Cisco
Page 43 of 69 — Cisco CVEs from a corpus of 6881, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-6408 | High | 7.5 | 2016-09-24 | Cisco Prime Home 5.2.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an ent… |
CVE-2016-6414 | High | 7.8 | 2016-09-22 | iox in Cisco IOS, possibly 15.6 and earlier, and IOS XE, possibly 3.18 and earlier, allows local users to execute arbitrary IOx Linux commands on the guest OS… |
CVE-2016-6406 | Critical | 9.8 | 2016-09-22 | Cisco IronPort AsyncOS 9.1.2-023, 9.1.2-028, 9.1.2-036, 9.7.2-046, 9.7.2-047, 9.7.2-054, 10.0.0-124, and 10.0.0-125 on Email Security Appliance (ESA) devices… |
CVE-2016-6374 | Critical | 9.8 | 2016-09-22 | Cisco Cloud Services Platform (CSP) 2100 2.0 allows remote attackers to execute arbitrary code via a crafted dnslookup command in an HTTP request, aka Bug ID C… |
CVE-2016-6373 | High | 7.2 | 2016-09-22 | The web-based GUI in Cisco Cloud Services Platform (CSP) 2100 2.0 allows remote authenticated administrators to execute arbitrary OS commands as root via craft… |
CVE-2014-2146 | Medium | 6.5 | 2016-09-22 | The Zone-Based Firewall (ZBFW) functionality in Cisco IOS, possibly 15.4 and earlier, and IOS XE, possibly 3.13 and earlier, mishandles zone checking for exist… |
CVE-2016-6415 | High | 7.5 | 2016-09-19 | The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX befor… |
CVE-2016-1483 | High | 7.5 | 2016-09-19 | Cisco WebEx Meetings Server 2.6 allows remote attackers to cause a denial of service (CPU consumption) by repeatedly accessing the account-validation component… |
CVE-2016-6405 | Medium | 6.5 | 2016-09-18 | Cisco Fog Director 1.0(0) for IOx allows remote authenticated users to bypass intended access restrictions and write to arbitrary files via the Cartridge inter… |
CVE-2016-6404 | Medium | 6.1 | 2016-09-18 | Cross-site scripting (XSS) vulnerability in the web framework in Cisco IOx Local Manager in IOS 15.5(2)T and IOS XE allows remote attackers to inject arbitrary… |
CVE-2016-6403 | Medium | 5.9 | 2016-09-18 | The Data in Motion (DMo) application in Cisco IOS 15.6(1)T and IOS XE, when the IOx feature set is enabled, allows remote attackers to cause a denial of servic… |
CVE-2016-6402 | High | 7.8 | 2016-09-18 | UCS Manager and UCS 6200 Fabric Interconnects in Cisco Unified Computing System (UCS) through 3.0(2d) allow local users to obtain OS root access via crafted CL… |
CVE-2016-1433 | Medium | 5.3 | 2016-09-18 | Cisco IOS XR 6.0 and 6.0.1 on NCS 6000 devices allows remote attackers to cause a denial of service (OSPFv3 process reload) via crafted OSPFv3 packets, aka Bug… |
CVE-2016-1482 | High | 8.1 | 2016-09-17 | Cisco WebEx Meetings Server 2.6 allows remote attackers to execute arbitrary commands by injecting these commands into an application script, aka Bug ID CSCuy8… |
CVE-2016-6407 | High | 7.5 | 2016-09-17 | Cisco AsyncOS through 9.5.0-444 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (link saturation) by making many H… |
CVE-2016-6401 | Medium | 5.3 | 2016-09-17 | Cisco Carrier Routing System (CRS) 5.1 and 5.1.4, as used in CRS Carrier Grade Services for CRS-1 and CRS-3 devices, allows remote attackers to cause a denial… |
CVE-2016-6399 | High | 7.5 | 2016-09-12 | Cisco ACE30 Application Control Engine Module through A5 3.3 and ACE 4700 Application Control Engine appliances through A5 3.3 allow remote attackers to cause… |
CVE-2016-6398 | Medium | 5.3 | 2016-09-12 | The PPTP server in Cisco IOS 15.5(3)M does not properly initialize packet buffers, which allows remote attackers to obtain sensitive information from earlier n… |
CVE-2016-6396 | Medium | 5.3 | 2016-09-12 | Cisco Firepower Management Center before 6.1 and FireSIGHT System Software before 6.1, when certain malware blocking options are enabled, allow remote attacker… |
CVE-2016-6395 | Medium | 5.4 | 2016-09-12 | Cross-site scripting (XSS) vulnerability in the web-based management interface in Cisco Firepower Management Center before 6.1 and FireSIGHT System Software be… |
CVE-2016-6394 | Critical | 9.1 | 2016-09-12 | Session fixation vulnerability in Cisco Firepower Management Center and Cisco FireSIGHT System Software through 6.1.0 allows remote attackers to hijack web ses… |
CVE-2016-6371 | High | 7.5 | 2016-09-12 | Directory traversal vulnerability in the web interface in Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) 10.6(3) and earlier allows remote attackers… |
CVE-2016-6370 | Medium | 4.3 | 2016-09-12 | Directory traversal vulnerability in the web interface in Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) 10.6(3) and earlier allows remote authentica… |
CVE-2016-6375 | Medium | 5.3 | 2016-09-12 | Cisco Wireless LAN Controller (WLC) devices before 8.0.140.0, 8.1.x and 8.2.x before 8.2.121.0, and 8.3.x before 8.3.102.0 allow remote attackers to cause a de… |
CVE-2016-1469 | High | 7.5 | 2016-09-12 | The HTTP framework on Cisco SPA300, SPA500, and SPA51x devices allows remote attackers to cause a denial of service (device outage) via a series of malformed H… |
CVE-2016-6377 | High | 8.1 | 2016-09-03 | Media Origination System Suite Software 2.6 and earlier in Cisco Virtual Media Packager (VMP) allows remote attackers to bypass authentication and make arbitra… |
CVE-2016-1464 | High | 7.8 | 2016-09-03 | Cisco WebEx Meetings Player T29.10, when WRF file support is enabled, allows remote attackers to execute arbitrary code via a crafted file, aka Bug ID CSCva093… |
CVE-2016-1415 | Medium | 5.5 | 2016-09-03 | Cisco WebEx Meetings Player T29.10, when WRF file support is enabled, allows remote attackers to cause a denial of service (application crash) via a crafted fi… |
CVE-2016-6376 | Medium | 6.5 | 2016-09-02 | The Adaptive Wireless Intrusion Prevention System (wIPS) feature on Cisco Wireless LAN Controller (WLC) devices before 8.0.140.0, 8.1.x and 8.2.x before 8.2.12… |
CVE-2016-1473 | Critical | 9.8 | 2016-09-02 | Cisco Small Business 220 devices with firmware before 1.0.1.1 have a hardcoded SNMP community, which allows remote attackers to read or modify SNMP objects by… |
CVE-2016-1472 | High | 7.5 | 2016-09-02 | The web-based management interface on Cisco Small Business 220 devices with firmware before 1.0.1.1 allows remote attackers to cause a denial of service (inter… |
CVE-2016-1471 | Medium | 6.1 | 2016-09-02 | Cross-site scripting (XSS) vulnerability in the web-based management interface on Cisco Small Business 220 devices with firmware before 1.0.1.1 allows remote a… |
CVE-2016-1470 | High | 8.8 | 2016-09-02 | Cross-site request forgery (CSRF) vulnerability in the web-based management interface on Cisco Small Business 220 devices with firmware before 1.0.1.1 allows r… |
CVE-2016-2183 | High | 7.5 | 2016-09-01 | The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four bill… |
CVE-2016-6369 | High | 7.8 | 2016-08-25 | Cisco AnyConnect Secure Mobility Client before 4.2.05015 and 4.3.x before 4.3.02039 mishandles pathnames, which allows local users to gain privileges via a cra… |
CVE-2016-6365 | Medium | 6.1 | 2016-08-23 | Cross-site scripting (XSS) vulnerability in Cisco Firepower Management Center 4.10.3, 5.2.0, 5.3.0, 5.3.0.2, 5.3.1, and 5.4.0 allows remote attackers to inject… |
CVE-2016-6364 | High | 7.5 | 2016-08-23 | The User Data Services (UDS) API implementation in Cisco Unified Communications Manager 11.5 allows remote attackers to bypass intended access restrictions and… |
CVE-2016-6355 | High | 7.5 | 2016-08-23 | Memory leak in Cisco IOS XR 5.1.x through 5.1.3, 5.2.x through 5.2.5, and 5.3.x through 5.3.2 on ASR 9001 devices allows remote attackers to cause a denial of… |
CVE-2016-1484 | High | 7.5 | 2016-08-23 | Cisco WebEx Meetings Server 2.6 allows remote attackers to bypass intended access restrictions and obtain sensitive application information via unspecified vec… |
CVE-2016-1477 | Medium | 6.5 | 2016-08-23 | Cisco Connected Streaming Analytics 1.1.1 allows remote authenticated users to discover a notification service password by reading administrative pages, aka Bu… |
CVE-2016-6363 | Medium | 6.5 | 2016-08-22 | The rate-limit feature in the 802.11 protocol implementation on Cisco Aironet 1800, 2800, and 3800 devices with software before 8.2.121.0 and 8.3.x before 8.3… |
CVE-2016-6362 | High | 7.8 | 2016-08-22 | Cisco Aironet 1800, 2800, and 3800 devices with software before 8.2.110.0, 8.2.12x before 8.2.121.0, and 8.3.x before 8.3.102.0 allow local users to gain privi… |
CVE-2016-6361 | Medium | 6.5 | 2016-08-22 | The Aggregated MAC Protocol Data Unit (AMPDU) implementation on Cisco Aironet 1800, 2800, and 3800 devices with software before 8.2.121.0 and 8.3.x before 8.3… |
CVE-2016-6359 | Medium | 6.1 | 2016-08-22 | Cross-site scripting (XSS) vulnerability in Cisco Transport Gateway Installation Software 4.1(4.0) on Smart Call Home Transport Gateway devices allows remote a… |
CVE-2016-1485 | Medium | 6.1 | 2016-08-22 | Cross-site scripting (XSS) vulnerability in Cisco Identity Services Engine 1.3(0.876) allows remote attackers to inject arbitrary web script or HTML via crafte… |
CVE-2016-1479 | High | 7.5 | 2016-08-22 | Cisco IP Phone 8800 devices with software 11.0(1) allow remote attackers to cause a denial of service (memory corruption) via a crafted HTTP request, aka Bug I… |
CVE-2016-1476 | Medium | 5.4 | 2016-08-22 | Cross-site scripting (XSS) vulnerability on Cisco IP Phone 8800 devices with software 11.0 allows remote authenticated users to inject arbitrary web script or… |
CVE-2016-1458 | High | 8.8 | 2016-08-18 | The web-based GUI in Cisco Firepower Management Center 4.x and 5.x before 5.3.0.3, 5.3.1.x before 5.3.1.2, and 5.4.x before 5.4.0.1 and Cisco Adaptive Security… |
CVE-2016-1457 | High | 8.8 | 2016-08-18 | The web-based GUI in Cisco Firepower Management Center 4.x and 5.x before 5.3.1.2 and 5.4.x before 5.4.0.1 and Cisco Adaptive Security Appliance (ASA) Software… |
CVE-2016-1365 | High | 8.8 | 2016-08-18 | The Grapevine update process in Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) 1.0 allows remote authenticated users to execute… |
CVE-2016-6367 | High | 7.8 | 2016-08-18 | Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid… |
CVE-2016-6366 | High | 8.8 | 2016-08-18 | Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 93… |
CVE-2016-1478 | High | 7.5 | 2016-08-08 | Cisco IOS 15.5(3)S3, 15.6(1)S2, 15.6(2)S1, and 15.6(2)T1 does not properly dequeue invalid NTP packets, which allows remote attackers to cause a denial of serv… |
CVE-2016-1474 | Medium | 4.3 | 2016-08-08 | Cisco Prime Infrastructure 2.2(2) does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks… |
CVE-2016-1468 | High | 8.8 | 2016-08-08 | The administrative web interface in Cisco TelePresence Video Communication Server Expressway X8.5.2 allows remote authenticated users to execute arbitrary comm… |
CVE-2016-1466 | High | 7.5 | 2016-08-08 | Cisco Unified Communications Manager IM and Presence Service 9.1(1) SU6, 9.1(1) SU6a, 9.1(1) SU7, 10.5(2) SU2, 10.5(2) SU2a, 11.0(1) SU1, and 11.5(1) allows re… |
CVE-2016-1430 | High | 8.8 | 2016-08-08 | Cisco RV180 and RV180W devices allow remote authenticated users to execute arbitrary commands as root via a crafted HTTP request, aka Bug ID CSCuz48592. |
CVE-2016-1429 | High | 7.5 | 2016-08-08 | Directory traversal vulnerability in the web interface on Cisco RV180 and RV180W devices allows remote attackers to read arbitrary files via a crafted HTTP req… |
CVE-2015-6397 | High | 8.8 | 2016-08-08 | Cisco RV110W, RV130W, and RV215W devices have an incorrect RBAC configuration for the default account, which allows remote authenticated users to obtain root a… |
CVE-2015-6396 | High | 7.8 | 2016-08-08 | The CLI command parser on Cisco RV110W, RV130W, and RV215W devices allows local users to execute arbitrary shell commands as an administrator via crafted param… |
CVE-2016-1461 | High | 7.5 | 2016-08-01 | Cisco AsyncOS on Email Security Appliance (ESA) devices through 9.7.0-125 allows remote attackers to bypass malware detection via a crafted attachment in an e-… |
CVE-2016-1467 | Medium | 6.5 | 2016-07-28 | Cisco Videoscape Session Resource Manager (VSRM) allows remote attackers to cause a denial of service (device restart) by sending a traffic flood to upstream d… |
CVE-2016-1465 | Medium | 6.5 | 2016-07-28 | Cisco Nexus 1000v Application Virtual Switch (AVS) devices before 5.2(1)SV3(1.5i) allow remote attackers to cause a denial of service (ESXi hypervisor crash an… |
CVE-2016-1463 | High | 7.5 | 2016-07-28 | Cisco FireSIGHT System Software 5.3.0, 5.3.1, 5.4.0, 6.0, and 6.0.1 allows remote attackers to bypass Snort rules via crafted parameters in the header of an HT… |
CVE-2016-1462 | Medium | 6.1 | 2016-07-28 | Cross-site scripting (XSS) vulnerability in the web-based management interface in Cisco Prime Service Catalog (PSC) 11.0 allows remote attackers to inject arbi… |
CVE-2016-1460 | Medium | 6.5 | 2016-07-28 | Cisco Wireless LAN Controller (WLC) devices 7.4(121.0) and 8.0(0.30220.385) allow remote attackers to cause a denial of service via crafted wireless management… |
CVE-2016-1374 | High | 8.8 | 2016-07-28 | The web framework in Cisco Unified Computing System (UCS) Performance Manager 2.0.0 and earlier allows remote authenticated users to execute arbitrary commands… |
CVE-2016-1459 | Medium | 5.3 | 2016-07-17 | Cisco IOS 12.4 and 15.0 through 15.5 and IOS XE 3.13 through 3.17 allow remote authenticated users to cause a denial of service (device reload) via crafted att… |
CVE-2016-1448 | High | 8.8 | 2016-07-17 | Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Meetings Server 2.7 allows remote attackers to hijack the authentication of arbitrary users, aka… |
CVE-2016-1456 | High | 7.8 | 2016-07-15 | The CLI in Cisco IOS XR 6.x through 6.0.1 allows local users to execute arbitrary OS commands in a privileged context by leveraging unspecified container acces… |
CVE-2016-1452 | Medium | 6.5 | 2016-07-15 | Cisco ASR 5000 devices with software 18.3 through 20.0.0 allow remote attackers to make configuration changes over SNMP by leveraging knowledge of the read-wri… |
CVE-2016-1451 | Medium | 6.1 | 2016-07-15 | Cross-site scripting (XSS) vulnerability in the web-based management interface in Cisco Meeting Server (formerly Acano Conferencing Server) 1.7 through 1.9 all… |
CVE-2016-1450 | High | 7.5 | 2016-07-15 | Cisco WebEx Meetings Server 2.6 allows remote authenticated users to conduct command-injection attacks via vectors related to an upload's file type, aka Bug ID… |
CVE-2016-1449 | Medium | 6.1 | 2016-07-15 | Cross-site scripting (XSS) vulnerability in Cisco WebEx Meetings Server 2.6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, a… |
CVE-2016-1447 | Medium | 6.1 | 2016-07-15 | Cross-site scripting (XSS) vulnerability in the administrator interface in Cisco WebEx Meetings Server 2.6 allows remote attackers to inject arbitrary web scri… |
CVE-2016-1446 | High | 8.8 | 2016-07-15 | SQL injection vulnerability in Cisco WebEx Meetings Server 2.6 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka… |
CVE-2016-1426 | High | 7.5 | 2016-07-15 | Cisco IOS XR 5.x through 5.2.5 on NCS 6000 devices allows remote attackers to cause a denial of service (timer consumption and Route Processor reload) via craf… |
CVE-2016-1445 | Medium | 5.3 | 2016-07-12 | Cisco Adaptive Security Appliance (ASA) Software 8.2 through 9.4.3.3 allows remote attackers to bypass intended ICMP Echo Reply ACLs via vectors related to sub… |
CVE-2016-1444 | Medium | 6.5 | 2016-07-07 | The Mobile and Remote Access (MRA) component in Cisco TelePresence Video Communication Server (VCS) X8.1 through X8.7 and Expressway X8.1 through X8.6 mishandl… |
CVE-2016-1443 | High | 8.1 | 2016-07-07 | The virtual network stack on Cisco AMP Threat Grid Appliance devices before 2.1.1 allows remote attackers to bypass a sandbox protection mechanism, and consequ… |
CVE-2016-1442 | High | 8.8 | 2016-07-07 | The administrative web interface in Cisco Prime Infrastructure (PI) before 3.1.1 allows remote authenticated users to execute arbitrary commands via crafted fi… |
CVE-2016-1425 | Medium | 6.5 | 2016-07-03 | Cisco IOS 15.0(2)SG5, 15.1(2)SG3, 15.2(1)E, 15.3(3)S, and 15.4(1.13)S allows remote attackers to cause a denial of service (device crash) via a crafted LLDP pa… |
CVE-2016-1398 | Medium | 6.5 | 2016-07-03 | Buffer overflow in the web-based management interface on Cisco RV110W devices with firmware through 1.2.1.4, RV130W devices with firmware through 1.0.2.7, and… |
CVE-2016-1337 | High | 8.1 | 2016-07-03 | Cisco EPC3928 devices allow remote attackers to obtain sensitive configuration and credential information by making requests during the early part of the boot… |
CVE-2016-1336 | High | 7.5 | 2016-07-03 | goform/Docsis_system on Cisco EPC3928 devices allows remote attackers to cause a denial of service (device crash) via a long LanguageSelect parameter, related… |
CVE-2016-1328 | High | 7.5 | 2016-07-03 | goform/WClientMACList on Cisco EPC3928 devices allows remote attackers to cause a denial of service (device crash) via a long h_sortWireless parameter, related… |
CVE-2016-1441 | High | 8.2 | 2016-07-03 | Cisco Cloud Network Automation Provisioner (CNAP) 1.0(0) in Cisco Configuration Assistant (CCA) allows remote attackers to bypass intended filesystem and admin… |
CVE-2016-1394 | High | 8.6 | 2016-07-03 | Cisco Firepower System Software 6.0.0 through 6.1.0 has a hardcoded account, which allows remote attackers to obtain CLI access by leveraging knowledge of the… |
CVE-2016-1440 | Medium | 5.3 | 2016-07-02 | The proxy process on Cisco Web Security Appliance (WSA) devices through 9.1.0-070 allows remote attackers to cause a denial of service (CPU consumption) by est… |
CVE-2016-1416 | Critical | 9.8 | 2016-07-02 | Cisco Prime Collaboration Provisioning 10.6 SP2 (aka 10.6.0.10602) mishandles LDAP authentication, which allows remote attackers to obtain administrator privil… |
CVE-2016-1408 | High | 8.8 | 2016-07-02 | Cisco Prime Infrastructure 1.2 through 3.1 and Evolved Programmable Network Manager (EPNM) 1.2 and 2.0 allow remote authenticated users to execute arbitrary co… |
CVE-2016-1289 | Critical | 9.8 | 2016-07-02 | The API in Cisco Prime Infrastructure 1.2 through 3.0 and Evolved Programmable Network Manager (EPNM) 1.2 allows remote attackers to execute arbitrary code or… |
CVE-2016-1439 | Medium | 6.1 | 2016-06-23 | Cross-site scripting (XSS) vulnerability in the management interface in Cisco Unified Contact Center Enterprise through 10.5(2) allows remote attackers to inje… |
CVE-2016-1438 | High | 7.5 | 2016-06-23 | Cisco AsyncOS 9.7.0-125 on Email Security Appliance (ESA) devices allows remote attackers to bypass intended spam filtering via crafted executable content in a… |
CVE-2016-1437 | Medium | 6.5 | 2016-06-23 | SQL injection vulnerability in the SQL database in Cisco Prime Collaboration Deployment before 11.5.1 allows remote authenticated users to execute arbitrary SQ… |
CVE-2016-1436 | High | 7.5 | 2016-06-23 | The General Packet Radio Switching Tunneling Protocol 1 (aka GTPv1) implementation on Cisco ASR 5000 Packet Data Network Gateway devices before 19.4 allows rem… |
CVE-2016-1435 | High | 7.0 | 2016-06-23 | Cisco 8800 phones with software 11.0(1) do not properly enforce mounted-filesystem permissions, which allows local users to write to arbitrary files by leverag… |
CVE-2016-1434 | Medium | 6.5 | 2016-06-23 | The license-certificate upload functionality on Cisco 8800 phones with software 11.0(1) allows remote authenticated users to delete arbitrary files via an inva… |
CVE-2016-1428 | Medium | 6.5 | 2016-06-23 | Double free vulnerability in Cisco IOS XE 3.15S, 3.16S, and 3.17S allows remote authenticated users to cause a denial of service (device restart) via a sequenc… |
CVE-2015-6289 | High | 7.5 | 2016-06-23 | Cisco IOS 15.5(3)M on Integrated Services Router (ISR) 800, 819, and 829 devices allows remote attackers to cause a denial of service (memory consumption) via… |