CVE-2015-4219: Exposure of Sensitive Information to an Unauthorized Actor

Cisco Secure Access Control System before 5.40.46.2 and 5.5 before 5.50.46 and Cisco Identity Services Engine 1.04.573 do not properly implement access control for support bundles, which allows remote authenticated users to obtain sensitive information via brute-force attempts to send valid...

The vulnerability of Cisco ACS’s microprogramming software allows a remote attacker to execute arbitrary code.

The vulnerability of the ACS View interface allows a remote authenticated user with administrator privileges to execute arbitrary SQL commands using specially crafted HTTPS requests...

Cisco Secure Access Control System SQLi Vulnerability (cisco-sa-20150211-csacs)

The version of Cisco Secure Access Control System ACS running on the remote host is prior to 5.5 patch 7. It is, therefore, affected by a SQL injection vulnerability due to not properly sanitizing user input to the ACS View reporting interface pages. An authenticated, remote attacker, using craft...

Cisco Secure Access Control System SQL injection

SQL injection via Web interface...

CVE-2015-0580

Summary: CVE-2015-0580 affects Cisco Secure Access Control System (ACS) prior to 5.5 patch 7, via multiple SQL injection flaws in the ACS View reporting interface. An authenticated remote attacker can craft HTTPS requests to disclose or modify data in ACS View databases due to improper input sani...

CVE-2015-0580: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the ACS View reporting interface pages in Cisco Secure Access Control System ACS before 5.5 patch 7 allow remote authenticated administrators to execute arbitrary SQL commands via crafted HTTPS requests, aka Bug ID CSCuq79027...

Cisco Secure Access Control System SQL Injection Vulnerability

Cisco Secure Access Control System ACS prior to version 5.5 patch 8 is vulnerable to a SQL injection attack in the ACS View reporting interface pages. A successful attack could allow an authenticated, remote attacker to access and modify information such as RADIUS accounting records stored in one...

CVE-2014-8029

Open redirect vulnerability in the web interface in Cisco Secure Access Control System ACS allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter, aka Bug ID CSCuq74150...

Open redirect

Open redirect vulnerability in the web interface in Cisco Secure Access Control System ACS allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter, aka Bug ID CSCuq74150...

CVE-2014-8028

Cisco Secure ACS (Access Control Server) is affected by multiple cross-site scripting (XSS) vulnerabilities in its web framework. The issue stems from insufficient input validation of several parameters passed to the web server, allowing remote attackers to craft links that persuade users to exec...

CVE-2014-8029

CVE-2014-8029 affects Cisco Secure Access Control Server (ACS) web interface. It is a open redirect vulnerability due to insufficient input validation of a specific parameter, enabling an unauthenticated, remote attacker to lure users to arbitrary sites and conduct phishing via a crafted link. Ci...

CVE-2014-8028

Multiple cross-site scripting XSS vulnerabilities in the web framework in Cisco Secure Access Control System ACS allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuq79019...

CVE-2014-8029: Undefined Security Weakness

Open redirect vulnerability in the web interface in Cisco Secure Access Control System ACS allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter, aka Bug ID CSCuq74150...

CVE-2014-8027: Undefined Security Weakness

The RBAC component in Cisco Secure Access Control System ACS allows remote authenticated users to obtain Network Device Administrator privileges for Create, Delete, Read, and Update operations via crafted HTTP requests, aka Bug ID CSCuq79034...

CVE-2014-8028: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the web framework in Cisco Secure Access Control System ACS allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuq79019...

Cisco Secure ACS Portal Interface Session Hijacking

The version of Cisco Secure Access Control System ACS on the remote host is affected by a vulnerability in the Portal Interface. Due to insufficient session management, this could allow a remote, authenticated attacker to perform actions in the portal with the privileges of another user. C Tenabl...

Cisco Secure ACS Portal Session Management Vulnerability

A vulnerability in the portal interface of Cisco Secure Access Control System ACS could allow an authenticated, remote attacker to access the portal with the access capabilities of another user. The vulnerability is due to insufficient session management in the portal. An attacker could exploit...

Design/Logic Flaw

The portal interface in Cisco Secure Access Control System ACS does not properly manage sessions, which allows remote authenticated users to hijack sessions and gain privileges via unspecified vectors, aka Bug ID CSCue65951...

CVE-2014-0678

The portal interface in Cisco Secure Access Control System ACS does not properly manage sessions, which allows remote authenticated users to hijack sessions and gain privileges via unspecified vectors, aka Bug ID CSCue65951...

CVE-2014-0678: Undefined Security Weakness

The portal interface in Cisco Secure Access Control System ACS does not properly manage sessions, which allows remote authenticated users to hijack sessions and gain privileges via unspecified vectors, aka Bug ID CSCue65951...