CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-9215
https://notcve.org/view.php?id=CVE-2016-9215
A vulnerability in Cisco IOS XR Software could allow an authenticated, local attacker to log in to the device with the privileges of the root user. More Information: CSCva38434. Known Affected Releases: 6.1.1.BASE. Una vulnerabilidad en Cisco IOS XR Software podría permitir a un atacante local autenticado iniciar sesión en el dispositivo con los privilegios de root del usuario. Más Información: CSCva38434. • http://www.securityfocus.com/bid/94812 http://www.securitytracker.com/id/1037418 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-iosxr • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-9205
https://notcve.org/view.php?id=CVE-2016-9205
A vulnerability in the HTTP 2.0 request handling code of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the Event Management Service daemon (emsd) to crash, resulting in a denial of service (DoS) condition. More Information: CSCvb14425. Known Affected Releases: 6.1.1.BASE. Known Fixed Releases: 6.1.2.6i.MGBL 6.1.22.9i.MGBL 6.2.1.14i.MGBL. Una vulnerabilidad en la petición de código de manejo HTTP 2.0 de Cisco IOS XR Software podría permitir a un atacante remoto no autenticado provocar la caída del demonio Event Management Service (emsd), resultando en una condición de denegación de servicio (DoS). • http://www.securityfocus.com/bid/94813 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-ios-xr • CWE-399: Resource Management Errors •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-6428
https://notcve.org/view.php?id=CVE-2016-6428
Cisco IOS XR 6.1.1 allows local users to execute arbitrary OS commands as root by leveraging admin privileges, aka Bug ID CSCva38349. Cisco IOS XR 6.1.1 permite a usuarios locales ejecutar comandos de SO arbitrarios como root aprovechando privilegios de admin, vulnerabilidad también conocida como Bug ID CSCva38349. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-iosxr http://www.securityfocus.com/bid/93416 http://www.securitytracker.com/id/1036956 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2016-6421
https://notcve.org/view.php?id=CVE-2016-6421
Cisco IOS XR 5.2.2 allows remote attackers to cause a denial of service (process restart) via a crafted OSPF Link State Advertisement (LSA) update, aka Bug ID CSCvb05643. Cisco IOS XR 5.2.2 permite a atacantes remotos provocar una denegación de servicio (reinicio del proceso) a través de una actualización OSPF Link State Advertisement (LSA) manipulada, vulnerabilidad también conocida como Bug ID CSCvb05643. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-ospf http://www.securityfocus.com/bid/93212 http://www.securitytracker.com/id/1036909 • CWE-399: Resource Management Errors •
CVSS: 7.5EPSS: 97%CPEs: 5EXPL: 2CVE-2016-6415 – Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2016-6415
The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allows remote attackers to obtain sensitive information from device memory via a Security Association (SA) negotiation request, aka Bug IDs CSCvb29204 and CSCvb36055 or BENIGNCERTAIN. La implementación del servidor IKEv1 en Cisco IOS 12.2 hasta la versión 12.4 y 15.0 hasta la versión 15.6, IOS XE hasta la versión 3.18S, IOS XR 4.3.x y 5.0.x hasta la versión 5.2.x y PIX en versiones anteriores a 7.0 permite a atacantes remotos obtener información sensible de la memoria del dispositivo a través de una petición de negociación Security Association (SA), vulnerabilidad también conocida como Bug IDs CSCvb29204 y CSCvb36055 o BENIGNCERTAIN. Cisco IOS, IOS XR, and IOS XE contain insufficient condition checks in the part of the code that handles Internet Key Exchange version 1 (IKEv1) security negotiation requests. contains an information disclosure vulnerability in the Internet Key Exchange version 1 (IKEv1) that could allow an attacker to retrieve memory contents. Successful exploitation could allow the attacker to retrieve memory contents, which can lead to information disclosure. • https://www.exploit-db.com/exploits/43383 https://github.com/3ndG4me/CVE-2016-6415-BenignCertain-Monitor http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160916-ikev1 http://www.securityfocus.com/bid/93003 http://www.securitytracker.com/id/1036841 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •