Vulnerabilities > Cisco > Medium

DATE CVE VULNERABILITY TITLE RISK
2014-06-25 CVE-2014-3299 Improper Input Validation vulnerability in Cisco IOS
Cisco IOS allows remote authenticated users to cause a denial of service (device reload) via malformed IPsec packets, aka Bug ID CSCui79745.
network
low complexity
cisco CWE-20
6.8
2014-06-21 CVE-2014-3296 Information Exposure vulnerability in Cisco Webex Meetings Server
The XML programmatic interface (XML PI) in Cisco WebEx Meeting Server 1.5(.1.131) and earlier allows remote authenticated users to obtain sensitive meeting information via a crafted URL, aka Bug ID CSCum03527.
network
low complexity
cisco CWE-200
4.0
2014-06-18 CVE-2014-2151 Unspecified vulnerability in Cisco Adaptive Security Appliance Software
The WebVPN portal in Cisco Adaptive Security Appliance (ASA) Software 8.4(.7.15) and earlier allows remote authenticated users to obtain sensitive information via a crafted JavaScript file, aka Bug ID CSCui04520.
network
low complexity
cisco
4.0
2014-06-14 CVE-2014-3290 Permissions, Privileges, and Access Controls vulnerability in Cisco IOS XE 3.12S
The mDNS implementation in Cisco IOS XE 3.12S does not properly interact with autonomic networking, which allows remote attackers to obtain sensitive networking-services information by sniffing the network or overwrite networking-services data via a crafted mDNS response, aka Bug ID CSCun64867.
low complexity
cisco CWE-264
4.8
2014-06-14 CVE-2014-3295 Improper Authentication vulnerability in Cisco Nx-Os
The HSRP implementation in Cisco NX-OS 6.2(2a) and earlier allows remote attackers to bypass authentication and cause a denial of service (group-member state modification and traffic blackholing) via malformed HSRP packets, aka Bug ID CSCup11309.
low complexity
cisco CWE-287
4.8
2014-06-10 CVE-2014-3294 Permissions, Privileges, and Access Controls vulnerability in Cisco Webex Meetings Server
Cisco WebEx Meeting Server does not properly restrict the content of URLs, which allows remote authenticated users to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history, aka Bug ID CSCuj81691.
network
low complexity
cisco CWE-264
4.0
2014-06-10 CVE-2014-3292 Improper Input Validation vulnerability in Cisco Unified Communications Manager
The Real Time Monitoring Tool (RTMT) implementation in Cisco Unified Communications Manager (Unified CM) allows remote authenticated users to (1) read or (2) delete arbitrary files via a crafted URL, aka Bug IDs CSCuo17302 and CSCuo17199.
network
low complexity
cisco CWE-20
5.5
2014-06-10 CVE-2014-3289 Cross-Site Scripting vulnerability in Cisco products
Cross-site scripting (XSS) vulnerability in the web management interface in Cisco AsyncOS on the Email Security Appliance (ESA) 8.0, Web Security Appliance (WSA) 8.0 (.5 Hot Patch 1) and earlier, and Content Security Management Appliance (SMA) 8.3 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, as demonstrated by the date_range parameter to monitor/reports/overview on the IronPort ESA, aka Bug IDs CSCun07998, CSCun07844, and CSCun07888.
network
cisco CWE-79
4.3
2014-06-10 CVE-2014-3287 SQL Injection vulnerability in Cisco Unified Communications Manager
SQL injection vulnerability in BulkViewFileContentsAction.java in the Java interface in Cisco Unified Communications Manager (Unified CM) allows remote authenticated users to execute arbitrary SQL commands via crafted filename parameters in a URL, aka Bug ID CSCuo17337.
network
low complexity
cisco CWE-89
4.0
2014-06-08 CVE-2014-3291 Improper Input Validation vulnerability in Cisco Wireless LAN Controller
Cisco Wireless LAN Controller (WLC) devices allow remote attackers to cause a denial of service (NULL pointer dereference and device restart) via a zero value in Cisco Discovery Protocol packet data that is not properly handled during SNMP polling, aka Bug ID CSCuo12321.
5.7