Anfälligkeitssuche        Suche in 219043 CVE Beschreibungen
und 99761 Test Beschreibungen,
Zugriff auf 10,000+ Quellverweise.
Tests   CVE   Alle  

Test Kennung:1.3.6.1.4.1.25623.1.0.105582
Kategorie:CISCO
Titel:Cisco FireSIGHT System Software Multiple Vulnerabilities
Zusammenfassung:A vulnerability in credential authentication for valid and invalid username-password pairs for Cisco; FireSIGHT System Software could allow an unauthenticated, remote attacker to determine a list of valid usernames for an affected device.; A vulnerability in the HTTP web-based management interface of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker; to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected system.
Beschreibung:Summary:
A vulnerability in credential authentication for valid and invalid username-password pairs for Cisco
FireSIGHT System Software could allow an unauthenticated, remote attacker to determine a list of valid usernames for an affected device.
A vulnerability in the HTTP web-based management interface of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker
to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected system.

Vulnerability Insight:
The XSS vulnerability is due to improper sanitization of parameter values. The Convert Timing Channel
Vulnerability is due to implementation details of how system credentials are verified by the affected software.

Vulnerability Impact:
An attacker could exploit the XSS vulnerability by persuading a user to click a specific link.
An attacker could exploit the Convert Timing Channel vulnerability by using a combination of valid system logins, invalid system
logins, and time variability to try to continuously authenticate to a device.

Affected Software/OS:
Cisco FireSIGHT System Software Release 6.1.0 is vulnerable.

Solution:
See vendor advisory

CVSS Score:
4.3

CVSS Vector:
AV:N/AC:M/Au:N/C:P/I:N/A:N

Querverweis: Common Vulnerability Exposure (CVE) ID: CVE-2016-1356
Cisco Security Advisory: 20160302 Cisco FireSIGHT System Software Convert Timing Channel Vulnerability
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-FireSIGHT1
http://www.securitytracker.com/id/1035189
Common Vulnerability Exposure (CVE) ID: CVE-2016-1355
Cisco Security Advisory: 20160302 Cisco FireSIGHT System Software Device Management UI Cross-Site Scripting Vulnerability
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-FireSIGHT
http://www.securitytracker.com/id/1035188
CopyrightCopyright (C) 2016 Greenbone Networks GmbH

Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus.

Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.




© 1998-2024 E-Soft Inc. Alle Rechte vorbehalten.