Cisco Webex Network Recording Players Denial of Service Vulnerabilities
Multiple vulnerabilities exist in the Cisco Webex Network Recording Player for Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit these vulnerabilities by providing a user with a malicious .arf or .wrf file via...
Cisco Policy Suite Policy Builder Database Unauthenticated Access Vulnerability
A vulnerability in the Policy Builder database of Cisco Policy Suite could allow an unauthenticated, remote attacker to connect directly to the Policy Builder database.
The vulnerability is due to a lack of authentication. An attacker could exploit this vulnerability...
Cisco SD-WAN Solution Local Buffer Overflow Vulnerability
A vulnerability in the configuration and monitoring service of the Cisco SD-WAN Solution could allow an authenticated, local attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device.
The vulnerability is due...
Cisco Cloud Services Platform 2100 Web Upload Function Code Injection Vulnerability
A vulnerability in the web upload function of Cisco Cloud Services Platform 2100 could allow an authenticated, remote attacker to obtain restricted shell access on an affected system.
The vulnerability is due to insufficient input validation of parameters passed to...
Cisco Webex Network Recording Players Remote Code Execution Vulnerabilities
Multiple vulnerabilities exist in the Cisco Webex Network Recording Player for Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit these vulnerabilities by providing a user with a malicious .arf or .wrf file via...
Cisco Policy Suite World-Readable Sensitive Data Vulnerability
A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by another user.
The vulnerability is due to insufficient access control permissions. An attacker could exploit this vulnerability by logging in...
Cisco Webex DOM-Based Cross-Site Scripting Vulnerability
A vulnerability in the web framework of Cisco Webex could allow an unauthenticated, remote attacker to conduct a Document Object Model-based (DOM-based) cross-site scripting (XSS) attack against the user of the web interface of an affected system.
The vulnerability is...
Cisco SD-WAN Solution VPN Subsystem Command Injection Vulnerability
A vulnerability in the VPN subsystem configuration in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges.
The vulnerability is due to insufficient input validation. An attacker could exploit...
Multiple Vulnerabilities in Cisco Unified Contact Center Express
Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface, conduct a cross-site request forgery (CSRF)...
Cisco Nexus 9000 Series Fabric Switches Application-Centric Infrastructure Mode DHCP Version 6 Denial of Service Vulnerability
A vulnerability in the DHCPv6 feature of the Cisco Nexus 9000 Series Fabric Switches in Application-Centric Infrastructure (ACI) Mode could allow an unauthenticated, remote attacker to cause the device to run low on system memory, which could result in a Denial...
Cisco Policy Suite Policy Builder Unauthenticated Access Vulnerability
A vulnerability in the Policy Builder interface of Cisco Policy Suite could allow an unauthenticated, remote attacker to access the Policy Builder interface.
The vulnerability is due to a lack of authentication. An attacker could exploit this vulnerability by accessing...
Cisco SD-WAN Solution Arbitrary File Overwrite Vulnerability
A vulnerability in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to overwrite arbitrary files on the underlying operating system of an affected device.
The vulnerability is due to improper input validation of the request admin-tech command in the...
Cisco SD-WAN Solution Zero Touch Provisioning Denial of Service Vulnerability
A vulnerability in the Zero Touch Provisioning service of the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
The vulnerability is due to incorrect bounds checks for certain values...
Cisco SD-WAN Solution Configuration and Management Database Remote Code Execution Vulnerability
A vulnerability in the configuration and management database of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to execute arbitrary commands with the privileges of the vmanage user in the configuration management system of the affected software.
The...
Multiple Vulnerabilities in Cisco Finesse
Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a server-side request forgery (SSRF) attack or retrieve a cleartext password from an affected system.
For more information about these vulnerabilities, see the Details...
Cisco SD-WAN Solution Command Injection Vulnerability
A vulnerability in the vManage dashboard for the configuration and management service of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject and execute arbitrary commands with vmanage user privileges on an affected system.
The vulnerability is due...
Cisco Policy Suite OSGi Interface Unauthenticated Access Vulnerability
A vulnerability in the Open Systems Gateway initiative (OSGi) interface of Cisco Policy Suite could allow an unauthenticated, remote attacker to directly connect to the OSGi interface.
The vulnerability is due to a lack of authentication. An attacker could exploit...
Cisco SD-WAN Solution Zero Touch Provisioning Command Injection Vulnerability
A vulnerability in the Zero Touch Provisioning (ZTP) subsystem of the Cisco SD-WAN Solution could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges.
The vulnerability is due to insufficient input validation. An attacker...
Cisco Webex Teams Remote Code Execution Vulnerability
A vulnerability in Cisco Webex Teams could allow an unauthenticated, remote attacker to execute arbitrary code on the user’s device, possibly with elevated privileges.
The vulnerability occurs because Cisco Webex Teams does not properly sanitize input. An attacker could exploit...
Cisco SD-WAN Solution CLI Command Injection Vulnerability
A vulnerability in the CLI of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges.
The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability...
Privacy Advocates Say Kelsey Smith Act Gives Police Too Much Power
This bill making its way through Congress would allow law enforcement to more easily uncover location data for cell phones from mobile carriers in an emergency.
Financial Industry Insiders Put the Keys to the Kingdom at Risk
Monitoring for Illicit Insider Activity Shouldn’t Focus Exclusively on Dark Web and Criminal Forums
read more
Trends in malware – ransomware, cryptojacking, what next? [PODCAST]
Catch up with Day 3 of our Security SOS Week - here's the third episode of our week-long online security summit.
Microsoft offers up to $100,000 to identity bug finders
Want to earn $100,000? You could win as much as that if you manage to uncover a serious vulnerability in Microsoft’s various identity services.
Read more in my article on the Hot for Security blog.
Automated money-laundering scheme found in free-to-play games
The scammers automatically created iOS accounts with valid email accounts, then automatically used stolen cards to buy and resell stuff.
