CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2010-4686
https://notcve.org/view.php?id=CVE-2010-4686
CallManager Express (CME) on Cisco IOS before 15.0(1)XA1 does not properly handle SIP TRUNK traffic that contains rate bursts and a "peculiar" request size, which allows remote attackers to cause a denial of service (memory consumption) by sending this traffic over a long duration, aka Bug ID CSCtb47950. CallManager Express (CME) en Cisco IOS anteriores a v15.0(1)XA1 no maneja adecuadamente el tráfico SIP TRUNK que contiene las ráfagas y una tamaño de petición "peculiar", que permite a atacantes remotos provocar una denegación de servicio (consumo de memoria) mediante el envío de este tráfico de larga duración, también conocido como error de identificación CSCtb47950. • http://www.cisco.com/en/US/docs/ios/15_0/15_0x/15_01_XA/rn800xa.pdf http://www.securityfocus.com/bid/45769 https://exchange.xforce.ibmcloud.com/vulnerabilities/64585 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 2CVE-2010-4671
https://notcve.org/view.php?id=CVE-2010-4671
The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in Cisco IOS before 15.0(1)XA5 allows remote attackers to cause a denial of service (CPU consumption and device hang) by sending many Router Advertisement (RA) messages with different source addresses, as demonstrated by the flood_router6 program in the thc-ipv6 package, aka Bug ID CSCti33534. La implementación del protocolo Neighbor Discovery (ND) en la pila de IPv6 en Cisco IOS anterior a v15.0(1)XA5 permite a atacantes remotos provocar una denegación de servicio (consumo de CPU y bloqueo de dispositivo) mediante el envío de muchos mensajes Router Advertisement (AR) con distintas direcciones origen, como demostró el programa flood_router6 en el paquete thc-ipv6, también conocido como ID de error CSCti33534 • http://events.ccc.de/congress/2010/Fahrplan/events/3957.en.html http://mirror.fem-net.de/CCC/27C3/mp3-audio-only/27c3-3957-en-ipv6_insecurities.mp3 http://mirror.fem-net.de/CCC/27C3/mp4-h264-HQ/27c3-3957-en-ipv6_insecurities.mp4 http://www.ciscosystems.com/en/US/docs/ios/15_0/15_0x/15_01_XA/rn800xa.pdf http://www.securityfocus.com/bid/45760 http://www.youtube.com/watch?v=00yjWB6gGy8 https://exchange.xforce.ibmcloud.com/vulnerabilities/64589 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 4.3EPSS: 1%CPEs: 2EXPL: 2CVE-2009-1220 – Cisco ASA Appliance 7.x/8.0 WebVPN - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2009-1220
Cross-site scripting (XSS) vulnerability in +webvpn+/index.html in WebVPN on the Cisco Adaptive Security Appliances (ASA) 5520 with software 7.2(4)30 and earlier 7.2 versions including 7.2(2)22, and 8.0(4)28 and earlier 8.0 versions, when clientless mode is enabled, allows remote attackers to inject arbitrary web script or HTML via the Host HTTP header. Una vulnerabilidad de tipo cross-site scripting (XSS) en archivo +webvpn+/index.html en el WebVPN en los Adaptive Security Appliances (ASA) 5520 de Cisco con el software versiones 7.2(4)30 y anteriores a 7.2 incluyendo 7.2(2)22, y versiones 8.0(4)28 y anteriores a 8.0, cuando el modo clientless está habilitado, permite a los atacantes remotos inyectar script web o HTML arbitrario por medio del encabezado HTTP Host. • https://www.exploit-db.com/exploits/32878 http://archives.neohapsis.com/archives/fulldisclosure/2009-03/0478.html http://tools.cisco.com/security/center/viewAlert.x?alertId=17950 http://www.securityfocus.com/archive/1/502313/100/0/threaded http://www.securityfocus.com/archive/1/502932 http://www.securityfocus.com/bid/34307 http://www.securitytracker.com/id?1022122 http://www.vupen.com/english/advisories/2009/1169 https://exchange.xforce.ibmcloud.com/vulnerabilities/49528 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.1EPSS: 2%CPEs: 2049EXPL: 0CVE-2008-4609
https://notcve.org/view.php?id=CVE-2008-4609
The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress. La implementación del protocolo TCP en (1) Linux, (2) plataformas basadas en BSD Unix, (3) Microsoft Windows, (4) productos Cisco, y probablemente otros sistemas operativos, permite a atacantes remotos provocar una denegación de servicio (agotamiento de cola de conexión) a través de múltiples vectores que manipulan información en la tabla de estados del TCP, como lo demuestra sockstress. • http://blog.robertlee.name/2008/10/conjecture-speculation.html http://insecure.org/stf/tcp-dos-attack-explained.html http://lists.immunitysec.com/pipermail/dailydave/2008-October/005360.html http://marc.info/?l=bugtraq&m=125856010926699&w=2 http://searchsecurity.techtarget.com.au/articles/27154-TCP-is-fundamentally-borked http://www.cisco.com/en/US/products/products_security_advisory09186a0080af511d.shtml http://www.cisco.com/en/US/products/products_security_response09186a0080a15120.html http://www.cpni • CWE-16: Configuration •
CVSS: 7.1EPSS: 2%CPEs: 1EXPL: 0CVE-2008-1150
https://notcve.org/view.php?id=CVE-2008-1150
The virtual private dial-up network (VPDN) component in Cisco IOS before 12.3 allows remote attackers to cause a denial of service (resource exhaustion) via a series of PPTP sessions, related to the persistence of interface descriptor block (IDB) data structures after process termination, aka bug ID CSCdv59309. La componente red privada virtual dial-up (VPDN) de Cisco IOS versiones anteriores a 12.3 permite a atacantes remotos provocar una denegación de servicio (agotamiento de recursos) a través de una serie de sesiones PPTP, en relación con la persistencia de las estructuras de datos de la interfaz de descriptor de bloque (BID) después de la terminación proceso, también conocido como bug CSCdv59309 ID. • http://secunia.com/advisories/29507 http://securitytracker.com/id?1019714 http://www.cisco.com/en/US/products/products_security_advisory09186a0080969862.shtml http://www.securityfocus.com/bid/28460 http://www.us-cert.gov/cas/techalerts/TA08-087B.html http://www.vupen.com/english/advisories/2008/1006/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41484 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5598 • CWE-399: Resource Management Errors •