VYPR
← Cisco Systems, Inc.

Vendor CVEs

Cisco Systems, Inc.

All CVEs

6,961 total · sorted by risk
  • CVE-2006-3287Jun 28, 2006
    Cisco Systems, Inc.
    Wireless Control System
    risk 0.00cvss —epss 0.03

    Cisco Wireless Control System (WCS) for Linux and Windows 4.0(1) and earlier uses a default administrator username "root" and password "public," which allows remote attackers to gain access (aka bug CSCse21391).

  • CVE-2006-3290Jun 28, 2006
    Cisco Systems, Inc.
    Wireless Control System
    risk 0.00cvss —epss 0.02

    HTTP server in Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(51) stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain usernames and directory paths via a direct URL request.

  • CVE-2006-3288Jun 28, 2006
    Cisco Systems, Inc.
    Wireless Control System
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the TFTP server in Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(51), when configured to use a directory path name that contains a space character, allows remote authenticated users to read and overwrite arbitrary files via…

  • CVE-2006-3291Jun 28, 2006
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.04

    The web interface on Cisco IOS 12.3(8)JA and 12.3(8)JA1, as used on the Cisco Wireless Access Point and Wireless Bridge, reconfigures itself when it is changed to use the "Local User List Only (Individual Passwords)" setting, which removes all security and password…

  • CVE-2006-3286Jun 28, 2006
    Cisco Systems, Inc.
    Wireless Control System
    risk 0.00cvss —epss 0.03

    The internal database in Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(63) stores a hard-coded username and password in plaintext within unspecified files, which allows remote authenticated users to access the database (aka bug CSCsd15951).

  • CVE-2006-3289Jun 28, 2006
    Cisco Systems, Inc.
    Wireless Control System
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the login page of the HTTP interface for the Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(51) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a "malicious URL".

  • CVE-2006-3285Jun 28, 2006
    Cisco Systems, Inc.
    Wireless Control System
    risk 0.00cvss —epss 0.03

    The internal database in Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(51) uses an undocumented, hard-coded username and password, which allows remote authenticated users to read, and possibly modify, sensitive configuration data (aka bugs CSCsd15955).

  • CVE-2006-3226Jun 26, 2006
    Cisco Systems, Inc.
    Secure Access Control Server
    risk 0.00cvss —epss 0.02

    Cisco Secure Access Control Server (ACS) 4.x for Windows uses the client's IP address and the server's port number to grant access to an HTTP server port for an administration session, which allows remote attackers to bypass authentication via various methods, aka "ACS Weak…

  • CVE-2006-3073Jun 19, 2006
    Cisco Systems, Inc.
    Asa 5500
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the WebVPN feature in the Cisco VPN 3000 Series Concentrators and Cisco ASA 5500 Series Adaptive Security Appliances (ASA), when in WebVPN clientless mode, allow remote attackers to inject arbitrary web script or HTML via…

  • CVE-2006-2679May 31, 2006
    Cisco Systems, Inc.
    VPN Client
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the VPN Client for Windows Graphical User Interface (GUI) (aka the VPN client dialer) in Cisco VPN Client for Windows 4.8.00.* and earlier, except for 4.7.00.0533, allows local authenticated, interactive users to gain privileges, possibly due to…

  • CVE-2006-2322May 12, 2006
    Cisco Systems, Inc.
    Application Velocity System 3110
    risk 0.00cvss —epss 0.02

    The transparent proxy feature of the Cisco Application Velocity System (AVS) 3110 5.0 and 4.0 and earlier, and 3120 5.0.0 and earlier, has a default configuration that allows remote attackers to proxy arbitrary TCP connections, aka Bug ID CSCsd32143.

  • CVE-2006-0561May 10, 2006
    Cisco Systems, Inc.
    Secure Access Control Server
    risk 0.00cvss —epss 0.00

    Cisco Secure Access Control Server (ACS) 3.x for Windows stores ACS administrator passwords and the master key in the registry with insecure permissions, which allows local users and remote administrators to decrypt the passwords by using Microsoft's cryptographic API functions…

  • CVE-2006-2166May 4, 2006
    Cisco Systems, Inc.
    Unity Express
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the HTTP management interface in Cisco Unity Express (CUE) 2.2(2) and earlier, when running on any CUE Advanced Integration Module (AIM) or Network Module (NM), allows remote authenticated attackers to reset the password for any user with an expired…

  • CVE-2006-1961Apr 21, 2006
    Cisco Systems, Inc.
    Wireless Lan Solution Engine
    risk 0.00cvss —epss 0.03

    Cisco CiscoWorks Wireless LAN Solution Engine (WLSE) and WLSE Express before 2.13, Hosting Solution Engine (HSE) and User Registration Tool (URT) before 20060419, and all versions of Ethernet Subscriber Solution Engine (ESSE) and CiscoWorks2000 Service Management Solution (SMS)…

  • CVE-2006-1928Apr 20, 2006
    Cisco Systems, Inc.
    iOS Xr
    risk 0.00cvss —epss 0.02

    Cisco IOS XR, when configured for Multi Protocol Label Switching (MPLS) and running on Cisco CRS-1 routers, allows remote attackers to cause a denial of service (Modular Services Cards (MSC) crash or "MPLS packet handling problems") via certain MPLS packets, as identified by…

  • CVE-2006-1927Apr 20, 2006
    Cisco Systems, Inc.
    iOS Xr
    risk 0.00cvss —epss 0.02

    Cisco IOS XR, when configured for Multi Protocol Label Switching (MPLS) and running on Cisco CRS-1 or Cisco 12000 series routers, allows remote attackers to cause a denial of service (Line card crash) via certain MPLS packets, as identified by Cisco bug ID CSCsc77475.

  • CVE-2006-1670Apr 7, 2006
    Cisco Systems, Inc.
    Optical Networking Systems Software
    risk 0.00cvss —epss 0.02

    Control cards for Cisco Optical Networking System (ONS) 15000 series nodes before 20060405 allow remote attackers to cause a denial of service (memory exhaustion and possibly card reset) by sending an invalid response when the final ACK is expected, aka bug ID CSCei45910.

  • CVE-2006-1672Apr 7, 2006
    Cisco Systems, Inc.
    Transport Controller
    risk 0.00cvss —epss 0.04

    The installation of Cisco Transport Controller (CTC) for Cisco Optical Networking System (ONS) 15000 series nodes adds a Java policy file entry with a wildcard that grants the java.security.AllPermission permission to any http URL containing "fs/LAUNCHER.jar", which allows…

  • CVE-2006-1671Apr 7, 2006
    Cisco Systems, Inc.
    Optical Networking Systems Software
    risk 0.00cvss —epss 0.02

    Control cards for Cisco Optical Networking System (ONS) 15000 series nodes before 20060405 allow remote attackers to cause a denial of service (card reset) via (1) a "crafted" IP packet to a device with secure mode EMS-to-network-element access, aka bug ID CSCsc51390; (2) a…

  • CVE-2006-1631Apr 5, 2006
    Cisco Systems, Inc.
    Content Services Switch 11500
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the HTTP compression functionality in Cisco CSS 11500 Series Content Services switches allows remote attackers to cause a denial of service (device reload) via (1) "valid, but obsolete" or (2) "specially crafted" HTTP requests.

  • CVE-2006-0764Feb 18, 2006
    Cisco Systems, Inc.
    Cisco Anomaly Detection and Mitigation
    risk 0.00cvss —epss 0.02

    The Authentication, Authorization, and Accounting (AAA) capability in versions 5.0(1) and 5.0(3) of the software used by multiple Cisco Anomaly Detection and Mitigation products, when running with an incomplete TACACS+ configuration without a "tacacs-server host" command, allows…

  • CVE-2006-0485Feb 1, 2006
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.00

    The TCL shell in Cisco IOS 12.2(14)S before 12.2(14)S16, 12.2(18)S before 12.2(18)S11, and certain other releases before 25 January 2006 does not perform Authentication, Authorization, and Accounting (AAA) command authorization checks, which may allow local users to execute IOS…

  • CVE-2006-0486Feb 1, 2006
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.00

    Certain Cisco IOS releases in 12.2S based trains with maintenance release number 25 and later, 12.3T based trains, and 12.4 based trains reuse a Tcl Shell process across login sessions of different local users on the same terminal if the first user does not use tclquit before…

  • CVE-2006-0483Jan 31, 2006
    Cisco Systems, Inc.
    VPN 3030 Concentator
    risk 0.00cvss —epss 0.03

    Cisco VPN 3000 series concentrators running software 4.7.0 through 4.7.2.A allow remote attackers to cause a denial of service (device reload or user disconnect) via a crafted HTTP packet.

  • CVE-2006-0367Jan 22, 2006
    Cisco Systems, Inc.
    Unified Callmanager
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Cisco CallManager 3.2 and earlier, 3.3 before 3.3(5)SR1, 4.0 before 4.0(2a)SR2c, and 4.1 before 4.1(3)SR2 allows remote authenticated users with read-only administrative privileges to obtain full administrative privileges via a "crafted URL on the…

  • CVE-2006-0368Jan 22, 2006
    Cisco Systems, Inc.
    Unified Callmanager
    risk 0.00cvss —epss 0.04

    Cisco CallManager 3.2 and earlier, 3.3 before 3.3(5)SR1, 4.0 before 4.0(2a)SR2c, and 4.1 before 4.1(3)SR2 allow remote attackers to (1) cause a denial of service (CPU and memory consumption) via a large number of open TCP connections to port 2000 and (2) cause a denial of…

  • CVE-2006-0340Jan 21, 2006
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Stack Group Bidding Protocol (SGBP) support in Cisco IOS 12.0 through 12.4 running on various Cisco products, when SGBP is enabled, allows remote attackers on the local network to cause a denial of service (device hang and network traffic loss) via a…

  • CVE-2006-0181Jan 12, 2006
    Cisco Systems, Inc.
    Cs Mars
    risk 0.00cvss —epss 0.00

    Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.1.3 has an undocumented administrative account with a default password, which allows local users to gain privileges via the expert command.

  • CVE-2005-4825Dec 31, 2005
    Cisco Systems, Inc.
    Clean Access
    risk 0.00cvss —epss 0.01

    Cisco Clean Access 3.5.5 and earlier on the Secure Smart Manager allows remote attackers to bypass authentication and cause a denial of service (disk consumption), or make unauthorized files accessible, by uploading files through requests to certain JSP scripts, a related issue…

  • CVE-2005-4826Dec 31, 2005
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the VLAN Trunking Protocol (VTP) feature in Cisco IOS 12.1(22)EA3 on Catalyst 2950T switches allows remote attackers to cause a denial of service (device reboot) via a crafted Subset-Advert message packet, a different issue than CVE-2006-4774,…

  • CVE-2005-4794Dec 31, 2005
    Cisco Systems, Inc.
    Ata
    risk 0.00cvss —epss 0.02

    Cisco IP Phones 7902/7905/7912, ATA 186/188, Unity Express, ACNS, and Subscriber Edge Services Manager (SESM) allows remote attackers to cause a denial of service (crash or instability) via a compressed DNS packet with a label length byte with an incorrect offset.

  • CVE-2005-4499Dec 22, 2005
    Cisco Systems, Inc.
    Secure Access Control Server
    risk 0.00cvss —epss 0.03

    The Downloadable RADIUS ACLs feature in Cisco PIX and VPN 3000 concentrators, when creating an ACL on the Cisco Secure Access Control Server (CS ACS), generates a random internal name for an ACL that is also used as a hidden user name and password, which allows remote attackers…

  • CVE-2005-4436Dec 21, 2005
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Extended Interior Gateway Routing Protocol (EIGRP) 1.2, as implemented in Cisco IOS after 12.3(2), 12.3(3)B, and 12.3(2)T and other products, allows remote attackers to cause a denial of service by sending a "spoofed neighbor announcement" with (1) mismatched k values or (2)…

  • CVE-2005-4437Dec 21, 2005
    Extended Interior Gateway Routing Protocol
    Extended Interior Gateway Routing Protocol
    risk 0.00cvss —epss 0.02

    MD5 Neighbor Authentication in Extended Interior Gateway Routing Protocol (EIGRP) 1.2, as implemented in Cisco IOS 11.3 and later, does not include the Message Authentication Code (MAC) in the checksum, which allows remote attackers to sniff message hashes and (1) replay EIGRP…

  • CVE-2005-4332Dec 17, 2005
    Cisco Systems, Inc.
    Clean Access
    risk 0.00cvss —epss 0.04

    Cisco Clean Access 3.5.5 and earlier on the Secure Smart Manager allows remote attackers to bypass authentication and cause a denial of service or upload files via direct requests to obsolete JSP files including (1) admin/uploadclient.jsp, (2) apply_firmware_action.jsp, and (3)…

  • CVE-2005-4258Dec 15, 2005
    Cisco Systems, Inc.
    Catalyst
    risk 0.00cvss —epss 0.02

    Unspecified Cisco Catalyst Switches allow remote attackers to cause a denial of service (device crash) via an IP packet with the same source and destination IPs and ports, and with the SYN flag set (aka LanD). NOTE: the provenance of this issue is unknown; the details are…

  • CVE-2005-3921Nov 30, 2005
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in Cisco IOS Web Server for IOS 12.0(2a) allows remote attackers to inject arbitrary web script or HTML by (1) packets containing HTML that an administrator views via an HTTP interface to the contents of memory buffers, as demonstrated by…

  • CVE-2005-3886Nov 29, 2005
    Cisco Systems, Inc.
    Security Agent
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in Cisco Security Agent (CSA) 4.5.0 and 4.5.1 agents, when running on Windows systems, allows local users to bypass protections and gain system privileges by executing certain local software.

  • CVE-2005-3804Nov 24, 2005
    Cisco Systems, Inc.
    IP Phone
    risk 0.00cvss —epss 0.03

    Cisco IP Phone (VoIP) 7920 1.0(8) listens to UDP port 17185 to support a VxWorks debugger, which allows remote attackers to obtain sensitive information and cause a denial of service.

  • CVE-2005-3788Nov 24, 2005
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.03

    Race condition in Cisco Adaptive Security Appliance (ASA) 7.0(0), 7.0(2), and 7.0(4), when running with an Active/Standby configuration and when the failover LAN interface fails, allows remote attackers to cause a denial of service (standby firewall failure) by sending spoofed…

  • CVE-2005-3669Nov 18, 2005
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.05

    Multiple unspecified vulnerabilities in the Internet Key Exchange version 1 (IKEv1) implementation in multiple Cisco products allow remote attackers to cause a denial of service (device reset) via certain malformed IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for…

  • CVE-2005-3482Nov 3, 2005
    Cisco Systems, Inc.
    Airespace WLAN Controller
    risk 0.00cvss —epss 0.02

    Cisco 1200, 1131, and 1240 series Access Points, when operating in Lightweight Access Point Protocol (LWAPP) mode and controlled by 2000 and 4400 series Airespace WLAN controllers running 3.1.59.24, allow remote attackers to send unencrypted traffic to a secure network using…

  • CVE-2005-3426Nov 2, 2005
    Cisco Systems, Inc.
    Content Services Switch 11500
    risk 0.00cvss —epss 0.01

    Cisco CSS 11500 Content Services Switch (CSS) with SSL termination services allows remote attackers to cause a denial of service (memory corruption and device reload) via a malformed client certificate during SSL session negotiation.

  • CVE-2005-3427Nov 2, 2005
    Cisco Systems, Inc.
    IPS MC
    risk 0.00cvss —epss 0.00

    The Cisco Management Center (MC) for IPS Sensors (IPS MC) 2.1 can omit port field values while generating the Cisco IOS IPS configuration file, wich can cause some signatures to be disabled and makes it easier for attackers to escape detection.

  • CVE-2005-2695Aug 26, 2005
    Cisco Systems, Inc.
    Ciscoworks Management Center For Ids Sensors
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the SSL certificate checking functionality in Cisco CiscoWorks Management Center for IDS Sensors (IDSMC) 2.0 and 2.1, and Monitoring Center for Security (Security Monitor or Secmon) 1.1 through 2.0 and 2.1, allows remote attackers to spoof a Cisco…

  • CVE-2005-2681Aug 23, 2005
    Cisco Systems, Inc.
    Intrusion Prevention System
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the command line processing (CLI) logic in Cisco Intrusion Prevention System 5.0(1) and 5.0(2) allows local users with OPERATOR or VIEWER privileges to gain additional privileges via unknown vectors.

  • CVE-2005-2631Aug 23, 2005
    Cisco Systems, Inc.
    Clean Access
    risk 0.00cvss —epss 0.02

    Cisco Clean Access (CCA) 3.3.0 to 3.3.9, 3.4.0 to 3.4.5, and 3.5.0 to 3.5.3 does not properly authenticate users when invoking API methods, which could allow remote attackers to bypass security checks, change the assigned role of a user, or disconnect users.

  • CVE-2005-2451Aug 3, 2005
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.01

    Cisco IOS 12.0 through 12.4 and IOS XR before 3.2, with IPv6 enabled, allows remote attackers on a local network segment to cause a denial of service (device reload) and possibly execute arbitrary code via a crafted IPv6 packet.

  • CVE-2005-2279Jul 18, 2005
    Cisco Systems, Inc.
    ONS 15216 Optical Add/Drop Multiplexer (OADM)
    risk 0.00cvss —epss 0.02

    Cisco ONS 15216 Optical Add/Drop Multiplexer (OADM) running firmware 2.2.2 and earlier allows remote attackers to cause a denial of service (management plane session loss) via crafted telnet data.

  • CVE-2005-2280Jul 18, 2005
    Cisco Systems, Inc.
    Security Agent
    risk 0.00cvss —epss 0.01

    Cisco Security Agent (CSA) 4.5 allows remote attackers to cause a denial of service (system crash) via a crafted IP packet.

Page 135 of 140