CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Cisco : Security Vulnerabilities (Bypass)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2016-6405 20 Bypass 2016-09-18 2016-09-19
6.8
None Remote Low Single system None Complete None
Cisco Fog Director 1.0(0) for IOx allows remote authenticated users to bypass intended access restrictions and write to arbitrary files via the Cartridge interface, aka Bug ID CSCuz89368.
2 CVE-2016-6396 20 Bypass 2016-09-12 2016-09-12
5.0
None Remote Low Not required None Partial None
Cisco Firepower Management Center before 6.1 and FireSIGHT System Software before 6.1, when certain malware blocking options are enabled, allow remote attackers to bypass malware detection via crafted fields in HTTP headers, aka Bug ID CSCuz44482.
3 CVE-2016-6377 287 Bypass 2016-09-03 2016-09-06
6.8
None Remote Medium Not required Partial Partial Partial
Media Origination System Suite Software 2.6 and earlier in Cisco Virtual Media Packager (VMP) allows remote attackers to bypass authentication and make arbitrary Platform and Applications Manager (PAM) API calls via unspecified vectors, aka Bug ID CSCuz52110.
4 CVE-2016-6364 200 Bypass +Info 2016-08-22 2016-08-23
5.0
None Remote Low Not required Partial None None
The User Data Services (UDS) API implementation in Cisco Unified Communications Manager 11.5 allows remote attackers to bypass intended access restrictions and obtain sensitive information via unspecified API calls, aka Bug ID CSCux67855.
5 CVE-2016-1484 20 Bypass +Info 2016-08-22 2016-08-23
5.0
None Remote Low Not required Partial None None
Cisco WebEx Meetings Server 2.6 allows remote attackers to bypass intended access restrictions and obtain sensitive application information via unspecified vectors, aka Bug ID CSCuy92724.
6 CVE-2016-1463 20 Bypass 2016-07-27 2016-07-28
5.0
None Remote Low Not required None Partial None
Cisco FireSIGHT System Software 5.3.0, 5.3.1, 5.4.0, 6.0, and 6.0.1 allows remote attackers to bypass Snort rules via crafted parameters in the header of an HTTP packet, aka Bug ID CSCuz20737.
7 CVE-2016-1445 20 Bypass 2016-07-11 2016-07-12
4.3
None Remote Medium Not required Partial None None
Cisco Adaptive Security Appliance (ASA) Software 8.2 through 9.4.3.3 allows remote attackers to bypass intended ICMP Echo Reply ACLs via vectors related to subtypes.
8 CVE-2016-1444 20 Bypass 2016-07-07 2016-07-08
5.8
None Remote Medium Not required Partial Partial None
The Mobile and Remote Access (MRA) component in Cisco TelePresence Video Communication Server (VCS) X8.1 through X8.7 and Expressway X8.1 through X8.6 mishandles certificates, which allows remote attackers to bypass authentication via an arbitrary trusted certificate, aka Bug ID CSCuz64601.
9 CVE-2016-1443 254 Bypass +Info 2016-07-07 2016-07-08
6.8
None Remote Medium Not required Partial Partial Partial
The virtual network stack on Cisco AMP Threat Grid Appliance devices before 2.1.1 allows remote attackers to bypass a sandbox protection mechanism, and consequently obtain sensitive interprocess information or modify interprocess data, via a crafted malware sample.
10 CVE-2016-1441 20 Bypass 2016-07-02 2016-07-05
6.4
None Remote Low Not required Partial Partial None
Cisco Cloud Network Automation Provisioner (CNAP) 1.0(0) in Cisco Configuration Assistant (CCA) allows remote attackers to bypass intended filesystem and administrative-endpoint restrictions via GET API calls, aka Bug ID CSCuy77145.
11 CVE-2016-1438 20 Bypass 2016-06-22 2016-06-23
5.0
None Remote Low Not required None Partial None
Cisco AsyncOS 9.7.0-125 on Email Security Appliance (ESA) devices allows remote attackers to bypass intended spam filtering via crafted executable content in a ZIP archive, aka Bug ID CSCuy39210.
12 CVE-2016-1406 284 +Priv Bypass +Info 2016-05-24 2016-05-25
6.5
None Remote Low Single system Partial Partial Partial
The API web interface in Cisco Prime Infrastructure before 3.1 and Cisco Evolved Programmable Network Manager before 1.2.4 allows remote authenticated users to bypass intended RBAC restrictions and obtain sensitive information, and consequently gain privileges, via crafted JSON data, aka Bug ID CSCuy12409.
13 CVE-2016-1357 200 Bypass +Info 2016-03-03 2016-03-14
5.0
None Remote Low Not required Partial None None
The password-management administration component in Cisco Policy Suite (CPS) 7.0.1.3, 7.0.2, 7.0.2-att, 7.0.3-att, 7.0.4-att, and 7.5.0 allows remote attackers to bypass intended RBAC restrictions and read unspecified data via unknown vectors, aka Bug ID CSCut85211.
14 CVE-2016-1345 20 Bypass 2016-03-31 2016-04-01
5.0
None Remote Low Not required None Partial None
Cisco FireSIGHT System Software 5.4.0 through 6.0.1 and ASA with FirePOWER Services 5.4.0 through 6.0.0.1 allow remote attackers to bypass malware protection via crafted fields in HTTP headers, aka Bug ID CSCux22726.
15 CVE-2016-1322 264 Bypass 2016-02-11 2016-03-01
5.0
None Remote Low Not required None Partial None
The REST interface in Cisco Spark 2015-07-04 allows remote attackers to bypass intended access restrictions and create arbitrary user accounts via unspecified web requests, aka Bug ID CSCuv72584.
16 CVE-2016-1321 200 Bypass +Info 2016-02-15 2016-02-24
5.0
None Remote Low Not required Partial None None
Cisco Universal Small Cell devices with firmware R2.12 through R3.5 contain an image-decryption key in flash memory, which allows remote attackers to bypass a certain certificate-validation feature and obtain sensitive firmware-image and IP address data via a request to an unspecified Cisco server, aka Bug ID CSCut98082.
17 CVE-2016-1315 284 Bypass 2016-02-11 2016-03-11
5.0
None Remote Low Not required None Partial None
The proxy engine in Cisco Advanced Malware Protection (AMP), when used with Email Security Appliance (ESA) 9.5.0-201, 9.6.0-051, and 9.7.0-125, allows remote attackers to bypass intended content restrictions via a malformed e-mail message containing an encoded file, aka Bug ID CSCux45338.
18 CVE-2016-1302 284 Bypass 2016-02-07 2016-03-14
9.0
None Remote Low Single system Complete Complete Complete
Cisco Application Policy Infrastructure Controller (APIC) devices with software before 1.0(3h) and 1.1 before 1.1(1j) and Nexus 9000 ACI Mode switches with software before 11.0(3h) and 11.1 before 11.1(1j) allow remote authenticated users to bypass intended RBAC restrictions via crafted REST requests, aka Bug ID CSCut12998.
19 CVE-2016-1297 78 Exec Code Bypass 2016-02-26 2016-08-04
9.0
None Remote Low Single system Complete Complete Complete
The Device Manager GUI in Cisco Application Control Engine (ACE) 4710 A5 before A5(3.1) allows remote authenticated users to bypass intended RBAC restrictions and execute arbitrary CLI commands with admin privileges via an unspecified parameter in a POST request, aka Bug ID CSCul84801.
20 CVE-2016-1296 254 Bypass 2016-01-20 2016-01-22
5.0
None Remote Low Not required None Partial None
The proxy engine on Cisco Web Security Appliance (WSA) devices with software 8.5.3-055, 9.1.0-000, and 9.5.0-235 allows remote attackers to bypass intended proxy restrictions via a malformed HTTP method, aka Bug ID CSCux00848.
21 CVE-2016-1290 264 +Priv Bypass 2016-04-06 2016-04-07
5.5
None Remote Low Single system Partial Partial None
The web API in Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allows remote authenticated users to bypass intended RBAC restrictions and gain privileges via an HTTP request that is inconsistent with a pattern filter, aka Bug ID CSCuy10227.
22 CVE-2015-6427 254 Bypass 2015-12-18 2015-12-18
5.0
None Remote Low Not required None Partial None
Cisco FireSIGHT Management Center allows remote attackers to bypass the HTTP attack detection feature and avoid triggering Snort IDS rules via an SSL session that is mishandled after decryption, aka Bug ID CSCux53437.
23 CVE-2015-6426 20 Exec Code Bypass 2015-12-18 2015-12-18
7.2
None Local Low Not required Complete Complete Complete
Cisco Prime Network Services Controller 3.0 allows local users to bypass intended access restrictions and execute arbitrary commands via additional parameters to an unspecified command, aka Bug ID CSCus99427.
24 CVE-2015-6424 255 Bypass 2015-12-18 2015-12-18
7.2
None Local Low Not required Complete Complete Complete
The boot manager in Cisco Application Policy Infrastructure Controller (APIC) 1.1(0.920a) allows local users to bypass intended access restrictions and obtain single-user-mode root access via unspecified vectors, aka Bug ID CSCuu83985.
25 CVE-2015-6423 264 Bypass 2016-01-14 2016-01-20
3.5
None Remote Medium Single system Partial None None
The DCERPC Inspection implementation in Cisco Adaptive Security Appliance (ASA) Software 9.4.1 through 9.5.1 allows remote authenticated users to bypass an intended DCERPC-only ACL by sending arbitrary network traffic, aka Bug ID CSCuu67782.
26 CVE-2015-6413 264 Bypass 2015-12-12 2015-12-14
4.0
None Remote Low Single system None Partial None
Cisco TelePresence Video Communication Server (VCS) Expressway X8.6 allows remote authenticated users to bypass intended read-only restrictions and upload Tandberg Linux Package (TLP) files by visiting an administrative page, aka Bug ID CSCuw55651.
27 CVE-2015-6410 20 Bypass 2015-12-13 2015-12-14
4.0
None Remote Low Single system Partial None None
The Mobile and Remote Access (MRA) services implementation in Cisco Unified Communications Manager mishandles edge-device identity validation, which allows remote attackers to bypass intended call-reception and call-setup restrictions by spoofing a user, aka Bug ID CSCuu97283.
28 CVE-2015-6401 287 Bypass 2015-12-13 2015-12-14
7.5
None Remote Low Not required Partial Partial Partial
Cisco EPC3928 devices with EDVA 5.5.10, 5.5.11, and 5.7.1 allow remote attackers to bypass an intended authentication requirement and execute unspecified administrative functions via a crafted HTTP request, aka Bug ID CSCux24941.
29 CVE-2015-6384 264 Bypass 2015-12-04 2015-12-07
4.3
None Remote Medium Not required Partial None None
The Cisco WebEx Meetings application before 8.5.1 for Android improperly initializes custom application permissions, which allows attackers to bypass intended access restrictions via a crafted application, aka Bug ID CSCuw86442.
30 CVE-2015-6383 264 Bypass 2015-12-02 2015-12-03
7.2
Admin Local Low Not required Complete Complete Complete
Cisco IOS XE 15.4(3)S on ASR 1000 devices improperly loads software packages, which allows local users to bypass license restrictions and obtain certain root privileges by using the CLI to enter crafted filenames, aka Bug ID CSCuv93130.
31 CVE-2015-6366 284 Bypass 2015-11-12 2015-11-13
5.0
None Remote Low Not required None Partial None
Cisco IOS 15.2(04)M6 and 15.4(03)S lets physical-interface ACLs supersede tunnel-interface ACLs, which allows remote attackers to bypass intended network-traffic restrictions in opportunistic circumstances by using a tunnel, aka Bug ID CSCur01042.
32 CVE-2015-6365 20 Bypass 2015-11-13 2015-11-16
4.0
None Remote Low Single system None Partial None
Cisco IOS 15.2(04)M and 15.4(03)M lets physical-interface ACLs supersede virtual PPP interface ACLs, which allows remote authenticated users to bypass intended network-traffic restrictions in opportunistic circumstances by using PPP, aka Bug ID CSCur61303.
33 CVE-2015-6362 264 Bypass 2015-11-09 2015-11-10
4.0
None Remote Low Single system None Partial None
The web GUI in Cisco Connected Grid Network Management System (CG-NMS) 3.0(0.35) and 3.0(0.54) allows remote authenticated users to bypass intended access restrictions and modify the configuration by leveraging the Monitor-Only role, aka Bug ID CSCuw42640.
34 CVE-2015-6348 264 Bypass 2015-10-30 2015-10-30
4.0
None Remote Low Single system Partial None None
The report-generation web interface in the Solution Engine in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote authenticated users to bypass intended RBAC restrictions, and read report or status information, by visiting an unspecified web page.
35 CVE-2015-6347 264 Bypass 2015-10-30 2015-10-30
4.0
None Remote Low Single system None Partial None
The Solution Engine in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote authenticated users to bypass intended RBAC restrictions, and create a dashboard or portlet, by visiting an unspecified web page.
36 CVE-2015-6344 200 Bypass +Info 2015-10-30 2015-10-30
4.0
None Remote Low Single system Partial None None
The web-based GUI in Cisco Adaptive Security Appliance (ASA) CX Context-Aware Security 9.3(4.1.11) allows remote authenticated users to bypass intended access restrictions and obtain sensitive user information via an unspecified HTTP request, aka Bug ID CSCuv74105.
37 CVE-2015-6335 264 Exec Code Bypass 2015-10-24 2015-10-26
9.0
Admin Remote Low Single system Complete Complete Complete
The policy implementation in Cisco FireSIGHT Management Center 5.3.1.7, 5.4.0.4, and 6.0.0 for VMware allows remote authenticated administrators to bypass intended policy restrictions and execute Linux commands as root via unspecified vectors, aka Bug ID CSCuw12839.
38 CVE-2015-6328 200 Bypass +Info 2015-10-12 2015-10-13
6.8
None Remote Low Single system Complete None None
The web framework in Cisco Prime Collaboration Assurance (PCA) 10.5(1) allows remote authenticated users to bypass intended access restrictions and read arbitrary files via a crafted URL, aka Bug ID CSCus88380.
39 CVE-2015-6322 264 Bypass 2015-10-12 2015-10-13
6.6
None Local Low Not required None Complete Complete
The IPC channel in Cisco AnyConnect Secure Mobility Client 2.0.0343 through 4.1(8) allows local users to bypass intended access restrictions and move arbitrary files by leveraging the lack of source-path validation, aka Bug ID CSCuv48563.
40 CVE-2015-6317 284 Bypass 2016-01-23 2016-01-25
6.8
None Remote Low Single system None Complete None
Cisco Identity Services Engine (ISE) before 2.0 allows remote authenticated users to bypass intended web-resource access restrictions via a direct request, aka Bug ID CSCuu45926.
41 CVE-2015-6265 79 XSS Bypass 2015-08-26 2015-08-27
4.3
None Remote Medium Not required None Partial None
The CLI in Cisco Application Control Engine (ACE) 4700 A5 3.0 and earlier allows local users to bypass intended access restrictions, and read or write to files, by entering an unspecified CLI command with a crafted file as this command's input, aka Bug ID CSCur23662.
42 CVE-2015-6261 200 Bypass +Info 2015-08-26 2015-08-26
4.0
None Remote Low Single system Partial None None
Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows remote authenticated users to bypass intended access restrictions and read configuration files by leveraging the Mobile and Remote Access (MRA) role and establishing a TFTP session, aka Bug ID CSCuv78531.
43 CVE-2015-4331 264 Bypass 2015-08-22 2015-08-24
3.5
None Remote Medium Single system Partial None None
Cisco Prime Infrastructure (PI) 1.4(0.45) and earlier, when AAA authentication is used, allows remote authenticated users to bypass intended access restrictions via a username with a modified composition of lowercase and uppercase characters, aka Bug ID CSum59958.
44 CVE-2015-4321 20 Bypass 2015-08-20 2015-08-21
5.0
None Remote Low Not required Partial None None
The Unicast Reverse Path Forwarding (uRPF) implementation in Cisco Adaptive Security Appliance (ASA) Software 9.3(1.50), 9.3(2.100), 9.3(3), and 9.4(1) mishandles cases where an IP address belongs to an internal interface but is also in the ASA routing table, which allows remote attackers to bypass uRPF validation via spoofed packets, aka Bug ID CSCuv60724.
45 CVE-2015-4307 264 Bypass 2015-09-19 2015-09-21
9.0
None Remote Low Single system Complete Complete Complete
The web framework in Cisco Prime Collaboration Provisioning before 11.0 allows remote authenticated users to bypass intended access restrictions and create administrative accounts via a crafted URL, aka Bug ID CSCut64111.
46 CVE-2015-4306 264 Bypass 2015-09-19 2015-09-21
8.5
None Remote Medium Single system Complete Complete Complete
The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended login-session read restrictions, and impersonate administrators of arbitrary tenant domains, by discovering a session identifier and constructing a crafted URL, aka Bug IDs CSCus88343 and CSCus88334.
47 CVE-2015-4305 264 Bypass 2015-09-19 2015-09-21
4.0
None Remote Low Single system Partial None None
The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended system-database read restrictions, and discover credentials or SNMP communities for arbitrary tenant domains, via a crafted URL, aka Bug ID CSCus62656.
48 CVE-2015-4304 264 Bypass 2015-09-19 2015-09-21
9.0
None Remote Low Single system Complete Complete Complete
The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended access restrictions, and create administrative accounts or read data from arbitrary tenant domains, via a crafted URL, aka Bug IDs CSCus62671 and CSCus62652.
49 CVE-2015-4287 264 Bypass +Info 2015-07-28 2015-07-29
5.0
None Remote Low Not required Partial None None
Cisco Firepower Extensible Operating System 1.1(1.86) on Firepower 9000 devices allows remote attackers to bypass intended access restrictions and obtain sensitive device information by visiting an unspecified web page, aka Bug ID CSCuu82230.
50 CVE-2015-4271 284 Bypass 2015-07-15 2015-07-16
6.4
None Remote Low Not required Partial Partial None
Cisco TelePresence TC before 7.3.4 on Integrator C devices allows remote attackers to bypass authentication via vectors involving multiple request parameters, aka Bug ID CSCuv00604.
Total number of vulnerabilities : 220   Page : 1 (This Page)2 3 4 5
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.