Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

473 results · page 8 of 10

Apr 20, 2017A vulnerability in the DNS input packet processor for Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to cause the DNS process to CVE-2017-6613 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.8
A vulnerability in the DNS input packet processor for Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to cause the DNS process to momentarily restart, which could lead to a partial denial of service (DoS) condition on the affected system. The vulnerability is due to incomplete DNS packet header validation when the packet is received by the application. An attacker could exploit this vulnerability by sending a malformed DNS packet to the application. An exploit could allow the attacker to cause the DNS process to restart, which could lead to a DoS condition. This vulnerability affects Cisco Prime Network Registrar on all software versions prior to 8.3.5. Cisco Bug IDs: CSCvb55412.
Product
Prime Network Registrar
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Apr 20, 2017A vulnerability in the web framework code of Cisco Prime Infrastructure 2.2(2) could allow an unauthenticated, remote attacker to conduct a cross-site scriptingCVE-2017-6611 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
A vulnerability in the web framework code of Cisco Prime Infrastructure 2.2(2) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of the affected system. The vulnerability is due to insufficient input validation of some parameters passed to the web server. An attacker could exploit this vulnerability by convincing the user to access a malicious link or by intercepting the user request and injecting the malicious code. An exploit could allow the attacker to execute arbitrary script code in the context of the affected site or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCuw65830.
Product
Prime Infrastructure
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Apr 7, 2017A vulnerability in the web interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attCVE-2017-3884 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
A vulnerability in the web interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to access sensitive data. The attacker does not need administrator credentials and could use this information to conduct additional reconnaissance attacks. More Information: CSCvc60031 (Fixed) CSCvc60041 (Fixed) CSCvc60095 (Open) CSCvc60102 (Open). Known Affected Releases: 2.2 2.2(3) 3.0 3.1(0.0) 3.1(0.128) 3.1(4.0) 3.1(5.0) 3.2(0.0) 2.0(4.0.45D).
Product
Evolved Programmable Network Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Apr 7, 2017A vulnerability in the HTTP web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-siteCVE-2017-3848 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
A vulnerability in the HTTP web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of the affected system. More Information: CSCuw63001 CSCuw63003. Known Affected Releases: 2.2(2). Known Fixed Releases: 3.1(0.0).
Product
Prime Infrastructure
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Mar 17, 2017A RADIUS Secret Disclosure vulnerability in the web network management interface of Cisco Prime Optical for Service Providers could allow an authenticated, remoCVE-2017-3871 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
A RADIUS Secret Disclosure vulnerability in the web network management interface of Cisco Prime Optical for Service Providers could allow an authenticated, remote attacker to disclose sensitive information in the configuration generated for a device. The attacker must have valid credentials for the device. More Information: CSCvc65257. Known Affected Releases: 10.6(0.1).
Product
Prime Optical
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com tools.cisco.com
Mar 17, 2017An API Credentials Management vulnerability in the APIs for Cisco Prime Infrastructure could allow an authenticated, remote attacker to access an API that shoulCVE-2017-3869 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.4
An API Credentials Management vulnerability in the APIs for Cisco Prime Infrastructure could allow an authenticated, remote attacker to access an API that should be restricted to a privileged user. The attacker needs to have valid credentials. More Information: CSCuy36192. Known Affected Releases: 3.1(1) 3.1(1).
Product
Prime Infrastructure
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Mar 17, 2017A vulnerability in the web framework code of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS)CVE-2017-3866 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
A vulnerability in the web framework code of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of the affected system. More Information: CSCvc79842 CSCvc79846 CSCvc79855 CSCvc79873 CSCvc79882 CSCvc79891. Known Affected Releases: 11.1.2.
Product
Prime Service Catalog
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Mar 14, 2017Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable memory corruption vulnerability in the Primetime TVSDK functionality related to hosting pCVE-2017-2999 · Other software · Adobe · reported by AdobeHigh 8.8
Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable memory corruption vulnerability in the Primetime TVSDK functionality related to hosting playback surface. Successful exploitation could lead to arbitrary code execution.
Product
Flash Player
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rhn.redhat.com securityfocus.com
Mar 14, 2017Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable memory corruption vulnerability in the Primetime TVSDK API functionality related to timelCVE-2017-2998 · Other software · Adobe · reported by AdobeHigh 8.8
Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable memory corruption vulnerability in the Primetime TVSDK API functionality related to timeline interactions. Successful exploitation could lead to arbitrary code execution.
Product
Flash Player
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rhn.redhat.com securityfocus.com
Mar 14, 2017Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable buffer overflow / underflow vulnerability in the Primetime TVSDK that supports customizinCVE-2017-2997 · Other software · Adobe · reported by AdobeHigh 8.8
Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable buffer overflow / underflow vulnerability in the Primetime TVSDK that supports customizing ad information. Successful exploitation could lead to arbitrary code execution.
Product
Flash Player
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rhn.redhat.com securityfocus.com
Feb 21, 2017A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross-CVE-2017-3845 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. Affected Products: Cisco Prime Collaboration Assurance software versions 11.0, 11.1, and 11.5 are vulnerable. Cisco Prime Collaboration Assurance software versions prior to 11.0 are not vulnerable. More Information: CSCvc77783. Known Affected Releases: 11.5(0).
Product
Prime Collaboration Assurance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Feb 21, 2017A vulnerability in exporting functions of the user interface for Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to view file CVE-2017-3844 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
A vulnerability in exporting functions of the user interface for Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to view file directory listings and download files. Affected Products: Cisco Prime Collaboration Assurance software versions 11.0, 11.1, and 11.5 are vulnerable. Cisco Prime Collaboration Assurance software versions prior to 11.0 are not vulnerable. More Information: CSCvc86238. Known Affected Releases: 11.5(0).
Product
Prime Collaboration Assurance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Feb 21, 2017A vulnerability in the file download functions for Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to download system files thCVE-2017-3843 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
A vulnerability in the file download functions for Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to download system files that should be restricted. More Information: CSCvc99446. Known Affected Releases: 11.5(0).
Product
Prime Collaboration Assurance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Feb 15, 2017Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability in Primetime SDK.CVE-2017-2996 · Other software · Adobe · reported by AdobeHigh 8.8
Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability in Primetime SDK. Successful exploitation could lead to arbitrary code execution.
Product
Flash Player
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rhn.redhat.com securityfocus.com
Feb 15, 2017Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in Primetime SDK event dispatch.CVE-2017-2994 · Other software · Adobe · reported by AdobeHigh 8.8
Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in Primetime SDK event dispatch. Successful exploitation could lead to arbitrary code execution.
Product
Flash Player
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rhn.redhat.com securityfocus.com
Feb 3, 2017A vulnerability in the web framework of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conduct a web URL redirect attack against aCVE-2017-3810 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.4
A vulnerability in the web framework of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conduct a web URL redirect attack against a user who is logged in to an affected system. More Information: CSCvb21745. Known Affected Releases: 10.0_R2_tanggula.
Product
Prime Service Catalog
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Feb 1, 2017A vulnerability in the web-based GUI of Cisco Prime Home could allow an unauthenticated, remote attacker to bypass authentication and execute actions with adminCVE-2017-3791 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 10
A vulnerability in the web-based GUI of Cisco Prime Home could allow an unauthenticated, remote attacker to bypass authentication and execute actions with administrator privileges. The vulnerability is due to a processing error in the role-based access control (RBAC) of URLs. An attacker could exploit this vulnerability by sending API commands via HTTP to a particular URL without prior authentication. An exploit could allow the attacker to perform any actions in Cisco Prime Home with administrator privileges. This vulnerability affects Cisco Prime Home versions from 6.3.0.0 to the first fixed release 6.5.0.1. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Cisco Bug IDs: CSCvb49837.
Product
Cisco Prime Home
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com tools.cisco.com
Jan 30, 2017The OpenSSL address implementation in Socat 1.7.3.0 and 2.0.0-b8 does not use a prime number for the DH, which makes it easier for remote attackers to obtain thCVE-2016-2217 · Other software · Dest-unreach · reported by MITREMedium 5.3
The OpenSSL address implementation in Socat 1.7.3.0 and 2.0.0-b8 does not use a prime number for the DH, which makes it easier for remote attackers to obtain the shared secret.
Product
Socat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dest-unreach.org openwall.com
Dec 13, 2016A vulnerability in the web framework code of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross-site scriptiCVE-2016-9200 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
A vulnerability in the web framework code of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface. More Information: CSCut43268. Known Affected Releases: 10.5(1) 10.6.
Product
Prime Collaboration Assurance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Nov 3, 2016A vulnerability in the web-based graphical user interface (GUI) of Cisco Prime Home could allow an unauthenticated, remote attacker to bypass authentication.CVE-2016-6452 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.8
A vulnerability in the web-based graphical user interface (GUI) of Cisco Prime Home could allow an unauthenticated, remote attacker to bypass authentication. The attacker could be granted full administrator privileges. Cisco Prime Home versions 5.1.1.6 and earlier and 5.2.2.2 and earlier have been confirmed to be vulnerable. Cisco Prime Home versions 6.0 and later are not vulnerable. More Information: CSCvb71732. Known Affected Releases: 5.0 5.0(1) 5.0(1.1) 5.0(1.2) 5.0(2) 5.15.1(0) 5.1(1) 5.1(1.3) 5.1(1.4) 5.1(1.5) 5.1(1.6) 5.1(2) 5.1(2.1) 5.1(2.3) 5.25.2(0.1) 5.2(1.0) 5.2(1.2) 5.2(2.0) 5.2(2.1) 5.2(2.2).
Product
Prime Home
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com tools.cisco.com
Nov 3, 2016Multiple vulnerabilities in the web framework code of the Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to conduct a crCVE-2016-6451 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
Multiple vulnerabilities in the web framework code of the Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of the affected system. More Information: CSCut43061 CSCut43066 CSCut43736 CSCut43738 CSCut43741 CSCut43745 CSCut43748 CSCut43751 CSCut43756 CSCut43759 CSCut43764 CSCut43766. Known Affected Releases: 10.6.
Product
Prime Collaboration Provisioning
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Oct 27, 2016A vulnerability in the Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL database interface could allow an authenticated, remote attacker CVE-2016-6443 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.8
A vulnerability in the Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL database interface could allow an authenticated, remote attacker to impact system confidentiality by executing a subset of arbitrary SQL queries that can cause product instability. More Information: CSCva27038, CSCva28335. Known Affected Releases: 3.1(0.128), 1.2(400), 2.0(1.0.34A).
Product
Evolved Programmable Network Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Sep 23, 2016Cisco Prime Home 5.2.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entiCVE-2016-6408 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
Cisco Prime Home 5.2.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka Bug ID CSCvb17814.
Product
Prime Home
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com securityfocus.com
Aug 22, 2016The Self-Service Portal in EMC RSA Authentication Manager (AM) Prime Self-Service 3.0 and 3.1 before 3.1 1915.42871 allows remote authenticated users to cause aCVE-2016-0915 · Other software · EMC · reported by security_alert@emc.comHigh 8.1
The Self-Service Portal in EMC RSA Authentication Manager (AM) Prime Self-Service 3.0 and 3.1 before 3.1 1915.42871 allows remote authenticated users to cause a denial of service (PIN change for an arbitrary user) via a modified token serial number within a PIN change request, related to a "direct object reference vulnerability."
Product
Authentication Manager Prime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org securityfocus.com
Aug 7, 2016Cisco Prime Infrastructure 2.2(2) does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks CVE-2016-1474 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
Cisco Prime Infrastructure 2.2(2) does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCuw65846, a different vulnerability than CVE-2015-6434.
Product
Prime Infrastructure
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com securityfocus.com
Jul 27, 2016Cross-site scripting (XSS) vulnerability in the web-based management interface in Cisco Prime Service Catalog (PSC) 11.0 allows remote attackers to inject arbitCVE-2016-1462 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
Cross-site scripting (XSS) vulnerability in the web-based management interface in Cisco Prime Service Catalog (PSC) 11.0 allows remote attackers to inject arbitrary web script or HTML via a crafted value, aka Bug ID CSCuz63795.
Product
Prime Service Catalog
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com securityfocus.com
Jul 7, 2016The administrative web interface in Cisco Prime Infrastructure (PI) before 3.1.1 allows remote authenticated users to execute arbitrary commands via crafted fieCVE-2016-1442 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.8
The administrative web interface in Cisco Prime Infrastructure (PI) before 3.1.1 allows remote authenticated users to execute arbitrary commands via crafted field values, aka Bug ID CSCuy96280.
Product
Prime Infrastructure
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com securitytracker.com
Jul 2, 2016Cisco Prime Collaboration Provisioning 10.6 SP2 (aka 10.6.0.10602) mishandles LDAP authentication, which allows remote attackers to obtain administrator privileCVE-2016-1416 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.8
Cisco Prime Collaboration Provisioning 10.6 SP2 (aka 10.6.0.10602) mishandles LDAP authentication, which allows remote attackers to obtain administrator privileges via a crafted login attempt, aka Bug ID CSCuv37513.
Product
Prime Collaboration Provisioning
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com securityfocus.com
Jul 2, 2016Cisco Prime Infrastructure 1.2 through 3.1 and Evolved Programmable Network Manager (EPNM) 1.2 and 2.0 allow remote authenticated users to execute arbitrary comCVE-2016-1408 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.8
Cisco Prime Infrastructure 1.2 through 3.1 and Evolved Programmable Network Manager (EPNM) 1.2 and 2.0 allow remote authenticated users to execute arbitrary commands or upload files via a crafted HTTP request, aka Bug ID CSCuz01488.
Product
Prime Infrastructure
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com securityfocus.com
Jul 2, 2016The API in Cisco Prime Infrastructure 1.2 through 3.0 and Evolved Programmable Network Manager (EPNM) 1.2 allows remote attackers to execute arbitrary code or oCVE-2016-1289 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.8
The API in Cisco Prime Infrastructure 1.2 through 3.0 and Evolved Programmable Network Manager (EPNM) 1.2 allows remote attackers to execute arbitrary code or obtain sensitive management information via a crafted HTTP request, as demonstrated by discovering managed-device credentials, aka Bug ID CSCuy10231.
Product
Prime Infrastructure
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com securityfocus.com
Jun 22, 2016SQL injection vulnerability in the SQL database in Cisco Prime Collaboration Deployment before 11.5.1 allows remote authenticated users to execute arbitrary SQLCVE-2016-1437 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
SQL injection vulnerability in the SQL database in Cisco Prime Collaboration Deployment before 11.5.1 allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCuy92549.
Product
Prime Collaboration Deployment
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com securitytracker.com
Jun 17, 2016The System Configuration Protocol (SCP) core messaging interface in Cisco Prime Network Registrar 8.2 before 8.2.3.1 and 8.3 before 8.3.2 allows remote attackerCVE-2016-1427 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
The System Configuration Protocol (SCP) core messaging interface in Cisco Prime Network Registrar 8.2 before 8.2.3.1 and 8.3 before 8.3.2 allows remote attackers to obtain sensitive information via crafted SCP messages, aka Bug ID CSCuv35694.
Product
Prime Network Registrar
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com securitytracker.com
Jun 3, 2016Cisco Prime Network Analysis Module (NAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(2) and Prime Virtual Network Analysis Module (vNAM) before 6.1(1)CVE-2016-1391 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.8
Cisco Prime Network Analysis Module (NAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(2) and Prime Virtual Network Analysis Module (vNAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(2) allow remote authenticated users to execute arbitrary OS commands via a crafted HTTP request, aka Bug ID CSCuy21889.
Product
Prime Network Analysis Module Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com securitytracker.com
Jun 3, 2016Cisco Prime Network Analysis Module (NAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(1) and Prime Virtual Network Analysis Module (vNAM) before 6.1(1)CVE-2016-1390 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.8
Cisco Prime Network Analysis Module (NAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(1) and Prime Virtual Network Analysis Module (vNAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(1) allow local users to obtain root access via crafted CLI input, aka Bug ID CSCuy21892.
Product
Prime Network Analysis Module Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com securitytracker.com
Jun 2, 2016Cisco Prime Network Analysis Module (NAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(1) and Prime Virtual Network Analysis Module (vNAM) before 6.1(1)CVE-2016-1388 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.8
Cisco Prime Network Analysis Module (NAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(1) and Prime Virtual Network Analysis Module (vNAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(1) allow remote attackers to execute arbitrary OS commands via a crafted HTTP request, aka Bug ID CSCuy21882.
Product
Network Analysis Module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com securitytracker.com
Jun 2, 2016Cisco Prime Network Analysis Module (NAM) before 6.2(1-b) miscalculates IPv6 payload lengths, which allows remote attackers to cause a denial of service (mond pCVE-2016-1370 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.3
Cisco Prime Network Analysis Module (NAM) before 6.2(1-b) miscalculates IPv6 payload lengths, which allows remote attackers to cause a denial of service (mond process crash and monitoring outage) via crafted IPv6 packets, aka Bug ID CSCuy37324.
Product
Network Analysis Module Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com securitytracker.com
May 24, 2016The API web interface in Cisco Prime Infrastructure before 3.1 and Cisco Evolved Programmable Network Manager before 1.2.4 allows remote authenticated users to CVE-2016-1406 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.8
The API web interface in Cisco Prime Infrastructure before 3.1 and Cisco Evolved Programmable Network Manager before 1.2.4 allows remote authenticated users to bypass intended RBAC restrictions and obtain sensitive information, and consequently gain privileges, via crafted JSON data, aka Bug ID CSCuy12409.
Product
Evolved Programmable Network Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com securitytracker.com
May 5, 2016Open redirect vulnerability in Cisco Prime Collaboration Assurance Software 10.5 through 11.0 allows remote attackers to redirect users to arbitrary web sites aCVE-2016-1392 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.4
Open redirect vulnerability in Cisco Prime Collaboration Assurance Software 10.5 through 11.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka Bug ID CSCuu34121.
Product
Prime Collaboration Assurance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com securitytracker.com
Apr 6, 2016Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allow remote attackers to execute arbitrary code via cCVE-2016-1291 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.8
Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allow remote attackers to execute arbitrary code via crafted deserialized data in an HTTP POST request, aka Bug ID CSCuw03192.
Product
Evolved Programmable Network Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com securitytracker.com
Apr 6, 2016The web API in Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allows remote authenticated users to byCVE-2016-1290 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.1
The web API in Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allows remote authenticated users to bypass intended RBAC restrictions and gain privileges via an HTTP request that is inconsistent with a pattern filter, aka Bug ID CSCuy10227.
Product
Evolved Programmable Network Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com securitytracker.com
Mar 11, 2016Cisco Prime LAN Management Solution (LMS) through 4.2.5 uses the same database decryption key across different customers' installations, which allows local userCVE-2016-1360 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.1
Cisco Prime LAN Management Solution (LMS) through 4.2.5 uses the same database decryption key across different customers' installations, which allows local users to obtain cleartext data by leveraging console connectivity, aka Bug ID CSCuw85390.
Product
Prime LAN Management Solution
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com securitytracker.com
Mar 3, 2016Cisco Prime Infrastructure 3.0 allows remote authenticated users to execute arbitrary code via a crafted HTTP request that is mishandled during viewing of a logCVE-2016-1359 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.8
Cisco Prime Infrastructure 3.0 allows remote authenticated users to execute arbitrary code via a crafted HTTP request that is mishandled during viewing of a log file, aka Bug ID CSCuw81494.
Product
Prime Infrastructure
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com securitytracker.com
Mar 3, 2016Cisco Prime Infrastructure 2.2, 3.0, and 3.1(0.0) allows remote authenticated users to read arbitrary files or cause a denial of service via an XML document conCVE-2016-1358 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.4
Cisco Prime Infrastructure 2.2, 3.0, and 3.1(0.0) allows remote authenticated users to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka Bug ID CSCuw81497.
Product
Prime Infrastructure
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com securitytracker.com
Feb 14, 2016The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH) CVE-2016-0701 · Email & office · Openssl · reported by Red HatLow 3.7
The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH) key exchange, which makes it easier for remote attackers to discover a private DH exponent by making multiple handshakes with a peer that chose an inappropriate number, as demonstrated by a number in an X9.42 file.
Product
Openssl
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intothesymmetry.blogspot.com kb.juniper.net
Feb 11, 2016The CLI in Cisco Prime Collaboration 9.0 and 11.0 allows local users to execute arbitrary OS commands as root by leveraging administrator privileges, aka Bug IDCVE-2016-1320 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.7
The CLI in Cisco Prime Collaboration 9.0 and 11.0 allows local users to execute arbitrary OS commands as root by leveraging administrator privileges, aka Bug ID CSCux69286.
Product
Prime Collaboration
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tenable.com
Feb 7, 2016The RBAC implementation in Cisco ASA-CX Content-Aware Security software before 9.3.1.1(112) and Cisco Prime Security Manager (PRSM) software before 9.3.1.1(112)CVE-2016-1301 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.8
The RBAC implementation in Cisco ASA-CX Content-Aware Security software before 9.3.1.1(112) and Cisco Prime Security Manager (PRSM) software before 9.3.1.1(112) allows remote authenticated users to change arbitrary passwords via a crafted HTTP request, aka Bug ID CSCuo94842.
Product
Prime Security Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com securitytracker.com
Jan 7, 2016Cisco Prime Infrastructure does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unsCVE-2015-6434 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
Cisco Prime Infrastructure does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCux64856.
Product
Prime Infrastructure
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com securitytracker.com
Dec 18, 2015Cisco Prime Network Services Controller 3.0 allows local users to bypass intended access restrictions and execute arbitrary commands via additional parameters tCVE-2015-6426 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.2
Cisco Prime Network Services Controller 3.0 allows local users to bypass intended access restrictions and execute arbitrary commands via additional parameters to an unspecified command, aka Bug ID CSCus99427.
Product
Prime Network Services Controller
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com securityfocus.com
Dec 12, 2015Cisco Prime Collaboration Assurance before 11.0 has a hardcoded cmuser account, which allows remote attackers to obtain access by establishing an SSH session anCVE-2015-6389 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 9
Cisco Prime Collaboration Assurance before 11.0 has a hardcoded cmuser account, which allows remote attackers to obtain access by establishing an SSH session and leveraging knowledge of this account's password, aka Bug ID CSCus62707.
Product
Prime Collaboration Assurance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com securityfocus.com
Dec 12, 2015Cisco Prime Service Catalog 10.0, 10.0(R2), 10.1, and 11.0 does not properly restrict access to web pages, which allows remote attackers to modify the configuraCVE-2015-6395 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
Cisco Prime Service Catalog 10.0, 10.0(R2), 10.1, and 11.0 does not properly restrict access to web pages, which allows remote attackers to modify the configuration via a direct request, aka Bug ID CSCuw48188.
Product
Prime Service Catalog
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com securitytracker.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.