VYPR
← Cisco Systems, Inc.

Vendor CVEs

Cisco Systems, Inc.

All CVEs

6,961 total · sorted by risk
  • CVE-2012-6007Dec 19, 2012
    Cisco Systems, Inc.
    Wireless Lan Controller Software
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in screens/base/web_auth_custom.html on Cisco Wireless LAN Controller (WLC) devices with software 7.2.110.0 allows remote authenticated users to inject arbitrary web script or HTML via the headline parameter, aka Bug ID CSCud65187, a…

  • CVE-2012-5992Dec 19, 2012
    Cisco Systems, Inc.
    Wireless Lan Controller Software
    risk 0.03cvss —epss 0.02

    Multiple cross-site request forgery (CSRF) vulnerabilities on Cisco Wireless LAN Controller (WLC) devices with software 7.2.110.0 allow remote attackers to hijack the authentication of administrators for requests that (1) add administrative accounts via…

  • CVE-2012-5991Dec 19, 2012
    Cisco Systems, Inc.
    Wireless Lan Controller Software
    risk 0.03cvss —epss 0.06

    screens/base/web_auth_custom.html on Cisco Wireless LAN Controller (WLC) devices with software 7.2.110.0 allows remote authenticated users to cause a denial of service (device reload) via a certain buttonClicked value in an internal webauth_type request, aka Bug ID CSCud50209.

  • CVE-2011-2544Sep 23, 2011
    Cisco Systems, Inc.
    Telepresence System Software
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in the web interface in Cisco TelePresence System MXP Series F9.1 and earlier allows remote authenticated users to inject arbitrary web script or HTML via a crafted Call ID, as demonstrated by resultant cross-site request forgery (CSRF)…

  • CVE-2011-0962May 20, 2011
    Cisco Systems, Inc.
    Unified Operations Manager
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in CSCOnm/servlet/com.cisco.nm.help.ServerHelpEngine in the Common Services Device Center in Cisco Unified Operations Manager (CUOM) before 8.6 allows remote attackers to inject arbitrary web script or HTML via the tag parameter, aka Bug…

  • CVE-2011-0961May 20, 2011
    Cisco Systems, Inc.
    Ciscoworks Common Services
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in cwhp/device.center.do in the Help servlet in Cisco CiscoWorks Common Services 3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the device parameter, aka Bug ID CSCto12704.

  • CVE-2011-0960May 20, 2011
    Cisco Systems, Inc.
    Unified Operations Manager
    risk 0.03cvss —epss 0.04

    Multiple SQL injection vulnerabilities in Cisco Unified Operations Manager (CUOM) before 8.6 allow remote attackers to execute arbitrary SQL commands via (1) the CCMs parameter to iptm/PRTestCreation.do or (2) the ccm parameter to iptm/TelePresenceReportAction.do, aka Bug ID…

  • CVE-2010-2025May 26, 2010
    Cisco Systems, Inc.
    Scientific Atlanta Webstar Dpc2100r2
    risk 0.03cvss —epss 0.02

    Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface on the Cisco Scientific Atlanta WebSTAR DPC2100R2 cable modem with firmware 2.0.2r1256-060303 allow remote attackers to hijack the authentication of administrators for requests that (1) reset the…

  • CVE-2010-1174Mar 29, 2010
    Cisco Systems, Inc.
    TFTP Server
    risk 0.03cvss —epss 0.05

    Cisco TFTP Server 1.1 allows remote attackers to cause a denial of service (daemon crash) via a crafted (1) read (aka RRQ) or (2) write (aka WRQ) request, or other TFTP packet. NOTE: some of these details are obtained from third party information.

  • CVE-2010-0641Feb 17, 2010
    Cisco Systems, Inc.
    Collaboration Server
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in webline/html/admin/wcs/LoginPage.jhtml in Cisco Collaboration Server (CCS) 5 allows remote attackers to inject arbitrary web script or HTML via the dest parameter.

  • CVE-2010-0440Feb 3, 2010
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in +CSCOT+/translation in Cisco Secure Desktop 3.4.2048, and other versions before 3.5; as used in Cisco ASA appliance before 8.2(1), 8.1(2.7), and 8.0(5); allows remote attackers to inject arbitrary web script or HTML via a crafted POST…

  • CVE-2009-4118Dec 1, 2009
    Cisco Systems, Inc.
    VPN Client
    risk 0.03cvss —epss 0.03

    The StartServiceCtrlDispatcher function in the cvpnd service (cvpnd.exe) in Cisco VPN client for Windows before 5.0.06.0100 does not properly handle an ERROR_FAILED_SERVICE_CONTROLLER_CONNECT error, which allows local users to cause a denial of service (service crash and VPN…

  • CVE-2009-3457Sep 29, 2009
    Cisco Systems, Inc.
    Ace Web Application Firewall
    risk 0.03cvss —epss 0.04

    Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote attackers to obtain sensitive information via an HTTP request that lacks a handler, as demonstrated by (1) an OPTIONS request or (2) a crafted GET request, leading to a Message-handling…

  • CVE-2009-1203Jun 25, 2009
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.03cvss —epss 0.04

    WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0(4), 8.1.2, and 8.2.1 does not properly distinguish its own login screen from the login screens it produces for third-party (1) FTP and (2) CIFS servers, which makes it easier for remote attackers to…

  • CVE-2009-1561May 6, 2009
    Cisco Systems, Inc.
    Wrt54gc
    risk 0.03cvss —epss 0.03

    Cross-site request forgery (CSRF) vulnerability in administration.cgi on the Cisco Linksys WRT54GC router with firmware 1.05.7 allows remote attackers to hijack the intranet connectivity of arbitrary users for requests that change the administrator password via the sysPasswd and…

  • CVE-2009-0470Feb 6, 2009
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in the HTTP server in Cisco IOS 12.4(23) allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under (1) level/15/exec/-/ or (2) exec/, a different vulnerability than CVE-2008-3821.

  • CVE-2008-3821Jan 16, 2009
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in the HTTP server in Cisco IOS 11.0 through 12.4 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to the ping program or (2) unspecified other aspects of the URI.

  • CVE-2008-5121Nov 18, 2008
    Citrix Systems
    Deterministic Network Enhancer
    risk 0.03cvss —epss 0.01

    dne2000.sys in Citrix Deterministic Network Enhancer (DNE) 2.21.7.233 through 3.21.7.17464, as used in (1) Cisco VPN Client, (2) Blue Coat WinProxy, and (3) SafeNet SoftRemote and HighAssurance Remote, allows local users to gain privileges via a crafted DNE_IOCTL DeviceIoControl…

  • CVE-2008-4609Oct 20, 2008
    Microsoft
    Windows
    risk 0.03cvss —epss 0.32

    The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate…

  • CVE-2008-0026Feb 14, 2008
    Cisco Systems, Inc.
    Unified Callmanager
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in Cisco Unified CallManager/Communications Manager (CUCM) 5.0/5.1 before 5.1(3a) and 6.0/6.1 before 6.1(1a) allows remote authenticated users to execute arbitrary SQL commands via the key parameter to the (1) admin and (2) user interface pages.

  • CVE-2008-0324Jan 17, 2008
    Cisco Systems, Inc.
    VPN Client
    risk 0.03cvss —epss 0.01

    Cisco Systems VPN Client IPSec Driver (CVPNDRVA.sys) 5.0.02.0090 allows local users to cause a denial of service (crash) by calling the 0x80002038 IOCTL with a small size value, which triggers memory corruption.

  • CVE-2007-5583Dec 18, 2007
    Cisco Systems, Inc.
    IP Phone
    risk 0.03cvss —epss 0.06

    Cisco IP Phone 7940 with firmware P0S3-08-7-00 allows remote attackers to cause a denial of service ("486 Busy" responses or device reboot) via a sequence of SIP INVITE transactions in which the Request-URI lacks a user name, a different vulnerability than CVE-2007-4459.

  • CVE-2007-6005Nov 15, 2007
    Cisco Systems, Inc.
    GpcContainer.GpcContainer.1 ActiveX control
    risk 0.03cvss —epss 0.02

    Unspecified vulnerability in the GpcContainer.GpcContainer.1 ActiveX control in WebEx allows remote attackers to cause a denial of service (memory access violation and crash) via (1) an invalid argument to the InitParam method or (2) an unspecified vector involving the SetParam…

  • CVE-2007-4634Aug 31, 2007
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.03cvss —epss 0.04

    Multiple SQL injection vulnerabilities in Cisco CallManager and Unified Communications Manager (CUCM) before 3.3(5)sr2b, 4.1 before 4.1(3)sr5, 4.2 before 4.2(3)sr2, and 4.3 before 4.3(1)sr1 allow remote attackers to execute arbitrary SQL commands via the lang variable to the (1)…

  • CVE-2007-3574Jul 5, 2007
    Linksys
    Wag54gs
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in setup.cgi on the Cisco Linksys WAG54GS Wireless-G ADSL Gateway with 1.00.06 firmware allow remote attackers to inject arbitrary web script or HTML via the (1) c4_trap_ip_, (2) devname, (3) snmp_getcomm, or (4) snmp_setcomm…

  • CVE-2006-3734Jul 21, 2006
    Cisco Systems, Inc.
    Cs Mars
    risk 0.03cvss —epss 0.03

    Multiple unspecified vulnerabilities in the Command Line Interface (CLI) for Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.2.1, allow local CS-MARS administrators to execute arbitrary commands as root.

  • CVE-2006-2369May 15, 2006
    Realvnc
    Realvnc
    risk 0.03cvss —epss 0.92

    RealVNC 4.1.1, and other products that use RealVNC such as AdderLink IP and Cisco CallManager, allows remote attackers to bypass authentication via a request in which the client specifies an insecure security type such as "Type 1 - None", which is accepted even if it is not…

  • CVE-2006-1960Apr 21, 2006
    Cisco Systems, Inc.
    Wireless Lan Solution Engine
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in the appliance web user interface in Cisco CiscoWorks Wireless LAN Solution Engine (WLSE) and WLSE Express before 2.13 allows remote attackers to inject arbitrary web script or HTML, possibly via the displayMsg parameter to…

  • CVE-2005-2242Jul 12, 2005
    Cisco Systems, Inc.
    Unified Callmanager
    risk 0.03cvss —epss 0.04

    Cisco CallManager (CCM) 3.2 and earlier, 3.3 before 3.3(5), 4.0 before 4.0(2a)SR2b, and 4.1 4.1 before 4.1(3)SR1 allows remote attackers to cause a denial of service (memory consumption and restart) via crafted packets to (1) the CTI Manager (ctimgr.exe) or (2) the CallManager…

  • CVE-2004-0244Nov 23, 2004
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.03cvss —epss 0.01

    Cisco 6000, 6500, and 7600 series systems with Multilayer Switch Feature Card 2 (MSFC2) and a FlexWAN or OSM module allow local users to cause a denial of service (hang or reset) by sending a layer 2 frame packet that encapsulates a layer 3 packet, but has inconsistent length…

  • CVE-2003-0647Aug 27, 2003
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.03cvss —epss 0.06

    Buffer overflow in the HTTP server for Cisco IOS 12.2 and earlier allows remote attackers to execute arbitrary code via an extremely long (2GB) HTTP GET request.

  • CVE-2002-1492Apr 2, 2003
    Cisco Systems, Inc.
    VPN 5000 Client
    risk 0.03cvss —epss 0.02

    Buffer overflows in the Cisco VPN 5000 Client before 5.2.7 for Linux, and VPN 5000 Client before 5.2.8 for Solaris, allow local users to gain root privileges via (1) close_tunnel and (2) open_tunnel.

  • CVE-2002-2379Dec 31, 2002
    Cisco Systems, Inc.
    As5350
    risk 0.03cvss —epss 0.06

    Cisco AS5350 IOS 12.2(11)T with access control lists (ACLs) applied and possibly with ssh running allows remote attackers to cause a denial of service (crash) via a port scan, possibly due to an ssh bug. NOTE: this issue could not be reproduced by the vendor

  • CVE-2002-0886Oct 4, 2002
    Cisco Systems, Inc.
    Cbos
    risk 0.03cvss —epss 0.05

    Cisco DSL CPE devices running CBOS 2.4.4 and earlier allows remote attackers to cause a denial of service (hang or memory consumption) via (1) a large packet to the DHCP port, (2) a large packet to the Telnet port, or (3) a flood of large packets to the CPE, which causes the…

  • CVE-2002-1101Oct 4, 2002
    Cisco Systems, Inc.
    VPN 3000 Concentrator Series Software
    risk 0.03cvss —epss 0.03

    Cisco VPN 3000 Concentrator 2.2.x, 3.6(Rel), and 3.x before 3.5.5, allows remote attackers to cause a denial of service via a long user name.

  • CVE-2002-0908Oct 4, 2002
    Cisco Systems, Inc.
    Ids Device Manager
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in the web server for Cisco IDS Device Manager before 3.1.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the HTTPS request.

  • CVE-2002-0938Oct 4, 2002
    Cisco Systems, Inc.
    Ciscosecure
    risk 0.03cvss —epss 0.03

    Cross-site scripting vulnerability in CiscoSecure ACS 3.0 allows remote attackers to execute arbitrary script or HTML as other web users via the action argument in a link to setup.exe.

  • CVE-2002-1447May 28, 2002
    Cisco Systems, Inc.
    VPN Client
    risk 0.03cvss —epss 0.01

    Buffer overflow in the vpnclient program for UNIX VPN Client before 3.5.2 allows local users to gain administrative privileges via a long profile name in a connect argument.

  • CVE-2001-0669Oct 30, 2001
    Snort
    Snort
    risk 0.03cvss —epss 0.04

    Various Intrusion Detection Systems (IDS) including (1) Cisco Secure Intrusion Detection System, (2) Cisco Catalyst 6000 Intrusion Detection System Module, (3) Dragon Sensor 4.x, (4) Snort before 1.8.1, (5) ISS RealSecure Network Sensor 5.x and 6.x before XPU 3.2, and (6) ISS…

  • CVE-2001-0751Oct 18, 2001
    Cisco Systems, Inc.
    Cbos
    risk 0.03cvss —epss 0.03

    Cisco switches and routers running CBOS 2.3.8 and earlier use predictable TCP Initial Sequence Numbers (ISN), which allows remote attackers to spoof or hijack TCP connections.

  • CVE-2001-0741Oct 18, 2001
    Cisco Systems, Inc.
    Hsrp
    risk 0.03cvss —epss 0.01

    Cisco Hot Standby Routing Protocol (HSRP) allows local attackers to cause a denial of service by spoofing HSRP packets.

  • CVE-2001-1064Aug 31, 2001
    Cisco Systems, Inc.
    Cbos
    risk 0.03cvss —epss 0.05

    Cisco 600 series routers running CBOS 2.0.1 through 2.4.2ap allows remote attackers to cause a denial of service via multiple connections to the router on the (1) HTTP or (2) telnet service, which causes the router to become unresponsive and stop forwarding packets.

  • CVE-2001-0711Aug 31, 2001
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.03cvss —epss 0.03

    Cisco IOS 11.x and 12.0 with ATM support allows attackers to cause a denial of service via the undocumented Interim Local Management Interface (ILMI) SNMP community string.

  • CVE-2001-1097Jul 24, 2001
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.03cvss —epss 0.04

    Cisco routers and switches running IOS 12.0 through 12.2.1 allows a remote attacker to cause a denial of service via a flood of UDP packets.

  • CVE-2001-0288May 3, 2001
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.03cvss —epss 0.05

    Cisco switches and routers running IOS 12.1 and earlier produce predictable TCP Initial Sequence Numbers (ISNs), which allows remote attackers to spoof or hijack TCP connections.

  • CVE-2001-0163Jan 1, 2001
    Cisco Systems, Inc.
    AP340 base station
    risk 0.03cvss —epss 0.03

    Cisco AP340 base station produces predictable TCP Initial Sequence Numbers (ISNs), which allows remote attackers to spoof or hijack TCP connections.

  • CVE-2000-0984Dec 19, 2000
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.03cvss —epss 0.04

    The HTTP server in Cisco IOS 12.0 through 12.1 allows local users to cause a denial of service (crash and reload) via a URL containing a "?/" string.

  • CVE-2000-0955Dec 19, 2000
    Cisco Systems, Inc.
    Virtual Central Office 4000
    risk 0.03cvss —epss 0.02

    Cisco Virtual Central Office 4000 (VCO/4K) uses weak encryption to store usernames and passwords in the SNMP MIB, which allows an attacker who knows the community name to crack the password and gain privileges.

  • CVE-2000-1027Dec 11, 2000
    Cisco Systems, Inc.
    Secure Pix Firewall
    risk 0.03cvss —epss 0.04

    Cisco Secure PIX Firewall 5.2(2) allows remote attackers to determine the real IP address of a target FTP server by flooding the server with PASV requests, which includes the real IP address in the response when passive mode is established.

  • CVE-2000-0559Jun 7, 2000
    Broadcom Corporation
    Etrust Intrusion Detection
    risk 0.03cvss —epss 0.01

    eTrust Intrusion Detection System (formerly SessionWall-3) uses weak encryption (XOR) to store administrative passwords in the registry, which allows local users to easily decrypt the passwords.

Page 93 of 140