Vendor CVEs

Cisco Systems, Inc.

All CVEs

7,231 total · sorted by risk

CVE	Vendor / Product	CVSS	EPSS	Published	Description
CVE-2002-1768	Cisco Systems, Inc. Cisco iOS	—	0.02	Dec 31, 2002	Cisco IOS 11.1 through 12.2, when HSRP support is not enabled, allows remote attackers to cause a denial of service (CPU consumption) via randomly sized UDP packets to the Hot Standby Routing Protocol (HSRP) port 1985.
CVE-2002-2037	Cisco Systems, Inc. Bams	—	0.01	Dec 31, 2002	The Cisco Media Gateway Controller (MGC) in (1) SC2200 7.4 and earlier, (2) VSC3000 9.1 and earlier, (3) PGW 2200 9.1 and earlier, (4) Billing and Management Server (BAMS) and (5) Voice Services Provisioning Tool (VSPT) runs on default installations of Solaris 2.6 with…
CVE-2002-2239	Cisco Systems, Inc. Cisco iOS	—	0.02	Dec 31, 2002	The Cisco Optical Service Module (OSM) for the Catalyst 6500 and 7600 series running Cisco IOS 12.1(8)E through 12.1(13.4)E allows remote attackers to cause a denial of service (hang) via a malformed packet.
CVE-2002-2316	Cisco Systems, Inc. Catos	—	0.01	Dec 31, 2002	Cisco Catalyst 4000 series switches running CatOS 5.5.5, 6.3.5, and 7.1.2 do not always learn MAC addresses from a single initial packet, which causes unicast traffic to be broadcast across the switch and allows remote attackers to obtain sensitive network information by…
CVE-2002-2052	Cisco Systems, Inc. Cisco iOS	—	0.02	Dec 31, 2002	Cisco 2611 router running IOS 12.1(6.5), possibly an interim release, allows remote attackers to cause a denial of service via port scans such as (1) scanning all ports on a single host and (2) scanning a network of hosts for a single open port through the router. NOTE: the…
CVE-2002-2139	Cisco Systems, Inc. Pix Firewall Software	—	0.01	Dec 31, 2002	Cisco PIX Firewall 6.0.3 and earlier, and 6.1.x to 6.1.3, do not delete the duplicate ISAKMP SAs for a user's VPN session, which allows local users to hijack a session via a man-in-the-middle attack.
CVE-2002-2140	Cisco Systems, Inc. Pix Firewall Software	—	0.02	Dec 31, 2002	Buffer overflow in Cisco PIX Firewall 5.2.x to 5.2.8, 6.0.x to 6.0.3, 6.1.x to 6.1.3, and 6.2.x to 6.2.1 allows remote attackers to cause a denial of service via HTTP traffic authentication using (1) TACACS+ or (2) RADIUS.
CVE-2002-2208	Extended Interior Gateway Routing Protocol Extended Interior Gateway Routing Protocol	—	0.04	Dec 31, 2002	Extended Interior Gateway Routing Protocol (EIGRP), as implemented in Cisco IOS 11.3 through 12.2 and other products, allows remote attackers to cause a denial of service (flood) by sending a large number of spoofed EIGRP neighbor announcements, which results in an ARP storm on…
CVE-2002-1358	Cisco Systems, Inc. Cisco iOS	—	0.06	Dec 23, 2002	Multiple SSH2 servers and clients do not properly handle lists with empty elements or strings, which may allow remote attackers to cause a denial of service or possibly execute arbitrary code, as demonstrated by the SSHredder SSH protocol test suite.
CVE-2002-1360	Cisco Systems, Inc. Cisco iOS	—	0.06	Dec 23, 2002	Multiple SSH2 servers and clients do not properly handle strings with null characters in them when the string length is specified by a length field, which could allow remote attackers to cause a denial of service or possibly execute arbitrary code due to interactions with the…
CVE-2002-1190	Cisco Systems, Inc. Unity	—	0.02	Oct 28, 2002	Cisco Unity 2.x and 3.x uses well-known default user accounts, which could allow remote attackers to gain access and place arbitrary calls.
CVE-2002-1189	Cisco Systems, Inc. Unity	—	0.00	Oct 11, 2002	The default configuration of Cisco Unity 2.x and 3.x does not block international operator calls in the predefined restriction tables, which could allow authenticated users to place international calls using call forwarding.
CVE-2002-1098	Cisco Systems, Inc. VPN 3000 Concentrator Series Software	—	0.01	Oct 4, 2002	Cisco VPN 3000 Concentrator 2.2.x, and 3.x before 3.5.3, adds an "HTTPS on Public Inbound (XML-Auto)(forward/in)" rule but sets the protocol to "ANY" when the XML filter configuration is enabled, which ultimately allows arbitrary traffic to pass through the concentrator.
CVE-2002-1106	Cisco Systems, Inc. VPN Client	—	0.01	Oct 4, 2002	Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.5.1C, does not properly verify that certificate DN fields match those of the certificate from the VPN Concentrator, which allows remote attackers to conduct man-in-the-middle attacks.
CVE-2002-1099	Cisco Systems, Inc. VPN 3000 Concentrator Series Software	—	0.01	Oct 4, 2002	Cisco VPN 3000 Concentrator 2.2.x, and 3.x before 3.5.3, allows remote attackers to obtain potentially sensitive information without authentication by directly accessing certain HTML pages.
CVE-2002-1102	Cisco Systems, Inc. VPN 3000 Concentrator Series Software	—	0.02	Oct 4, 2002	The LAN-to-LAN IPSEC capability for Cisco VPN 3000 Concentrator 2.2.x, and 3.x before 3.5.4, allows remote attackers to cause a denial of service via an incoming LAN-to-LAN connection with an existing security association with another device on the remote network, which causes…
CVE-2002-1024	Cisco Systems, Inc. Cisco iOS	—	0.03	Oct 4, 2002	Cisco IOS 12.0 through 12.2, when supporting SSH, allows remote attackers to cause a denial of service (CPU consumption) via a large packet that was designed to exploit the SSH CRC32 attack detection overflow (CVE-2001-0144).
CVE-2002-0880	Cisco Systems, Inc. IP Phone	—	0.01	Oct 4, 2002	Cisco IP Phone (VoIP) models 7910, 7940, and 7960 allow remote attackers to cause a denial of service (crash) via malformed packets as demonstrated by (1) "jolt", (2) "jolt2", (3) "raped", (4) "hping2", (5) "bloop", (6) "bubonic", (7) "mutant", (8) "trash", and (9) "trash2."
CVE-2002-0952	Cisco Systems, Inc. ONS15454	—	0.02	Oct 4, 2002	Cisco ONS15454 optical transport platform running ONS 3.1.0 to 3.2.0 allows remote attackers to cause a denial of service (reset) by sending IP packets with non-zero Type of Service (TOS) bits to the Timing Control Card (TCC) LAN interface.
CVE-2002-0882	Cisco Systems, Inc. IP Phone	—	0.03	Oct 4, 2002	The web server for Cisco IP Phone (VoIP) models 7910, 7940, and 7960 allows remote attackers to cause a denial of service (reset) and possibly read sensitive memory via a large integer value in (1) the stream ID of the StreamingStatistics script, or (2) the port ID of the…
CVE-2002-1104	Cisco Systems, Inc. VPN Client	—	0.02	Oct 4, 2002	Cisco Virtual Private Network (VPN) Client software 2.x.x and 3.x before 3.0.5 allows remote attackers to cause a denial of service (crash) via TCP packets with source and destination ports of 137 (NETBIOS).
CVE-2002-1103	Cisco Systems, Inc. VPN 3000 Concentrator Series Software	—	0.01	Oct 4, 2002	Cisco VPN 3000 Concentrator 2.2.x, 3.6(Rel), and 3.x before 3.5.5, allows remote attackers to cause a denial of service via (1) malformed or (2) large ISAKMP packets.
CVE-2002-1105	Cisco Systems, Inc. VPN Client	—	0.00	Oct 4, 2002	Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.5.1C, allows local users to use a utility program to obtain the group password.
CVE-2002-1100	Cisco Systems, Inc. VPN 3000 Concentrator Series Software	—	0.02	Oct 4, 2002	Cisco VPN 3000 Concentrator 2.2.x, and 3.x before 3.5.3, allows remote attackers to cause a denial of service (crash) via a long (1) username or (2) password to the HTML login interface.
CVE-2002-0954	Cisco Systems, Inc. Pix Firewall Software	—	0.01	Oct 4, 2002	The encryption algorithms for enable and passwd commands on Cisco PIX Firewall can be executed quickly due to a limited number of rounds, which make it easier for an attacker to decrypt the passwords using brute force techniques.
CVE-2002-1092	Cisco Systems, Inc. VPN 3000 Concentrator Series Software	—	0.01	Oct 4, 2002	Cisco VPN 3000 Concentrator 3.6(Rel) and earlier, and 2.x.x, when configured to use internal authentication with group accounts and without any user accounts, allows remote VPN clients to log in using PPTP or IPSEC user authentication.
CVE-2002-1097	Cisco Systems, Inc. VPN 3000 Concentrator Series Software	—	0.01	Oct 4, 2002	Cisco VPN 3000 Concentrator 2.2.x, and 3.x before 3.5.2, allows restricted administrators to obtain certificate passwords that are stored in plaintext in the HTML source code for Certificate Management pages.
CVE-2002-1096	Cisco Systems, Inc. VPN 3000 Concentrator Series Software	—	0.01	Oct 4, 2002	Cisco VPN 3000 Concentrator 2.2.x, and 3.x before 3.5.1, allows restricted administrators to obtain user passwords that are stored in plaintext in HTML source code.
CVE-2002-1107	Cisco Systems, Inc. VPN Client	—	0.02	Oct 4, 2002	Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.5.2B, does not generate sufficiently random numbers, which may make it vulnerable to certain attacks such as spoofing.
CVE-2002-1108	Cisco Systems, Inc. VPN Client	—	0.01	Oct 4, 2002	Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.6(Rel), when configured with all tunnel mode, can be forced into acknowledging a TCP packet from outside the tunnel.
CVE-2002-1095	Cisco Systems, Inc. Secure Access Control Server	—	0.01	Oct 4, 2002	Cisco VPN 3000 Concentrator before 2.5.2(F), with encryption enabled, allows remote attackers to cause a denial of service (reload) via a Windows-based PPTP client with the "No Encryption" option set.
CVE-2002-0881	Cisco Systems, Inc. Skinny Client Control Protocol Software	—	0.00	Oct 4, 2002	Cisco IP Phone (VoIP) models 7910, 7940, and 7960 use a default administrative password, which allows attackers with physical access to the phone to modify the configuration settings.
CVE-2002-1094	Cisco Systems, Inc. VPN 3000 Concentrator Series Software	—	0.02	Oct 4, 2002	Information leaks in Cisco VPN 3000 Concentrator 2.x.x and 3.x.x before 3.5.4 allow remote attackers to obtain potentially sensitive information via the (1) SSH banner, (2) FTP banner, or (3) an incorrect HTTP request.
CVE-2002-1093	Cisco Systems, Inc. VPN 3000 Concentrator Series Software	—	0.02	Oct 4, 2002	HTML interface for Cisco VPN 3000 Concentrator 2.x.x and 3.x.x before 3.0.3(B) allows remote attackers to cause a denial of service (CPU consumption) via a long URL request.
CVE-2002-0853	Cisco Systems, Inc. VPN Client	—	0.02	Sep 5, 2002	Cisco Virtual Private Network (VPN) Client 3.5.4 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a packet with a zero-length payload.
CVE-2002-0852	Cisco Systems, Inc. VPN Client	—	0.01	Sep 5, 2002	Buffer overflows in Cisco Virtual Private Network (VPN) Client 3.5.4 and earlier allows remote attackers to cause a denial of service via (1) an Internet Key Exchange (IKE) with a large Security Parameter Index (SPI) payload, or (2) an IKE packet with a large number of valid…
CVE-2002-0870	Cisco Systems, Inc. Webns	—	0.01	Sep 5, 2002	The original patch for the Cisco Content Service Switch 11000 Series authentication bypass vulnerability (CVE-2001-0622) was incomplete, which still allows remote attackers to gain additional privileges by directly requesting the web management URL instead of navigating through…
CVE-2002-0778	Cisco Systems, Inc. Content Engine	—	0.02	Aug 12, 2002	The default configuration of the proxy for Cisco Cache Engine and Content Engine allows remote attackers to use HTTPS to make TCP connections to allowed IP addresses while hiding the actual source IP.
CVE-2002-0792	Cisco Systems, Inc. Webns	—	0.03	Aug 12, 2002	The web management interface for Cisco Content Service Switch (CSS) 11000 switches allows remote attackers to cause a denial of service (soft reset) via (1) an HTTPS POST request, or (2) malformed XML data.
CVE-2002-0849	Linux iSCSI	—	0.00	Aug 12, 2002	Linux-iSCSI iSCSI implementation installs the iscsi.conf file with world-readable permissions on some operating systems, including Red Hat Linux Limbo Beta #1, which could allow local users to gain privileges by reading the cleartext CHAP password.
CVE-2002-0505	Cisco Systems, Inc. Unified Callmanager	—	0.02	Aug 12, 2002	Memory leak in the Call Telephony Integration (CTI) Framework authentication for Cisco CallManager 3.0 and 3.1 before 3.1(3) allows remote attackers to cause a denial of service (crash and reload) via a series of authentication failures, e.g. via incorrect passwords.
CVE-2002-0848	Cisco Systems, Inc. VPN 5000 Concentrator Series Software	—	0.02	Aug 12, 2002	Cisco VPN 5000 series concentrator hardware 6.0.21.0002 and earlier, and 5.2.23.0003 and earlier, when using RADIUS with a challenge type of Password Authentication Protocol (PAP) or Challenge, sends the user password in cleartext in a validation retry request, which could allow…
CVE-2002-0545	Cisco Systems, Inc. Aironet Ap340	—	0.02	Jul 3, 2002	Cisco Aironet before 11.21 with Telnet enabled allows remote attackers to cause a denial of service (reboot) via a series of login attempts with invalid usernames and passwords.
CVE-2002-0339	Cisco Systems, Inc. Cisco iOS	—	0.02	Jun 25, 2002	Cisco IOS 11.1CC through 12.2 with Cisco Express Forwarding (CEF) enabled includes portions of previous packets in the padding of a MAC level packet when the MAC packet's length is less than the IP level packet length.
CVE-2002-0241	Cisco Systems, Inc. Secure Access Control Server	—	0.02	May 29, 2002	NDSAuth.DLL in Cisco Secure Authentication Control Server (ACS) 3.0.1 does not check the Expired or Disabled state of users in the Novell Directory Services (NDS), which could allow those users to authenticate to the server.
CVE-2002-0225	Cisco Systems, Inc. tac_plus Tacacs+ daemon	—	0.00	May 16, 2002	tac_plus Tacacs+ daemon F4.0.4.alpha, originally maintained by Cisco, creates files from the accounting directive with world-readable and writable permissions, which allows local users to access and modify sensitive files.
CVE-2002-0159	Cisco Systems, Inc. Secure Access Control Server	—	0.05	Apr 22, 2002	Format string vulnerability in the administration function in Cisco Secure Access Control Server (ACS) for Windows, 2.6.x and earlier and 3.x through 3.01 (build 40), allows remote attackers to crash the CSADMIN module only (denial of service of administration function) or…
CVE-2002-0160	Cisco Systems, Inc. Secure Access Control Server	—	0.02	Apr 22, 2002	The administration function in Cisco Secure Access Control Server (ACS) for Windows, 2.6.x and earlier and 3.x through 3.01 (build 40), allows remote attackers to read HTML, Java class, and image files outside the web root via a ..\.. (modified ..) in the URL to port 2002.
CVE-2002-1597	Cisco Systems, Inc. Sn 5420 Storage Router	—	0.03	Jan 9, 2002	Cisco SN 5420 Storage Router 1.1(5) and earlier allows remote attackers to cause a denial of service (halt) via a fragmented packet to the Gigabit interface.
CVE-2002-1596	Cisco Systems, Inc. Sn 5420 Storage Router	—	0.02	Jan 9, 2002	Cisco SN 5420 Storage Router 1.1(5) and earlier allows remote attackers to cause a denial of service (router crash) via an HTTP request with large headers.

CVE-2002-1768Dec 31, 2002
Cisco Systems, Inc.
Cisco iOS
risk 0.00cvss —epss 0.02
Cisco IOS 11.1 through 12.2, when HSRP support is not enabled, allows remote attackers to cause a denial of service (CPU consumption) via randomly sized UDP packets to the Hot Standby Routing Protocol (HSRP) port 1985.
CVE-2002-2037Dec 31, 2002
Cisco Systems, Inc.
Bams
risk 0.00cvss —epss 0.01
The Cisco Media Gateway Controller (MGC) in (1) SC2200 7.4 and earlier, (2) VSC3000 9.1 and earlier, (3) PGW 2200 9.1 and earlier, (4) Billing and Management Server (BAMS) and (5) Voice Services Provisioning Tool (VSPT) runs on default installations of Solaris 2.6 with…
CVE-2002-2239Dec 31, 2002
Cisco Systems, Inc.
Cisco iOS
risk 0.00cvss —epss 0.02
The Cisco Optical Service Module (OSM) for the Catalyst 6500 and 7600 series running Cisco IOS 12.1(8)E through 12.1(13.4)E allows remote attackers to cause a denial of service (hang) via a malformed packet.
CVE-2002-2316Dec 31, 2002
Cisco Systems, Inc.
Catos
risk 0.00cvss —epss 0.01
Cisco Catalyst 4000 series switches running CatOS 5.5.5, 6.3.5, and 7.1.2 do not always learn MAC addresses from a single initial packet, which causes unicast traffic to be broadcast across the switch and allows remote attackers to obtain sensitive network information by…
CVE-2002-2052Dec 31, 2002
Cisco Systems, Inc.
Cisco iOS
risk 0.00cvss —epss 0.02
Cisco 2611 router running IOS 12.1(6.5), possibly an interim release, allows remote attackers to cause a denial of service via port scans such as (1) scanning all ports on a single host and (2) scanning a network of hosts for a single open port through the router. NOTE: the…
CVE-2002-2139Dec 31, 2002
Cisco Systems, Inc.
Pix Firewall Software
risk 0.00cvss —epss 0.01
Cisco PIX Firewall 6.0.3 and earlier, and 6.1.x to 6.1.3, do not delete the duplicate ISAKMP SAs for a user's VPN session, which allows local users to hijack a session via a man-in-the-middle attack.
CVE-2002-2140Dec 31, 2002
Cisco Systems, Inc.
Pix Firewall Software
risk 0.00cvss —epss 0.02
Buffer overflow in Cisco PIX Firewall 5.2.x to 5.2.8, 6.0.x to 6.0.3, 6.1.x to 6.1.3, and 6.2.x to 6.2.1 allows remote attackers to cause a denial of service via HTTP traffic authentication using (1) TACACS+ or (2) RADIUS.
CVE-2002-2208Dec 31, 2002
Extended Interior Gateway Routing Protocol
Extended Interior Gateway Routing Protocol
risk 0.00cvss —epss 0.04
Extended Interior Gateway Routing Protocol (EIGRP), as implemented in Cisco IOS 11.3 through 12.2 and other products, allows remote attackers to cause a denial of service (flood) by sending a large number of spoofed EIGRP neighbor announcements, which results in an ARP storm on…
CVE-2002-1358Dec 23, 2002
Cisco Systems, Inc.
Cisco iOS
risk 0.00cvss —epss 0.06
Multiple SSH2 servers and clients do not properly handle lists with empty elements or strings, which may allow remote attackers to cause a denial of service or possibly execute arbitrary code, as demonstrated by the SSHredder SSH protocol test suite.
CVE-2002-1360Dec 23, 2002
Cisco Systems, Inc.
Cisco iOS
risk 0.00cvss —epss 0.06
Multiple SSH2 servers and clients do not properly handle strings with null characters in them when the string length is specified by a length field, which could allow remote attackers to cause a denial of service or possibly execute arbitrary code due to interactions with the…
CVE-2002-1190Oct 28, 2002
Cisco Systems, Inc.
Unity
risk 0.00cvss —epss 0.02
Cisco Unity 2.x and 3.x uses well-known default user accounts, which could allow remote attackers to gain access and place arbitrary calls.
CVE-2002-1189Oct 11, 2002
Cisco Systems, Inc.
Unity
risk 0.00cvss —epss 0.00
The default configuration of Cisco Unity 2.x and 3.x does not block international operator calls in the predefined restriction tables, which could allow authenticated users to place international calls using call forwarding.
CVE-2002-1098Oct 4, 2002
Cisco Systems, Inc.
VPN 3000 Concentrator Series Software
risk 0.00cvss —epss 0.01
Cisco VPN 3000 Concentrator 2.2.x, and 3.x before 3.5.3, adds an "HTTPS on Public Inbound (XML-Auto)(forward/in)" rule but sets the protocol to "ANY" when the XML filter configuration is enabled, which ultimately allows arbitrary traffic to pass through the concentrator.
CVE-2002-1106Oct 4, 2002
Cisco Systems, Inc.
VPN Client
risk 0.00cvss —epss 0.01
Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.5.1C, does not properly verify that certificate DN fields match those of the certificate from the VPN Concentrator, which allows remote attackers to conduct man-in-the-middle attacks.
CVE-2002-1099Oct 4, 2002
Cisco Systems, Inc.
VPN 3000 Concentrator Series Software
risk 0.00cvss —epss 0.01
Cisco VPN 3000 Concentrator 2.2.x, and 3.x before 3.5.3, allows remote attackers to obtain potentially sensitive information without authentication by directly accessing certain HTML pages.
CVE-2002-1102Oct 4, 2002
Cisco Systems, Inc.
VPN 3000 Concentrator Series Software
risk 0.00cvss —epss 0.02
The LAN-to-LAN IPSEC capability for Cisco VPN 3000 Concentrator 2.2.x, and 3.x before 3.5.4, allows remote attackers to cause a denial of service via an incoming LAN-to-LAN connection with an existing security association with another device on the remote network, which causes…
CVE-2002-1024Oct 4, 2002
Cisco Systems, Inc.
Cisco iOS
risk 0.00cvss —epss 0.03
Cisco IOS 12.0 through 12.2, when supporting SSH, allows remote attackers to cause a denial of service (CPU consumption) via a large packet that was designed to exploit the SSH CRC32 attack detection overflow (CVE-2001-0144).
CVE-2002-0880Oct 4, 2002
Cisco Systems, Inc.
IP Phone
risk 0.00cvss —epss 0.01
Cisco IP Phone (VoIP) models 7910, 7940, and 7960 allow remote attackers to cause a denial of service (crash) via malformed packets as demonstrated by (1) "jolt", (2) "jolt2", (3) "raped", (4) "hping2", (5) "bloop", (6) "bubonic", (7) "mutant", (8) "trash", and (9) "trash2."
CVE-2002-0952Oct 4, 2002
Cisco Systems, Inc.
ONS15454
risk 0.00cvss —epss 0.02
Cisco ONS15454 optical transport platform running ONS 3.1.0 to 3.2.0 allows remote attackers to cause a denial of service (reset) by sending IP packets with non-zero Type of Service (TOS) bits to the Timing Control Card (TCC) LAN interface.
CVE-2002-0882Oct 4, 2002
Cisco Systems, Inc.
IP Phone
risk 0.00cvss —epss 0.03
The web server for Cisco IP Phone (VoIP) models 7910, 7940, and 7960 allows remote attackers to cause a denial of service (reset) and possibly read sensitive memory via a large integer value in (1) the stream ID of the StreamingStatistics script, or (2) the port ID of the…
CVE-2002-1104Oct 4, 2002
Cisco Systems, Inc.
VPN Client
risk 0.00cvss —epss 0.02
Cisco Virtual Private Network (VPN) Client software 2.x.x and 3.x before 3.0.5 allows remote attackers to cause a denial of service (crash) via TCP packets with source and destination ports of 137 (NETBIOS).
CVE-2002-1103Oct 4, 2002
Cisco Systems, Inc.
VPN 3000 Concentrator Series Software
risk 0.00cvss —epss 0.01
Cisco VPN 3000 Concentrator 2.2.x, 3.6(Rel), and 3.x before 3.5.5, allows remote attackers to cause a denial of service via (1) malformed or (2) large ISAKMP packets.
CVE-2002-1105Oct 4, 2002
Cisco Systems, Inc.
VPN Client
risk 0.00cvss —epss 0.00
Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.5.1C, allows local users to use a utility program to obtain the group password.
CVE-2002-1100Oct 4, 2002
Cisco Systems, Inc.
VPN 3000 Concentrator Series Software
risk 0.00cvss —epss 0.02
Cisco VPN 3000 Concentrator 2.2.x, and 3.x before 3.5.3, allows remote attackers to cause a denial of service (crash) via a long (1) username or (2) password to the HTML login interface.
CVE-2002-0954Oct 4, 2002
Cisco Systems, Inc.
Pix Firewall Software
risk 0.00cvss —epss 0.01
The encryption algorithms for enable and passwd commands on Cisco PIX Firewall can be executed quickly due to a limited number of rounds, which make it easier for an attacker to decrypt the passwords using brute force techniques.
CVE-2002-1092Oct 4, 2002
Cisco Systems, Inc.
VPN 3000 Concentrator Series Software
risk 0.00cvss —epss 0.01
Cisco VPN 3000 Concentrator 3.6(Rel) and earlier, and 2.x.x, when configured to use internal authentication with group accounts and without any user accounts, allows remote VPN clients to log in using PPTP or IPSEC user authentication.
CVE-2002-1097Oct 4, 2002
Cisco Systems, Inc.
VPN 3000 Concentrator Series Software
risk 0.00cvss —epss 0.01
Cisco VPN 3000 Concentrator 2.2.x, and 3.x before 3.5.2, allows restricted administrators to obtain certificate passwords that are stored in plaintext in the HTML source code for Certificate Management pages.
CVE-2002-1096Oct 4, 2002
Cisco Systems, Inc.
VPN 3000 Concentrator Series Software
risk 0.00cvss —epss 0.01
Cisco VPN 3000 Concentrator 2.2.x, and 3.x before 3.5.1, allows restricted administrators to obtain user passwords that are stored in plaintext in HTML source code.
CVE-2002-1107Oct 4, 2002
Cisco Systems, Inc.
VPN Client
risk 0.00cvss —epss 0.02
Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.5.2B, does not generate sufficiently random numbers, which may make it vulnerable to certain attacks such as spoofing.
CVE-2002-1108Oct 4, 2002
Cisco Systems, Inc.
VPN Client
risk 0.00cvss —epss 0.01
Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.6(Rel), when configured with all tunnel mode, can be forced into acknowledging a TCP packet from outside the tunnel.
CVE-2002-1095Oct 4, 2002
Cisco Systems, Inc.
Secure Access Control Server
risk 0.00cvss —epss 0.01
Cisco VPN 3000 Concentrator before 2.5.2(F), with encryption enabled, allows remote attackers to cause a denial of service (reload) via a Windows-based PPTP client with the "No Encryption" option set.
CVE-2002-0881Oct 4, 2002
Cisco Systems, Inc.
Skinny Client Control Protocol Software
risk 0.00cvss —epss 0.00
Cisco IP Phone (VoIP) models 7910, 7940, and 7960 use a default administrative password, which allows attackers with physical access to the phone to modify the configuration settings.
CVE-2002-1094Oct 4, 2002
Cisco Systems, Inc.
VPN 3000 Concentrator Series Software
risk 0.00cvss —epss 0.02
Information leaks in Cisco VPN 3000 Concentrator 2.x.x and 3.x.x before 3.5.4 allow remote attackers to obtain potentially sensitive information via the (1) SSH banner, (2) FTP banner, or (3) an incorrect HTTP request.
CVE-2002-1093Oct 4, 2002
Cisco Systems, Inc.
VPN 3000 Concentrator Series Software
risk 0.00cvss —epss 0.02
HTML interface for Cisco VPN 3000 Concentrator 2.x.x and 3.x.x before 3.0.3(B) allows remote attackers to cause a denial of service (CPU consumption) via a long URL request.
CVE-2002-0853Sep 5, 2002
Cisco Systems, Inc.
VPN Client
risk 0.00cvss —epss 0.02
Cisco Virtual Private Network (VPN) Client 3.5.4 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a packet with a zero-length payload.
CVE-2002-0852Sep 5, 2002
Cisco Systems, Inc.
VPN Client
risk 0.00cvss —epss 0.01
Buffer overflows in Cisco Virtual Private Network (VPN) Client 3.5.4 and earlier allows remote attackers to cause a denial of service via (1) an Internet Key Exchange (IKE) with a large Security Parameter Index (SPI) payload, or (2) an IKE packet with a large number of valid…
CVE-2002-0870Sep 5, 2002
Cisco Systems, Inc.
Webns
risk 0.00cvss —epss 0.01
The original patch for the Cisco Content Service Switch 11000 Series authentication bypass vulnerability (CVE-2001-0622) was incomplete, which still allows remote attackers to gain additional privileges by directly requesting the web management URL instead of navigating through…
CVE-2002-0778Aug 12, 2002
Cisco Systems, Inc.
Content Engine
risk 0.00cvss —epss 0.02
The default configuration of the proxy for Cisco Cache Engine and Content Engine allows remote attackers to use HTTPS to make TCP connections to allowed IP addresses while hiding the actual source IP.
CVE-2002-0792Aug 12, 2002
Cisco Systems, Inc.
Webns
risk 0.00cvss —epss 0.03
The web management interface for Cisco Content Service Switch (CSS) 11000 switches allows remote attackers to cause a denial of service (soft reset) via (1) an HTTPS POST request, or (2) malformed XML data.
CVE-2002-0849Aug 12, 2002
Linux
iSCSI
risk 0.00cvss —epss 0.00
Linux-iSCSI iSCSI implementation installs the iscsi.conf file with world-readable permissions on some operating systems, including Red Hat Linux Limbo Beta #1, which could allow local users to gain privileges by reading the cleartext CHAP password.
CVE-2002-0505Aug 12, 2002
Cisco Systems, Inc.
Unified Callmanager
risk 0.00cvss —epss 0.02
Memory leak in the Call Telephony Integration (CTI) Framework authentication for Cisco CallManager 3.0 and 3.1 before 3.1(3) allows remote attackers to cause a denial of service (crash and reload) via a series of authentication failures, e.g. via incorrect passwords.
CVE-2002-0848Aug 12, 2002
Cisco Systems, Inc.
VPN 5000 Concentrator Series Software
risk 0.00cvss —epss 0.02
Cisco VPN 5000 series concentrator hardware 6.0.21.0002 and earlier, and 5.2.23.0003 and earlier, when using RADIUS with a challenge type of Password Authentication Protocol (PAP) or Challenge, sends the user password in cleartext in a validation retry request, which could allow…
CVE-2002-0545Jul 3, 2002
Cisco Systems, Inc.
Aironet Ap340
risk 0.00cvss —epss 0.02
Cisco Aironet before 11.21 with Telnet enabled allows remote attackers to cause a denial of service (reboot) via a series of login attempts with invalid usernames and passwords.
CVE-2002-0339Jun 25, 2002
Cisco Systems, Inc.
Cisco iOS
risk 0.00cvss —epss 0.02
Cisco IOS 11.1CC through 12.2 with Cisco Express Forwarding (CEF) enabled includes portions of previous packets in the padding of a MAC level packet when the MAC packet's length is less than the IP level packet length.
CVE-2002-0241May 29, 2002
Cisco Systems, Inc.
Secure Access Control Server
risk 0.00cvss —epss 0.02
NDSAuth.DLL in Cisco Secure Authentication Control Server (ACS) 3.0.1 does not check the Expired or Disabled state of users in the Novell Directory Services (NDS), which could allow those users to authenticate to the server.
CVE-2002-0225May 16, 2002
Cisco Systems, Inc.
tac_plus Tacacs+ daemon
risk 0.00cvss —epss 0.00
tac_plus Tacacs+ daemon F4.0.4.alpha, originally maintained by Cisco, creates files from the accounting directive with world-readable and writable permissions, which allows local users to access and modify sensitive files.
CVE-2002-0159Apr 22, 2002
Cisco Systems, Inc.
Secure Access Control Server
risk 0.00cvss —epss 0.05
Format string vulnerability in the administration function in Cisco Secure Access Control Server (ACS) for Windows, 2.6.x and earlier and 3.x through 3.01 (build 40), allows remote attackers to crash the CSADMIN module only (denial of service of administration function) or…
CVE-2002-0160Apr 22, 2002
Cisco Systems, Inc.
Secure Access Control Server
risk 0.00cvss —epss 0.02
The administration function in Cisco Secure Access Control Server (ACS) for Windows, 2.6.x and earlier and 3.x through 3.01 (build 40), allows remote attackers to read HTML, Java class, and image files outside the web root via a ..\.. (modified ..) in the URL to port 2002.
CVE-2002-1597Jan 9, 2002
Cisco Systems, Inc.
Sn 5420 Storage Router
risk 0.00cvss —epss 0.03
Cisco SN 5420 Storage Router 1.1(5) and earlier allows remote attackers to cause a denial of service (halt) via a fragmented packet to the Gigabit interface.
CVE-2002-1596Jan 9, 2002
Cisco Systems, Inc.
Sn 5420 Storage Router
risk 0.00cvss —epss 0.02
Cisco SN 5420 Storage Router 1.1(5) and earlier allows remote attackers to cause a denial of service (router crash) via an HTTP request with large headers.

Page 143 of 145