CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2015-4266
https://notcve.org/view.php?id=CVE-2015-4266
The web interface in Cisco Identity Services Engine (ISE) 1.1(4.1), 1.3(106.146), and 1.3(120.135) does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCut04556. La interfaz web en Cisco Identity Services Engine (ISE) 1.1 (4.1), 1.3 (106.146) y 1.3 (120.135) no restringe correctamente el uso de elementos IFRAME, lo que facilita a atacantes remotos llevar a cabo ataques de clickjacking y otros ataques no especificados a través de una página web manipulada, relacionados con una cuestión de 'cross-frame scripting (XFS)', también conocido como Bug ID CSCut04556. • http://tools.cisco.com/security/center/viewAlert.x?alertId=39871 http://www.securitytracker.com/id/1032930 • CWE-20: Improper Input Validation •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2015-4182
https://notcve.org/view.php?id=CVE-2015-4182
The administrative web interface in Cisco Identity Services Engine (ISE) before 1.3 allows remote authenticated users to bypass intended access restrictions, and obtain sensitive information or change settings, via unspecified vectors, aka Bug ID CSCui72087. La interfaz web administrativa en Cisco Identity Services Engine (ISE) anterior a 1.3 permite a usuarios remotos autenticados evadir las restricciones de acceso, y obtener información sensible o cambiar configuraciones, a través de vectores no especificados, también conocido como Bug ID CSCui72087. • http://tools.cisco.com/security/center/viewAlert.x?alertId=39299 http://www.securityfocus.com/bid/75152 http://www.securitytracker.com/id/1032579 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2014-3275
https://notcve.org/view.php?id=CVE-2014-3275
SQL injection vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2(.1 patch 2) and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCul21337. Vulnerabilidad de inyección SQL en el Framework web en Cisco Identity Services Engine (ISE) 1.2(.1 patch 2) y anteriores permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través de una URL manipulada, también conocido como Bug ID CSCul21337. • http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3275 http://tools.cisco.com/security/center/viewAlert.x?alertId=34328 http://www.securityfocus.com/bid/67555 http://www.securitytracker.com/id/1030273 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.0EPSS: 0%CPEs: 3EXPL: 0CVE-2014-3276
https://notcve.org/view.php?id=CVE-2014-3276
Cisco Identity Services Engine (ISE) 1.2(.1 patch 2) and earlier does not properly handle deadlock conditions during reception of crafted RADIUS accounting packets from multiple NAS devices, which allows remote authenticated users to cause a denial of service (RADIUS outage) by sourcing these packets from two origins, aka Bug ID CSCuo56780. Cisco Identity Services Engine (ISE) 1.2(.1 patch 2) y anteriores no maneja debidamente condiciones de bloqueo durante la recepción de paquetes de contabilidad RADIUS manipulados de múltiples dispositivos NAS, lo que permite a usuarios remotos autenticados causar una denegación de servicio (RADIUS outage) mediante la obtención de estos paquetes de dos origines, también conocido como Bug ID CSCuo56780. • http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3276 http://tools.cisco.com/security/center/viewAlert.x?alertId=34329 http://www.securitytracker.com/id/1030274 • CWE-399: Resource Management Errors •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2014-0681
https://notcve.org/view.php?id=CVE-2014-0681
Cross-site scripting (XSS) vulnerability in Cisco Identity Services Engine (ISE) 1.2 patch 2 and earlier allows remote attackers to inject arbitrary web script or HTML via a report containing a crafted URL that is not properly handled during generation of report-output pages, aka Bug ID CSCui15064. Cross-site scripting (XSS) en Cisco Identity Services Engine (ISE) 1.2 parche 2 y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de un informe que contiene una URL manipulada que no se maneja adecuadamente durante la generación de páginas de informe de salida , también conocido como Bug ID CSCui15064. • http://osvdb.org/102589 http://secunia.com/advisories/56714 http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0681 http://tools.cisco.com/security/center/viewAlert.x?alertId=32609 http://www.securityfocus.com/bid/65183 http://www.securitytracker.com/id/1029699 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •