RSS   Vulnerabilities for
'Secure access control server solution engine'
   RSS

2018-10-05
 
CVE-2018-0414

CWE-611
 

 
A vulnerability in the web-based UI of Cisco Secure Access Control Server could allow an authenticated, remote attacker to gain read access to certain information in an affected system. The vulnerability is due to improper handling of XML External Entities (XXEs) when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file.

 
2018-03-08
 
CVE-2018-0218

CWE-200
 

 
A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker to gain read access to certain information in the affected system. The vulnerability is due to improper handling of XML External Entities (XXEs) when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file. Cisco Bug IDs: CSCve70616.

 
 
CVE-2018-0207

CWE-200
 

 
A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker to gain read access to certain information in the affected system. The vulnerability is due to improper handling of XML External Entities (XXEs) when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file. Cisco Bug IDs: CSCve70595.

 
2015-04-16
 
CVE-2015-0700

 

 
Cross-site request forgery (CSRF) vulnerability in the Dashboard page in the monitoring-and-report section in Cisco Secure Access Control Server Solution Engine before 5.5(0.46.5) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj62924.

 
2013-06-11
 
CVE-2013-3380

CWE-200
 

 
The administrative web interface in the Access Control Server in Cisco Secure Access Control System (ACS) does not properly restrict the report view page, which allows remote authenticated users to obtain sensitive information via a direct request, aka Bug ID CSCue79279.

 
2006-12-31
 
CVE-2006-4097

CWE-noinfo
 

 
Multiple unspecified vulnerabilities in the CSRadius service in Cisco Secure Access Control Server (ACS) for Windows before 4.1 and ACS Solution Engine before 4.1 allow remote attackers to cause a denial of service (crash) via a crafted RADIUS Access-Request packet. NOTE: it has been reported that at least one issue is a heap-based buffer overflow involving the Tunnel-Password attribute.

 
2005-05-31
 
CVE-2005-0356

CWE-Other
 

 
Multiple TCP implementations with Protection Against Wrapped Sequence Numbers (PAWS) with the timestamps option enabled allow remote attackers to cause a denial of service (connection loss) via a spoofed packet with a large timer value, which causes the host to discard later packets because they appear to be too old.

 
2005-01-10
 
CVE-2004-1099

CWE-Other
 

 
Cisco Secure Access Control Server for Windows (ACS Windows) and Cisco Secure Access Control Server Solution Engine (ACS Solution Engine) 3.3.1, when the EAP-TLS protocol is enabled, does not properly handle expired or untrusted certificates, which allows remote attackers to bypass authentication and gain unauthorized access via a "cryptographically correct" certificate with valid fields such as the username.

 

 >>> Vendor: Cisco 1789 Products
IOS
Pix firewall
Router
Cisco 7xx routers
Catalyst 12xx supervisor software
Catalyst 29xx supervisor software
Catalyst 5xxx supervisor software
Ciscosecure
675 router
Cache engine
Resource manager
Pix private link
Catalyst 2900 vlan
Catos
Accesspath
As5200
As5300
As5800
System controller 3640
3660 router
7100 router
7200 router
7500 router
Ubr7200
Voice gateway as5800
Router 2500
Router 2600
Router 3600
Router 4000
Router 7200
Router 7500
Tacacs+
Gigabit switch router 12008
Gigabit switch router 12012
Gigabit switch router 12016
Catalyst 3500 xl
Virtual central office 4000
Secure access control server
Arrowpoint
Content services switch
Cisco 6xx routers
Broadband operating system
Catalyst 4000
Catalyst 5000
Catalyst 6000
Aironet
Aironet ap340
Pix firewall 515
Pix firewall 520
Content services switch 11050
Content services switch 11150
Content services switch 11800
Vpn 3000 concentrator
Vpn 3005 concentrator
Vpn 3015 concentrator
Vpn 3030 concentator
Vpn 3060 concentrator
Vpn 3080 concentrator
CBOS
Aironet 340
Catalyst 2900
Content services switch 11000
Catalyst 6000 intrusion detection system module
Secure intrusion detection system
HSRP
6400 nrp 2
Tftp server
12000 router
Catalyst 2900xl
Catalyst 2948g-l3
Catalyst 2950
Catalyst 3500xl
Catalyst 3550
Catalyst 4908g-l3
Catalyst 8500
Distributed director
Sn 5420 storage router
Pix firewall manager
ICDN
Ubr920
Ubr924
Ubr925
Call manager
Aironet ap350
Ata-186
Content distribution manager 4630
Content distribution manager 4650
Content engine
Cache engine 505
Cache engine 550
Cache engine 570
Content router 4430
Webns
Vpn 500 concentrator
Iscsi driver
Vpn client
Voip phone cp-7940
Voip phone cp-7910
Voip phone cp-7960
Ids device manager
See all Products for Vendor Cisco


Copyright 2019, cxsecurity.com

 

Back to Top