CVSS: 6.8EPSS: 0%CPEs: 5EXPL: 0CVE-2015-6419
https://notcve.org/view.php?id=CVE-2015-6419
12 Dec 2015 — Cisco FireSIGHT Management Center with software 4.10.3, 5.2.0, 5.3.0, 5.3.1, and 5.4.0 allows remote authenticated users to read arbitrary files via a crafted GET request, aka Bug ID CSCur25410. Cisco FireSIGHT Management Center con software 4.10.3, 5.2.0, 5.3.0, 5.3.1 y 5.4.0 permite a usuarios remotos autenticados leer archivos arbitrarios a través de una petición GET manipulada, también conocida como Bug ID CSCur25410. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151211-fmc • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.4EPSS: 6%CPEs: 7EXPL: 2CVE-2015-6357 – Cisco FireSIGHT Management Center Certificate Validation
https://notcve.org/view.php?id=CVE-2015-6357
17 Nov 2015 — The rule-update feature in Cisco FireSIGHT Management Center (MC) 5.2 through 5.4.0.1 does not verify the X.509 certificate of the support.sourcefire.com SSL server, which allows man-in-the-middle attackers to spoof this server and provide an invalid package, and consequently execute arbitrary code, via a crafted certificate, aka Bug ID CSCuw06444. La funcionalidad de actualización de reglas en Cisco FireSIGHT Management Center (MC) 5.2 hasta la versión 5.4.0.1 no verifica el certificado X.509 del servidor ... • https://packetstorm.news/files/id/134390 • CWE-20: Improper Input Validation •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2015-6363
https://notcve.org/view.php?id=CVE-2015-6363
12 Nov 2015 — Multiple cross-site scripting (XSS) vulnerabilities in the web framework in Cisco FireSIGHT Management Center (MC) 5.4.1.4 and 6.0.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuw88396. Múltiples vulnerabilidades de XSS en el web framework en Cisco FireSIGHT Management Center (MC) 5.4.1.4 y 6.0.1 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de parámetros no especificados, también ... • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151111-fmc • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 7EXPL: 0CVE-2015-6353
https://notcve.org/view.php?id=CVE-2015-6353
31 Oct 2015 — Multiple cross-site scripting (XSS) vulnerabilities in Cisco FireSight Management Center (MC) 5.3.1.5 and 5.4.x through 5.4.1.3 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuu28922. Múltiples vulnerabilidades de XSS en Cisco FireSight Management Center (MC) 5.3.1.5 y 5.4.x hasta la versión 5.4.1.3 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de parámetros no especificados, también ... • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151029-fsmc1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2015-6354
https://notcve.org/view.php?id=CVE-2015-6354
31 Oct 2015 — Multiple cross-site scripting (XSS) vulnerabilities in Cisco FireSight Management Center (MC) 5.4.1.3 and 6.0 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuv73338. Múltiples vulnerabilidades de XSS en Cisco FireSight Management Center (MC) 5.4.1.3 y 6.0 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de parámetros no especificados, también conocido como Bug ID CSCuv73338. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151029-fsmc2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 1%CPEs: 3EXPL: 0CVE-2015-6335
https://notcve.org/view.php?id=CVE-2015-6335
25 Oct 2015 — The policy implementation in Cisco FireSIGHT Management Center 5.3.1.7, 5.4.0.4, and 6.0.0 for VMware allows remote authenticated administrators to bypass intended policy restrictions and execute Linux commands as root via unspecified vectors, aka Bug ID CSCuw12839. La implementación de policy en Cisco FireSIGHT Management Center 5.3.1.7, 5.4.0.4 y 6.0.0 para VMware permite a administradores remotos autenticados eludir las restricciones destinadas a policy y ejecutar comandos Linux como root a través de vec... • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151016-fmc • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-4302
https://notcve.org/view.php?id=CVE-2015-4302
19 Aug 2015 — The web interface in Cisco FireSIGHT Management Center 5.3.1.4 allows remote attackers to delete arbitrary system policies via modified parameters in a POST request, aka Bug ID CSCuu25390. Vulnerabilidad en la interfaz web en Cisco FireSIGHT Management Center 5.3.1.4, permite a atacantes remotos borrar políticas de sistema arbitrarias a través de parámetros en una petición POST, también conocida como Bug ID CSCuu25390. • http://tools.cisco.com/security/center/viewAlert.x?alertId=40432 • CWE-284: Improper Access Control •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2015-4270
https://notcve.org/view.php?id=CVE-2015-4270
14 Jul 2015 — Multiple cross-site scripting (XSS) vulnerabilities in Cisco FireSIGHT System Software 5.3.1.5 and 6.0.0 allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug IDs CSCuv22557, CSCuv22583, CSCuv22632, CSCuv22641, CSCuv22650, CSCuv22662, CSCuv22697, and CSCuv22702. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XXS) en Cisco FireSIGHT System Software 5.3.1.5 y 6.0.0, permite a atacantes remotos inyectar arbitrariamente secuencias de comandos web o HT... • http://tools.cisco.com/security/center/viewAlert.x?alertId=39879 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2015-4242
https://notcve.org/view.php?id=CVE-2015-4242
08 Jul 2015 — Cross-site request forgery (CSRF) vulnerability in Cisco FireSIGHT System Software 5.4.1.2 and 6.0.0 in FireSIGHT Management Center allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu94721. Vulnerabilidad de CSRF en Cisco FireSIGHT System Software 5.4.1.2 y 6.0.0 en FireSIGHT Management Center permite a atacantes remotos secuestrar la autenticación de usuarios arbitrarios, también conocido como Bug ID CSCuu94721. • http://tools.cisco.com/security/center/viewAlert.x?alertId=39643 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2015-0737
https://notcve.org/view.php?id=CVE-2015-0737
12 Jun 2015 — Multiple cross-site scripting (XSS) vulnerabilities in Cisco FireSIGHT System Software 5.3.1.1 allow remote attackers to inject arbitrary web script or HTML via a crafted (1) GET or (2) POST parameter, aka Bug ID CSCuu11099. Múltiples vulnerabilidades de XSS en Cisco FireSIGHT System Software 5.3.1.1 permiten a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través de un parámetro (1) GET o (2) POST manipulado, también conocida como Bug ID CSCuu11099. • http://tools.cisco.com/security/center/viewAlert.x?alertId=38883 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •