 10 allows remote attackers to cause a denial of service (daemon hang and GUI outage) via a flood of malformed TCP packets, aka Bug ID CSCur44177.
2 CVE-2015-0590 200 +Info 2015-01-17 2015-01-27
5.0
None Remote Low Not required Partial None None
Cisco WebEx Meeting Center allows remote attackers to activate disabled meeting attributes, and consequently obtain sensitive information, by providing crafted parameters during a meeting-join action, aka Bug ID CSCuo34165.
3 CVE-2015-0583 200 +Info 2015-01-14 2015-01-22
5.0
None Remote Low Not required Partial None None
Cisco WebEx Meeting Center does not properly restrict the content of URLs, which allows remote attackers to obtain sensitive information via vectors related to file: URIs, aka Bug ID CSCus18281.
4 CVE-2015-0582 20 DoS 2015-01-09 2015-01-22
5.0
None Remote Low Not required None None Partial
The High Availability (HA) subsystem in Cisco NX-OS on MDS 9000 devices allows remote attackers to cause a denial of service via crafted traffic, aka Bug ID CSCuo09129.
5 CVE-2015-0579 399 DoS 2015-01-14 2015-01-22
5.0
None Remote Low Not required None None Partial
Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway allow remote attackers to cause a denial of service (memory and CPU consumption, and partial outage) via crafted SIP packets, aka Bug ID CSCur12473.
6 CVE-2015-0578 20 DoS 2015-01-14 2015-01-22
5.7
None Local Network Medium Not required None None Complete
Cisco Adaptive Security Appliance (ASA) Software, when a DHCPv6 relay is configured, allows remote attackers to cause a denial of service (device reload) via crafted DHCP packets on the local network, aka Bug ID CSCur45455.
7 CVE-2014-8036 20 2015-01-09 2015-01-22
5.0
None Remote Low Not required None Partial None
The outlookpa component in Cisco WebEx Meetings Server does not properly validate API input, which allows remote attackers to modify a meeting's invite list via a crafted URL, aka Bug ID CSCuj40254.
8 CVE-2014-8035 200 +Info 2015-01-09 2015-01-12
5.0
None Remote Low Not required Partial None None
The web framework in Cisco WebEx Meetings Server produces different returned messages for URL requests depending on whether a username exists, which allows remote attackers to enumerate user accounts via a series of requests, aka Bug ID CSCuj40247.
9 CVE-2014-8034 255 2015-01-15 2015-01-22
5.0
None Remote Low Not required Partial None None
Cisco WebEx Meetings Server 1.5 presents the same CAPTCHA challenge for each login attempt, which makes it easier for remote attackers to obtain access via a brute-force approach of guessing usernames, aka Bug ID CSCuj40321.
10 CVE-2014-8033 287 2015-01-08 2015-01-09
5.0
None Remote Low Not required None Partial None
The play/modules component in Cisco WebEx Meetings Server allows remote attackers to obtain administrator access via crafted API requests, aka Bug ID CSCuj40421.
11 CVE-2014-8029 2015-01-08 2015-01-09
5.8
None Remote Medium Not required Partial Partial None
Open redirect vulnerability in the web interface in Cisco Secure Access Control System (ACS) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter, aka Bug ID CSCuq74150.
12 CVE-2014-8020 399 DoS 2015-01-09 2015-01-12
5.0
None Remote Low Not required None None Partial
Cisco Unified Communication Domain Manager Platform Software allows remote attackers to cause a denial of service (CPU consumption, and performance degradation or service outage) via a flood of malformed TCP packets and UDP packets, aka Bug ID CSCup25276.
13 CVE-2014-8019 22 Dir. Trav. 2014-12-19 2014-12-22
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in Cisco Enterprise Content Delivery System (ECDS) allows remote attackers to read arbitrary files via a crafted URL, aka Bug ID CSCuo90148.
14 CVE-2014-8017 200 +Info 2014-12-22 2014-12-23
5.0
None Remote Low Not required Partial None None
The periodic-backup feature in Cisco Identity Services Engine (ISE) allows remote attackers to discover backup-encryption passwords via a crafted request that triggers inclusion of a password in a reply, aka Bug ID CSCur41673.
15 CVE-2014-8016 399 DoS 2014-12-18 2014-12-19
5.0
None Remote Low Not required None None Partial
The Cisco IronPort Email Security Appliance (ESA) allows remote attackers to cause a denial of service (CPU consumption) via long Subject headers in e-mail messages, aka Bug ID CSCzv93864.
16 CVE-2014-8014 19 DoS 2014-12-18 2014-12-18
5.0
None Remote Low Not required None None Partial
Cisco IOS XR allows remote attackers to cause a denial of service (RSVP process reload) via a malformed RSVP packet, aka Bug ID CSCub63710.
17 CVE-2014-8009 200 +Info 2014-12-10 2015-01-23
5.0
None Remote Low Not required Partial None None
The Management subsystem in Cisco Unified Computing System 2.1(3f) and earlier allows remote attackers to obtain sensitive information by reading log files, aka Bug ID CSCur99239.
18 CVE-2014-8005 362 DoS 2014-11-25 2014-12-30
5.0
None Remote Low Not required None None Partial
Race condition in the lighttpd module in Cisco IOS XR 5.1 and earlier on Network Convergence System 6000 devices allows remote attackers to cause a denial of service (process reload) by establishing many TCP sessions, aka Bug ID CSCuq45239.
19 CVE-2014-8004 399 DoS 2014-11-25 2014-12-30
5.0
None Remote Low Not required None None Partial
Cisco IOS XR allows remote attackers to cause a denial of service (LISP process reload) by establishing many LISP TCP sessions, aka Bug ID CSCuq90378.
20 CVE-2014-8000 264 2014-11-20 2014-12-02
5.0
None Remote Low Not required Partial None None
Cisco Unified Communications Manager IM and Presence Service 9.1(1) produces different returned messages for URL requests depending on whether a username exists, which allows remote attackers to enumerate user accounts via a series of requests, aka Bug ID CSCur63497.
21 CVE-2014-7994 20 Exec Code 2014-12-23 2014-12-24
5.4
None Local Network Medium Not required Partial Partial Partial
Cisco-Meraki MS, MR, and MX devices with firmware before 2014-09-24 allow remote attackers to execute arbitrary commands by leveraging knowledge of a cross-device secret and a per-device secret, and sending a request to an unspecified HTTP handler on the local network, aka Cisco-Meraki defect ID 00301991.
22 CVE-2014-7992 200 +Info 2014-11-17 2014-12-30
5.0
None Remote Low Not required Partial None None
The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensitive credential information from process memory via a session on TCP port 2067, aka Bug ID CSCur14014.
23 CVE-2014-5868 310 +Info 2014-09-11 2014-09-21
5.4
None Local Network Medium Not required Partial Partial Partial
The Cisco Technical Support (aka com.cisco.swtg_android) application 3.7.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
24 CVE-2014-3407 399 DoS 2014-11-27 2014-11-28
5.0
None Remote Low Not required None None Partial
The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 9.3(.2) and earlier does not properly allocate memory blocks during HTTP packet handling, which allows remote attackers to cause a denial of service (memory consumption) via crafted packets, aka Bug ID CSCuq68888.
25 CVE-2014-3403 310 2014-10-09 2014-10-10
5.0
None Remote Low Not required None Partial None
The Autonomic Networking Infrastructure (ANI) component in Cisco IOS XE does not properly validate certificates, which allows remote attackers to spoof devices via crafted messages, aka Bug ID CSCuq22647.
26 CVE-2014-3402 287 DoS 2014-10-10 2014-10-15
5.0
None Remote Low Not required None None Partial
The authentication-manager process in the web framework in Cisco Intrusion Prevention System (IPS) 7.0(8)E4 and earlier in Cisco Intrusion Detection System (IDS) does not properly manage user tokens, which allows remote attackers to cause a denial of service (temporary MainApp hang) via a crafted connection request to the management interface, aka Bug ID CSCuq39550.
27 CVE-2014-3399 94 DoS 2014-10-07 2014-10-07
5.5
None Remote Low Single system None Partial Partial
The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 9.2(.2.4) and earlier does not properly manage session information during creation of a SharePoint handler, which allows remote authenticated users to overwrite arbitrary RAMFS cache files or inject Lua programs, and consequently cause a denial of service (portal outage or system reload), via crafted HTTP requests, aka Bug ID CSCup54208.
28 CVE-2014-3398 200 +Info 2014-10-04 2014-10-06
5.0
None Remote Low Not required Partial None None
The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to obtain potentially sensitive software-version information by reading the verbose response data that is provided for a request to an unspecified URL, aka Bug ID CSCuq65542.
29 CVE-2014-3395 20 2014-09-30 2014-10-23
5.0
None Remote Low Not required Partial None None
Cisco WebEx Meetings Server (WMS) 2.5 allows remote attackers to trigger the download of arbitrary files via a crafted URL, aka Bug ID CSCup10343.
30 CVE-2014-3394 16 Bypass 2014-10-10 2014-10-13
5.0
None Remote Low Not required Partial None None
The Smart Call Home (SCH) implementation in Cisco ASA Software 8.2 before 8.2(5.50), 8.4 before 8.4(7.15), 8.6 before 8.6(1.14), 8.7 before 8.7(1.13), 9.0 before 9.0(4.8), and 9.1 before 9.1(5.1) allows remote attackers to bypass certificate validation via an arbitrary VeriSign certificate, aka Bug ID CSCun10916.
31 CVE-2014-3381 264 Bypass 2014-10-18 2014-10-22
5.0
None Remote Low Not required Partial None None
The ZIP inspection engine in Cisco AsyncOS 8.5 and earlier on the Cisco Email Security Appliance (ESA) does not properly analyze ZIP archives, which allows remote attackers to bypass malware filtering via a crafted archive, aka Bug ID CSCup07934.
32 CVE-2014-3380 399 DoS 2014-09-23 2014-10-10
5.0
None Remote Low Not required None None Partial
Cisco Unified Communications Domain Manager Platform Software 4.4(.3) and earlier allows remote attackers to cause a denial of service (CPU consumption) by sending crafted TCP packets quickly, aka Bug ID CSCuo42063.
33 CVE-2014-3378 20 DoS 2014-09-20 2014-09-23
5.0
None Remote Low Not required None None Partial
tacacsd in Cisco IOS XR 5.1 and earlier allows remote attackers to cause a denial of service (process reload) via a malformed TACACS+ packet, aka Bug ID CSCum00468.
34 CVE-2014-3376 20 DoS 2014-09-20 2014-09-23
5.0
None Remote Low Not required None None Partial
Cisco IOS XR 5.1 and earlier allows remote attackers to cause a denial of service (process reload) via a malformed RSVP packet, aka Bug ID CSCuq12031.
35 CVE-2014-3351 200 +Info 2014-08-29 2014-08-29
5.0
None Remote Low Not required Partial None None
Cisco Intelligent Automation for Cloud (aka Cisco Cloud Portal) does not properly consider whether a session is a problematic NULL session, which allows remote attackers to obtain sensitive information via crafted packets, aka Bug IDs CSCuh87398 and CSCuh87380.
36 CVE-2014-3348 20 DoS 2014-09-10 2014-09-16
5.0
None Remote Low Not required None None Partial
The SSH module in the Integrated Management Controller (IMC) before 2.3.1 in Cisco Unified Computing System on E-Series blade servers allows remote attackers to cause a denial of service (IMC hang) via a crafted SSH packet, aka Bug ID CSCuo69206.
37 CVE-2014-3347 399 DoS 2014-08-28 2014-08-29
5.4
None Remote High Not required None None Complete
Cisco IOS 15.1(4)M2 on Cisco 1800 ISR devices, when the ISDN Basic Rate Interface is enabled, allows remote attackers to cause a denial of service (device hang) by leveraging knowledge of the ISDN phone number to trigger an interrupt timer collision during entropy collection, leading to an invalid state of the hardware encryption module, aka Bug ID CSCul77897.
38 CVE-2014-3345 264 2014-08-28 2014-08-29
5.0
None Remote Low Not required None Partial None
The web framework in Cisco Transport Gateway for Smart Call Home (aka TG-SCH or Transport Gateway Installation Software) 4.0 does not properly check authorization for administrative web pages, which allows remote attackers to modify the product via a crafted URL, aka Bug ID CSCuq31503.
39 CVE-2014-3341 200 +Info 2014-08-19 2014-08-19
5.0
None Remote Low Not required Partial None None
The SNMP module in Cisco NX-OS 7.0(3)N1(1) and earlier on Nexus 5000 and 6000 devices provides different error messages for invalid requests depending on whether the VLAN ID exists, which allows remote attackers to enumerate VLANs via a series of requests, aka Bug ID CSCup85616.
40 CVE-2014-3330 264 Bypass 2014-08-11 2014-08-12
5.0
None Remote Low Not required Partial None None
Cisco NX-OS 6.1(2)I2(1) on Nexus 9000 switches does not properly process packet-drop policy checks for logged packets, which allows remote attackers to bypass intended access restrictions via a flood of packets matching a policy that contains the log keyword, aka Bug ID CSCuo02489.
41 CVE-2014-3328 DoS 2014-07-26 2014-07-28
5.0
None Remote Low Not required None None Partial
The Intercluster Sync Agent Service in Cisco Unified Presence Server allows remote attackers to cause a denial of service via a TCP SYN flood, aka Bug ID CSCun34125.
42 CVE-2014-3321 20 DoS 2014-07-17 2014-07-18
5.7
None Local Network Medium Not required None None Complete
Cisco IOS XR 4.3.4 and earlier on ASR 9000 devices, when bridge-group virtual interface (BVI) routing is enabled, allows remote attackers to cause a denial of service (chip and card hangs) via a series of crafted MPLS packets, aka Bug ID CSCuo91149.
43 CVE-2014-3320 2014-07-17 2014-07-18
5.8
None Remote Medium Not required Partial Partial None
Multiple open redirect vulnerabilities in the admin web interface in the web framework in Cisco Unified Communications Domain Manager (CDM) 8.1(.4) and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted URLs for unspecified scripts, aka Bug ID CSCuo48835.
44 CVE-2014-3317 22 Dir. Trav. 2014-07-14 2014-07-18
5.5
None Remote Low Single system None Partial Partial
Directory traversal vulnerability in the Multiple Analyzer in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager 10.0(1) allows remote authenticated users to delete arbitrary files via a crafted URL, aka Bug ID CSCup76314.
45 CVE-2014-3314 20 2015-01-14 2015-01-15
5.0
None Remote Low Not required None Partial None
Cisco AnyConnect on Android and OS X does not properly verify the host type, which allows remote attackers to spoof authentication forms and possibly capture credentials via unspecified vectors, aka Bug IDs CSCuo24931 and CSCuo24940.
46 CVE-2014-3311 119 Exec Code Overflow 2014-07-10 2014-07-18
5.1
None Remote High Not required Partial Partial Partial
Heap-based buffer overflow in the file-sharing feature in WebEx Meetings Client in Cisco WebEx Meetings Server and WebEx Meeting Center allows remote attackers to execute arbitrary code via crafted data, aka Bug IDs CSCup62463 and CSCup58467.
47 CVE-2014-3309 264 Bypass 2014-07-09 2014-07-18
5.0
None Remote Low Not required Partial None None
The NTP implementation in Cisco IOS and IOS XE does not properly support use of the access-group command for a "deny all" configuration, which allows remote attackers to bypass intended restrictions on time synchronization via a standard query, aka Bug ID CSCuj66318.
48 CVE-2014-3304 200 +Info 2014-07-28 2014-07-29
5.0
None Remote Low Not required Partial None None
The OutlookAction Class in Cisco WebEx Meetings Server allows remote attackers to enumerate user accounts by entering crafted URLs and examining the returned messages, aka Bug ID CSCuj81722.
49 CVE-2014-3302 310 +Info 2014-08-01 2014-08-01
5.8
None Remote Medium Not required Partial Partial None
user.php in Cisco WebEx Meetings Server 1.5(.1.131) and earlier does not properly implement the token timer for authenticated encryption, which allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCuj81708.
50 CVE-2014-3301 200 +Info 2014-07-26 2014-07-28
5.0
None Remote Low Not required Partial None None
The ProfileAction controller in Cisco WebEx Meetings Server (CWMS) 1.5(.1.131) and earlier allows remote attackers to obtain sensitive information by reading stack traces in returned messages, aka Bug ID CSCuj81700.
Total number of vulnerabilities : 441   Page : 1 (This Page)2 3 4 5 6 7 8 9
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.