Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability
A vulnerability in the remote access SSL VPN features of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
This...
Cisco BroadWorks Application Delivery Platform Software Cross-Site Scripting Vulnerability
<p>A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting attack against a user of the interface.</p>
<p>This vulnerability exists because the web-based management interface does...
Cisco Identity Services Engine Sensitive Information Disclosure Vulnerability
<p>A vulnerability in the External RESTful Services (ERS) API of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to obtain sensitive information.</p>
<p>This vulnerability is due to excessive verbosity in a specific REST API output. An attacker...
Cisco Unified Communications Manager Arbitrary File Deletion Vulnerability
<p>A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to delete arbitrary files from an affected system.</p>
<p>This vulnerability exists...
Cisco Small Business RV Series Routers Vulnerabilities
<p>Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition on an affected device.</p>
<p>For more information about these vulnerabilities,...
Cisco Webex Meetings Web Interface Vulnerabilities
<p>Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow a remote attacker to conduct a cross-site scripting (XSS) attack or a frame hijacking attack against a user of the web interface.</p>
<p>For more information about these vulnerabilities, see...
Cisco Email Security Appliance and Cisco Secure Email and Web Manager External Authentication Bypass Vulnerability
<p>A vulnerability in the external authentication functionality of Cisco Secure Email and Web Manager, formerly known as Cisco Security Management Appliance (SMA), and Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass authentication and log in to the...
Cisco Nexus Dashboard Unauthorized Access Vulnerabilities
<p>Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload container image files, or perform a cross-site request forgery attack.</p>
<p>For more information about these vulnerabilities, see the <a href="#details">Details</a> section of...
Cisco Nexus Dashboard Privilege Escalation Vulnerabilities
<p>Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device.</p>
<p>These vulnerabilities are due to insufficient input validation during CLI command execution on an affected device. An attacker could exploit these vulnerabilities...
Cisco IoT Control Center Cross-Site Scripting Vulnerability
<p>A vulnerability in the web-based management interface of Cisco IoT Control Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.</p>
<p>This vulnerability exists because the web-based management interface does not...
Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerabilities
<p>Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpectedly, resulting in...
Cisco Nexus Dashboard SSL Certificate Validation Vulnerability
<p>A vulnerability in the SSL/TLS implementation of Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to alter communications with associated controllers or view sensitive information.</p>
<p>This vulnerability exists because SSL server certificates are not validated when Cisco Nexus Dashboard is establishing...
Cisco Identity Services Engine Administrator Password Lifetime Expiration Issue
<p>An issue in the Password Policy settings of Cisco Identity Services Engine (ISE) could allow an administrator to use expired credentials to gain access to the web management interface.</p>
<p>When the Password Lifetime<strong> </strong>setting for the administrator password policy is used...
Cisco Nexus Dashboard Arbitrary File Write Vulnerability
<p>A vulnerability in Cisco Nexus Dashboard could allow an authenticated, remote attacker to write arbitrary files on an affected device.</p>
<p>This vulnerability is due to insufficient input validation in the web-based management interface of Cisco Nexus Dashboard. An attacker with <em>Administrator </em>credentials...
Cisco Identity Services Engine Authentication Bypass Vulnerability
<p>A vulnerability in the login page of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to log in without credentials and access all roles without any restrictions.</p>
<p>This vulnerability is due to exposed sensitive Security Assertion Markup Language...
Cisco Unified Communications Manager Arbitrary File Read Vulnerability
<p>A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of...
Cisco Unified Communications Products Timing Attack Vulnerability
<p>A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and <span class="more">Cisco Unity Connection</span> could allow an unauthenticated, remote attacker to perform a timing attack.</p>
<p>This vulnerability is due to insufficient protection of...
Cisco Unified Communications Products Arbitrary File Read Vulnerability
<p>A vulnerability in the database user privileges of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an authenticated, remote attacker...
Cisco Smart Software Manager On-Prem Denial of Service Vulnerability
<p>A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.</p>
<p>This vulnerability is due to incorrect handling of multiple simultaneous device registrations on...
Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities
<p>Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow a remote attacker to overwrite arbitrary files or conduct null byte poisoning attacks on an affected device.</p>
<p><strong>Note:</strong>...
Phishers who breached Twilio and fooled Cloudflare could easily get you, too
Enlarge (credit: Getty Images)
At least two security-sensitive companies—Twilio and Cloudflare—were targeted in a phishing attack by an advanced threat actor who had possession of home phone numbers of not...
Microsoft Patch Tuesday, August 2022 Edition
Microsoft today released updates to fix a record 141 security vulnerabilities in its Windows operating systems and related software. Once again, Microsoft is patching a zero-day vulnerability in the Microsoft Support Diagnostics Tool (MSDT), a service built into Windows....
One of 5G's Biggest Features Is a Security Minefield
New research found troubling vulnerabilities in the 5G platforms carriers offer to wrangle embedded device data.
Patch Tuesday: Yet another Microsoft RCE bug under active exploit
Oh, and that critical VMware auth bypass vuln? Miscreants found it, too August Patch Tuesday clicks off the week of hacker summer camp in Las Vegas this year, so it's basically a code cracker's holiday too. …
