CVE-2014-9000
published 2014-11-20CVE-2014-9000: Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows remote authenticated users to gain…
PriorityP349medium6.5CVSS 2.0
AVNACLAuSCPIPAP
EXPLOIT
EPSS
8.87%
94.6th percentile
Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows remote authenticated users to gain administrator privileges and execute arbitrary code via a crafted request that adds a new user. NOTE: this issue was originally reported for ESB Runtime 3.5.1, but it originates in MMC.
CVSS provenance
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vendor_cisco7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-fcxw-jr7h-j53p: Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService
ghsa_unreviewed·2022-05-17
CVE-2014-9000 [MEDIUM] GHSA-fcxw-jr7h-j53p: Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService
Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows remote authenticated users to gain administrator privileges and execute arbitrary code via a crafted request that adds a new user. NOTE: this issue was originally reported for ESB Runtime 3.5.1, but it originates in MMC.
Cisco
Cisco IOS XR Software Compression ACL Bypass Vulnerability
vendor_cisco·2014-10-06·CVSS 7.5
CVE-2014-3396 [HIGH] CWE-264 Cisco IOS XR Software Compression ACL Bypass Vulnerability
Cisco IOS XR Software Compression ACL Bypass Vulnerability
A vulnerability in the port or address range compression feature for access control lists (ACLs) on Typhoon line cards in Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to bypass protection offered by a configured ACL on an affected device.
The vulnerability is due to incorrect port or address range encoding in the compression module of an ACL applied to an interface of an affected device. An attacker could exploit this vulnerability by sending traffic through an affected device that should otherwise be denied by the configured ACL. An exploit could allow the attacker to bypass protection offered by a configured ACL on an affected device.
Cisco has confirmed the vulnerability i
Cisco
Cisco IOS XR Software Packet Parsing Denial of Service Vulnerability
vendor_cisco·2014-08-25·CVSS 4.6
CVE-2014-3335 [MEDIUM] CWE-399 Cisco IOS XR Software Packet Parsing Denial of Service Vulnerability
Cisco IOS XR Software Packet Parsing Denial of Service Vulnerability
A vulnerability in the packet parsing code of Cisco IOS XR Software for ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, adjacent attacker to cause a lockup and eventual reload of a Network Processor (NP) chip and a line card processing traffic.
The vulnerability is due to improper parsing of a specific packet when NetFlow sampling is configured. An attacker could exploit this vulnerability by sending a specific packet with a multicast destination MAC address through an affected device that has NetFlow sampling configured. An exploit could allow the attacker to cause a lockup and eventual reload of an NP chip and a line card processing traffic.
Cisco has confirmed the vulnerability in a secu
Cisco
Cisco Nexus 9000 Series Switches Access List Bypass Vulnerability
vendor_cisco·2014-08-06·CVSS 5.0
CVE-2014-3330 [MEDIUM] CWE-264 Cisco Nexus 9000 Series Switches Access List Bypass Vulnerability
Cisco Nexus 9000 Series Switches Access List Bypass Vulnerability
A vulnerability in the implementation of the access list logging feature of Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to bypass the access list restriction for the logged traffic.
The vulnerability is due to insufficient policy checks for the logged packets. An attacker could exploit this vulnerability by sending a flood of denied packets that match an access list entry with the log keyword. An exploit could allow the attacker to bypass the access control list for a small percentage of the packets, which would otherwise have been dropped.
Cisco has confirmed the vulnerability in a security notice and released software updates.
Cisco indicates through the CVSS score that functional
Cisco
Cisco IOS XR Software NetFlow Processing Denial of Service Vulnerability
vendor_cisco·2014-07-23·CVSS 6.1
CVE-2014-3322 [MEDIUM] CWE-399 Cisco IOS XR Software NetFlow Processing Denial of Service Vulnerability
Cisco IOS XR Software NetFlow Processing Denial of Service Vulnerability
A vulnerability in NetFlow processing in Cisco IOS XR Software for ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, adjacent attacker to cause a lockup and eventual reload of a Network Processor (NP) chip and a line card processing traffic.
The vulnerability is due to improper NetFlow sampling of malformed IP version 4 (IPv4) or IP version 6 (IPv6) packets. An attacker could exploit this vulnerability by sending a stream of malformed IPv4 or IPv6 packets to be processed through an affected device. An exploit could allow the attacker to cause a lockup and eventual reload of an NP chip and a line card, leading to a denial of service (DoS) condition.
Cisco has confirmed the vulnerability in
Cisco
Cisco IOS XR Software MPLS Packet Denial of Service Vulnerability
vendor_cisco·2014-07-15·CVSS 5.7
CVE-2014-3321 [MEDIUM] CWE-20 Cisco IOS XR Software MPLS Packet Denial of Service Vulnerability
Cisco IOS XR Software MPLS Packet Denial of Service Vulnerability
A vulnerability in parsing crafted Multiprotocol Label Switching (MPLS) packets in Cisco IOS XR Software for ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, adjacent attacker to cause a lockup and eventual reload of a network processor chip and a line card processing traffic.
The vulnerability is due to insufficient logic in parsing MPLS packets. An attacker could exploit this vulnerability by sending a stream of crafted MPLS packets to be routed by a bridge-group virtual interface (BVI) on the affected device. An exploit could allow the attacker to cause a lockup and eventual reload of a network processor chip and a line card, leading to a denial of service (DoS) condition.
Cisco has confirme
Cisco
Cisco IOS XR Software Punt Policer Denial of Service Vulnerability
vendor_cisco·2014-07-08·CVSS 6.4
CVE-2014-3308 [MEDIUM] CWE-399 Cisco IOS XR Software Punt Policer Denial of Service Vulnerability
Cisco IOS XR Software Punt Policer Denial of Service Vulnerability
A vulnerability in the implementation of the punt policer on Trident line cards in Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to overload the CPU on the Trident line card or route processor (RP) and eventually cause a denial of service (DoS) condition for traffic in some queues.
The vulnerability is due to a missing static punt policer for traffic that is destined to a device. An attacker could exploit this vulnerability by sending a large number of specific packets that are destined to an affected device. An exploit could allow the attacker to overload the CPU on the Trident line card or RP and eventually cause a DoS condition for traffic in some queues.
Cisco has
Cisco
Cisco IOS XR Software IPv6 Malformed Packet Denial of Service Vulnerability
vendor_cisco·2014-06-11·CVSS 7.1
CVE-2014-2176 [HIGH] CWE-399 Cisco IOS XR Software IPv6 Malformed Packet Denial of Service Vulnerability
Cisco IOS XR Software IPv6 Malformed Packet Denial of Service Vulnerability
A vulnerability in the parsing of malformed Internet Protocol version 6 (IPv6) packets in Cisco IOS XR Software for ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause a lockup and eventual reload of a Network Processor (NP) chip and a line card processing traffic. Only Trident-based line cards on Cisco ASR 9000 Series Aggregation Services Routers are affected by this vulnerability.
The vulnerability is due to insufficient logic in parsing malformed IPv6 packets. An attacker could exploit this vulnerability by sending a stream of malformed IPv6 packets to the affected device. An exploit could allow the attacker to cause a lockup and eventual reload of an NP chip
Cisco
Cisco IOS XR Software IPv6 Malformed Packet Denial of Service Vulnerability
vendor_cisco
CVE-2014-2176 Cisco IOS XR Software IPv6 Malformed Packet Denial of Service Vulnerability
CVE-2014-2176: Cisco IOS XR Software IPv6 Malformed Packet Denial of Service Vulnerability
A vulnerability in the parsing of malformed Internet Protocol version 6 (IPv6) packets in Cisco IOS XR Software for ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause a lockup and eventual reload of a Network Processor (NP) chip and a line card processing traffic. Only Trident-based line cards on Cisco ASR 9000 Series Aggregation Services Routers are affected by this vulnerability. The vulnerability is due to insufficient logic in parsing malformed IPv6 packets. An attacker could exploit this vulnerability by sending a stream of malformed IPv6 packets to the affected device. An exploit could allow the attacker to cause a lockup and eventual reload of
No detection rules found.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/128799http://seclists.org/fulldisclosure/2014/Oct/107http://seclists.org/fulldisclosure/2014/Oct/98http://www.mulesoft.org/documentation/display/current/Mule+Enterprise+Management+Console+Security+Updatehttp://packetstormsecurity.com/files/128799http://seclists.org/fulldisclosure/2014/Oct/107http://seclists.org/fulldisclosure/2014/Oct/98http://www.mulesoft.org/documentation/display/current/Mule+Enterprise+Management+Console+Security+Update
2014-11-20
Published