CVE-2015-0580

Summary: CVE-2015-0580 affects Cisco Secure Access Control System (ACS) prior to 5.5 patch 7, via multiple SQL injection flaws in the ACS View reporting interface. An authenticated remote attacker can craft HTTPS requests to disclose or modify data in ACS View databases due to improper input sani...

Cisco Secure Access Control System SQL Injection Vulnerability

Cisco Secure Access Control System ACS prior to version 5.5 patch 8 is vulnerable to a SQL injection attack in the ACS View reporting interface pages. A successful attack could allow an authenticated, remote attacker to access and modify information such as RADIUS accounting records stored in one...

CVE-2014-8029

Open redirect vulnerability in the web interface in Cisco Secure Access Control System ACS allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter, aka Bug ID CSCuq74150...

Open redirect

Open redirect vulnerability in the web interface in Cisco Secure Access Control System ACS allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter, aka Bug ID CSCuq74150...

CVE-2014-8028

Cisco Secure ACS (Access Control Server) is affected by multiple cross-site scripting (XSS) vulnerabilities in its web framework. The issue stems from insufficient input validation of several parameters passed to the web server, allowing remote attackers to craft links that persuade users to exec...

CVE-2014-8029

CVE-2014-8029 affects Cisco Secure Access Control Server (ACS) web interface. It is a open redirect vulnerability due to insufficient input validation of a specific parameter, enabling an unauthenticated, remote attacker to lure users to arbitrary sites and conduct phishing via a crafted link. Ci...

CVE-2014-8028

Multiple cross-site scripting XSS vulnerabilities in the web framework in Cisco Secure Access Control System ACS allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuq79019...

Cisco Secure ACS Portal Interface Session Hijacking

The version of Cisco Secure Access Control System ACS on the remote host is affected by a vulnerability in the Portal Interface. Due to insufficient session management, this could allow a remote, authenticated attacker to perform actions in the portal with the privileges of another user. C Tenabl...

Cisco Secure ACS Portal Session Management Vulnerability

A vulnerability in the portal interface of Cisco Secure Access Control System ACS could allow an authenticated, remote attacker to access the portal with the access capabilities of another user. The vulnerability is due to insufficient session management in the portal. An attacker could exploit...

Design/Logic Flaw

The portal interface in Cisco Secure Access Control System ACS does not properly manage sessions, which allows remote authenticated users to hijack sessions and gain privileges via unspecified vectors, aka Bug ID CSCue65951...

CVE-2014-0678

The portal interface in Cisco Secure Access Control System ACS does not properly manage sessions, which allows remote authenticated users to hijack sessions and gain privileges via unspecified vectors, aka Bug ID CSCue65951...

Cross site scripting

Cross-site scripting XSS vulnerability in the portal in Cisco Secure Access Control System ACS allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCue65949...

CVE-2014-0668

Cisco Secure ACS Portal suffers a cross-site scripting (XSS) vulnerability due to insufficient input validation of a parameter in the ACS portal. This could allow a remote attacker to inject arbitrary script or HTML when a user visits a malicious link. Cisco’s advisory Cisco-SA-20140121-CVE-2014-...

CVE-2014-0650

The web interface in Cisco Secure Access Control System ACS 5.x before 5.4 Patch 3 allows remote attackers to execute arbitrary operating-system commands via a request to this interface, aka Bug ID CSCue65962...

Authorization

The RMI interface in Cisco Secure Access Control System ACS 5.x before 5.5 does not properly enforce authentication and authorization requirements, which allows remote attackers to obtain administrative access via a request to this interface, aka Bug ID CSCud75187...

Design/Logic Flaw

The web interface in Cisco Secure Access Control System ACS 5.x before 5.4 Patch 3 allows remote attackers to execute arbitrary operating-system commands via a request to this interface, aka Bug ID CSCue65962...

Cisco Secure ACS RMI Arbitrary File Read Vulnerability

A vulnerability in the Remote Method Invocation RMI interface of the Cisco Secure Access Control System ACS could allow an authenticated, remote attacker to read arbitrary files on the Cisco Secure ACS server. The vulnerability is due to insufficient authorization enforcement. An attacker could...

CVE-2014-0648

Cisco Secure ACS is affected by CVE-2014-0648 via the RMI interface, where improper authentication/authorization could let remote attackers obtain administrative access through RMI endpoints (ports 2020/2030). The related Cisco advisory (cisco-sa-20140115-csacs) also documents additional RMI-rela...

CVE-2014-0667

Cisco Secure Access Control System (ACS) is affected by CVE-2014-0667 due to insufficient authorization enforcement in the Remote Method Invocation (RMI) interface. A remote, authenticated attacker can read arbitrary files on the ACS server by issuing a crafted request to the RMI interface. The i...

CVE-2014-0667

The RMI interface in Cisco Secure Access Control System ACS does not properly enforce authorization requirements, which allows remote authenticated users to read arbitrary files via a request to this interface, aka Bug ID CSCud75169...