CVE-2014-3399: Improper Control of Generation of Code

The SSL VPN implementation in Cisco Adaptive Security Appliance ASA Software 9.2.2.4 and earlier does not properly manage session information during creation of a SharePoint handler, which allows remote authenticated users to overwrite arbitrary RAMFS cache files or inject Lua programs, and...

Cisco ASA Software Version Information Disclosure Vulnerability

A vulnerability in the SSL VPN code of Cisco ASA Software could allow an unauthenticated, remote attacker to obtain information about the Cisco ASA Software version. This information could be used for reconnaissance attacks. The vulnerability is due to verbose output returned when a specific URL ...

CVE-2014-3398

Cisco ASA SSL VPN Information Disclosure (CVE-2014-3398) affects ASA Software. An unauthenticated, remote attacker can obtain the device software version by requesting a URL and triggering verbose response data disclosure (e.g., via SSL VPN URL endpoints). Root cause is verbose output returned by...

CVE-2013-6691

The WebVPN CIFS implementation in Cisco Adaptive Security Appliance ASA Software 9.0.4.1 and earlier allows remote CIFS servers to cause a denial of service device reload via a long share list, aka Bug ID CSCuj83344...

Code injection

The WebVPN CIFS implementation in Cisco Adaptive Security Appliance ASA Software 9.0.4.1 and earlier allows remote CIFS servers to cause a denial of service device reload via a long share list, aka Bug ID CSCuj83344...

CVE-2013-5567: Uncontrolled Resource Consumption

Cisco Adaptive Security Appliance ASA Software 8.4.6 and earlier, when using an unsupported configuration with overlapping criteria for filtering and inspection, allows remote attackers to cause a denial of service traffic loop and device crash via a packet that triggers multiple matches, aka Bug...

CVE-2014-2151

The WebVPN portal in Cisco Adaptive Security Appliance ASA Software 8.4.7.15 and earlier allows remote authenticated users to obtain sensitive information via a crafted JavaScript file, aka Bug ID CSCui04520...

CVE-2014-3264: Undefined Security Weakness

Cisco Adaptive Security Appliance ASA Software 9.1.5 and earlier allows remote authenticated users to cause a denial of service device reload via crafted attributes in a RADIUS packet, aka Bug ID CSCun69561...

CVE-2014-2181: Improper Authentication

Cisco Adaptive Security Appliance ASA Software allows remote authenticated users to read files by sending a crafted URL to the HTTP server, as demonstrated by reading the running configuration, aka Bug ID CSCun78551...

CVE-2014-2182: Improper Input Validation

Cisco Adaptive Security Appliance ASA Software, when DHCPv6 replay is configured, allows remote attackers to cause a denial of service device reload via a crafted DHCPv6 packet, aka Bug ID CSCun45520...

CVE-2014-2128

The SSL VPN implementation in Cisco Adaptive Security Appliance ASA Software 8.2 before 8.25.47, 8.3 before 8.32.40, 8.4 before 8.47.3, 8.6 before 8.61.13, 9.0 before 9.03.8, and 9.1 before 9.13.2 allows remote attackers to bypass authentication via 1 a crafted cookie value within modified HTTP...

CVE-2014-2127

Cisco Adaptive Security Appliance ASA Software 8.x before 8.25.48, 8.3 before 8.32.40, 8.4 before 8.47.9, 8.6 before 8.61.13, 9.0 before 9.04.1, and 9.1 before 9.14.3 does not properly process management-session information during privilege validation for SSL VPN portal connections, which allows...

CVE-2014-2126

Cisco Adaptive Security Appliance ASA Software 8.2 before 8.25.47, 8.4 before 8.47.5, 8.7 before 8.71.11, 9.0 before 9.03.10, and 9.1 before 9.13.4 allows remote authenticated users to gain privileges by leveraging level-0 ASDM access, aka Bug ID CSCuj33496...

CVE-2014-2127: Improper Input Validation

Cisco Adaptive Security Appliance ASA Software 8.x before 8.25.48, 8.3 before 8.32.40, 8.4 before 8.47.9, 8.6 before 8.61.13, 9.0 before 9.04.1, and 9.1 before 9.14.3 does not properly process management-session information during privilege validation for SSL VPN portal connections, which allows...

CVE-2014-2128: Improper Authentication

The SSL VPN implementation in Cisco Adaptive Security Appliance ASA Software 8.2 before 8.25.47, 8.3 before 8.32.40, 8.4 before 8.47.3, 8.6 before 8.61.13, 9.0 before 9.03.8, and 9.1 before 9.13.2 allows remote attackers to bypass authentication via 1 a crafted cookie value within modified HTTP...

CVE-2014-2120

Cross-site scripting XSS vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance ASA Software allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun19025...

CVE-2014-2120

Cross-site scripting XSS vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance ASA Software allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun19025...

CVE-2014-2120

CVE-2014-2120 affects Cisco ASA WebVPN login page, with a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary script/HTML via an unspecified parameter (Bug ID CSCun19025). Multiple sources (Cisco advisory, NVD/NIST CVE entry, CISCO-SA, OpenVAS) consistently d...

PT-2014-2059 · Cisco · Cisco Asa

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software affected versions not specified Description: The issue is a cross-site scripting XSS vulnerability in the WebVPN login page of Cisco Adaptive Security Appliance ASA Software. This vulnerability...

CVE-2014-0738

The Phone Proxy component in Cisco Adaptive Security Appliance ASA Software 9.1.3 and earlier allows remote attackers to bypass authentication and change trust relationships by injecting a Certificate Trust List CTL file, aka Bug ID CSCuj66770...