CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2013-5523
https://notcve.org/view.php?id=CVE-2013-5523
The Sponsor Portal in Cisco Identity Services Engine (ISE) 1.2 and earlier does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCui82666. El Sponsor Portal in Cisco Identity Services Engine (ISE) y anteriores versiones no restringe adecuadamente el uso de elementos IFRAME, lo que hace más sencillo para atacantes remotos llevar a cabo ataques de clickjacking y otros sin especificar a través de un sitio web manipulado, relacionado con el fallo "cross-frame scripting (XFS)", también conocido como Bug ID CSCui82666. • http://osvdb.org/98168 http://secunia.com/advisories/55207 http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5523 http://tools.cisco.com/security/center/viewAlert.x?alertId=31161 http://www.securityfocus.com/bid/62869 http://www.securitytracker.com/id/1029157 https://exchange.xforce.ibmcloud.com/vulnerabilities/87724 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2013-5525
https://notcve.org/view.php?id=CVE-2013-5525
SQL injection vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCug90502. Vulnerabilidad de inyección SQL en el framework web de Cisco Identity Services Engine (ISE) 1.2 y versiones anteriores permite a usuarios remotos sin autenticar ejecutar comandos SQL arbitrarios a través de vectores sin especificar, aka Bug ID CSCug90502. • http://osvdb.org/98167 http://secunia.com/advisories/55098 http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5525 http://tools.cisco.com/security/center/viewAlert.x?alertId=31160 http://www.securitytracker.com/id/1029156 https://exchange.xforce.ibmcloud.com/vulnerabilities/87723 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2013-5524
https://notcve.org/view.php?id=CVE-2013-5524
Cross-site scripting (XSS) vulnerability in the troubleshooting page in Cisco Identity Services Engine (ISE) 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCug77655. Vulnerabilidad de inyección XSS en la página de solución de problemas en Cisco Identity Services Engine (ISE) 1.2 y anteriores permite a atacantes remotos inyectar script web o HTML arbitrario a través de parámetros sin especificar, también conocido como Bug ID CSCug77655. • http://osvdb.org/98166 http://secunia.com/advisories/55067 http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5524 http://tools.cisco.com/security/center/viewAlert.x?alertId=31159 http://www.securityfocus.com/bid/62870 http://www.securitytracker.com/id/1029155 https://exchange.xforce.ibmcloud.com/vulnerabilities/87722 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •