CVE-2013-3414

Cross-site scripting XSS vulnerability in the WebVPN portal login page on Cisco Adaptive Security Appliances ASA devices allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCug83080...

CVE-2013-3414

CVE-2013-3414 affects Cisco ASA devices’ WebVPN portal login page. The vulnerability is an XSS flaw in the WebVPN login page caused by insufficient input validation, enabling remote attackers to inject arbitrary script/HTML via a crafted URL. Multiple sources (Cisco advisory, Nessus, CVE records)...

Cisco ASA Software Cross-Site Scripting Vulnerability

A vulnerability in the WebVPN portal login page of the Cisco ASA could allow an unauthenticated, remote attacker to execute cross-site scripting XSS attacks or hijack user sessions. The vulnerability is due to a failure to properly validate user-supplied input in the WebVPN portal login page. An...

PT-2013-4371 · Cisco · Cisco Asa

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliances ASA devices affected versions not specified Description: A cross-site scripting XSS issue in the WebVPN portal login page allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2013-1243

The IP stack in Cisco Intrusion Prevention System IPS Software in ASA 5500-X IPS-SSP software and hardware modules before 7.15E4, IPS 4500 sensors before 7.16E4, and IPS 4300 sensors before 7.15E4 allows remote attackers to cause a denial of service MainApp process hang via malformed IPv4 packets...

CVE-2013-1218

Cisco Intrusion Prevention System IPS Software in ASA 5500-X IPS-SSP software modules before 7.17sp1E4 allows remote attackers to cause a denial of service Analysis Engine process hang or device reload via fragmented 1 IPv4 or 2 IPv6 packets, aka Bug ID CSCue51272...

Design/Logic Flaw

The IP stack in Cisco Intrusion Prevention System IPS Software in ASA 5500-X IPS-SSP software and hardware modules before 7.15E4, IPS 4500 sensors before 7.16E4, and IPS 4300 sensors before 7.15E4 allows remote attackers to cause a denial of service MainApp process hang via malformed IPv4 packets...

Code injection

Cisco Intrusion Prevention System IPS Software in ASA 5500-X IPS-SSP software modules before 7.17sp1E4 allows remote attackers to cause a denial of service Analysis Engine process hang or device reload via fragmented 1 IPv4 or 2 IPv6 packets, aka Bug ID CSCue51272...

CVE-2013-1218

CVE-2013-1218 affects Cisco IPS Software on ASA 5500-X IPS-SSP modules prior to 7.1(7)sp1E4. The vulnerability arises from handling fragmented IPv4/IPv6 packets, which can cause the DoS condition (Analysis Engine process hang or device reload) on remote attackers over the network (vector: network...

CVE-2013-1243

CVE-2013-1243 affects Cisco IPS Software running on ASA 5500-X IPS-SSP (before 7.1(5)E4), IPS 4500 sensors (before 7.1(6)E4), and IPS 4300 sensors (before 7.1(5)E4). The vulnerability stems from the IP stack misprocessing malformed IPv4 packets, allowing remote unauthenticated attackers to trigge...

CVE-2013-1218

Cisco Intrusion Prevention System IPS Software in ASA 5500-X IPS-SSP software modules before 7.17sp1E4 allows remote attackers to cause a denial of service Analysis Engine process hang or device reload via fragmented 1 IPv4 or 2 IPv6 packets, aka Bug ID CSCue51272...

Cisco ASA NGFW DoS

Fragmented packets DoS...

Cisco June 2013 Security Updates

Cisco’s Product Security Incident Response Team pushed out software updates for four different network security products. The fixes contain workarounds that can help users mitigate multiple denial-of-service and command-injection vulnerabilities recently found in Cisco’s software. The holes exist...

Cisco Releases Security Advisories

Cisco has released four security advisories to address multiple vulnerabilities. These vulnerabilities may allow a remote attacker to execute arbitrary code on a vulnerable system or cause a denial-of-service condition. US-CERT encourages users and administrators to review the following Cisco...

CVE-2013-3382

The Next-Generation Firewall aka NGFW, formerly CX Context-Aware Security module 9.x before 9.1.1.9 and 9.1.2.x before 9.1.2.12 for Cisco Adaptive Security Appliances ASA devices allows remote attackers to cause a denial of service device reload or traffic-processing outage via fragmented 1 IPv4 ...

CVE-2013-3382

CVE-2013-3382 (Cisco ASA NGFW) affects Cisco ASA NGFW module 9.x before 9.1.1.9 and 9.1.2.x before 9.1.2.12. A remote attacker can cause a denial-of-service by sending fragmented IPv4/IPv6 traffic, leading to device reload or traffic-processing outage. Root cause described as Bug CSCue88387. Miti...

Cisco ASA Next-Generation Firewall Fragmented Traffic Denial of Service Vulnerability

Cisco ASA Next-Generation Firewall NGFW Services��contains a Fragmented Traffic Denial of Service DoS vulnerability.�� Successful exploitation of this vulnerability on the Cisco ASA NGFW could cause the device to reload or stop processing user traffic that has been redirected by the parent Cisco...

CVE-2013-1203

Cisco ASA CX Context-Aware Security Software allows remote attackers to cause a denial of service device reload via crafted TCP packets that appear to have been forwarded by a Cisco Adaptive Security Appliances ASA device, aka Bug ID CSCue88386...

Code injection

Cisco ASA CX Context-Aware Security Software allows remote attackers to cause a denial of service device reload via crafted TCP packets that appear to have been forwarded by a Cisco Adaptive Security Appliances ASA device, aka Bug ID CSCue88386...

CVE-2013-1203

Cisco ASA CX Context-Aware Security Software allows remote attackers to cause a denial of service device reload via crafted TCP packets that appear to have been forwarded by a Cisco Adaptive Security Appliances ASA device, aka Bug ID CSCue88386...