Cross site scripting

Cross-site scripting XSS vulnerability in the Help index page in Cisco Secure Access Control System ACS allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCud75170...

CVE-2013-3421

Cross-site scripting XSS vulnerability in the Help index page in Cisco Secure Access Control System ACS allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCud75170...

Cross site scripting

Cross-site scripting XSS vulnerability in the web interface in Cisco Secure Access Control System ACS allows remote attackers to inject arbitrary web script or HTML via an unspecified field, aka Bug ID CSCud75174...

CVE-2013-3421

Cross-site scripting XSS vulnerability in the Help index page in Cisco Secure Access Control System ACS allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCud75170...

CVE-2013-3421

CVE-2013-3421 (Cisco ACS) describes a Cross-Site Scripting (XSS) vulnerability on the Help index page of Cisco Secure Access Control System (ACS). The issue arises from insufficient input validation of a parameter, enabling an unauthenticated, remote attacker to inject arbitrary script or HTML wh...

CVE-2013-3424

Cisco ACS is affected by CVE-2013-3424: a CSRF vulnerability in the Administration and View pages could allow an unauthenticated/remote attacker to hijack the authentication of a user (Bug CSCud75177). Impact per sources includes potential actions taken in the context of an authenticated session ...

CVE-2013-3424

Cross-site request forgery CSRF vulnerability in Administration and View pages in Cisco Secure Access Control System ACS allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCud75177...

CVE-2013-3422

CVE-2013-3422 describes a Cross-Site Scripting (XSS) vulnerability in the Administration pages of Cisco Secure Access Control System (ACS). The root cause is insufficient input validation of a parameter, allowing unauthenticated, remote attackers to craft links that execute arbitrary web script o...

CVE-2013-3380

The administrative web interface in the Access Control Server in Cisco Secure Access Control System ACS does not properly restrict the report view page, which allows remote authenticated users to obtain sensitive information via a direct request, aka Bug ID CSCue79279...

Information disclosure

The administrative web interface in the Access Control Server in Cisco Secure Access Control System ACS does not properly restrict the report view page, which allows remote authenticated users to obtain sensitive information via a direct request, aka Bug ID CSCue79279...

CVE-2013-3380

The administrative web interface in the Access Control Server in Cisco Secure Access Control System ACS does not properly restrict the report view page, which allows remote authenticated users to obtain sensitive information via a direct request, aka Bug ID CSCue79279...

CVE-2013-3380

The advisory concerns Cisco Secure Access Control System (ACS) and its administrative web interface. The issue is a failure to properly restrict the report view page, allowing remote authenticated users to view potentially sensitive information via a direct request (Bug ID CSCue79279). Exploitati...

Cisco Secure Access Control System Session Fixation Web Vulnerability

A vulnerability in the web interface of Cisco Secure Access Control System ACS could allow an unauthenticated, remote attacker to acquire the session identifier of another user's session. The vulnerability is due to the lack of session identifier regeneration. An attacker could exploit this...

CVE-2013-1200

Session fixation vulnerability in Cisco Secure Access Control System ACS allows remote attackers to hijack web sessions via unspecified vectors, aka Bug ID CSCud95787...

Session fixation

Session fixation vulnerability in Cisco Secure Access Control System ACS allows remote attackers to hijack web sessions via unspecified vectors, aka Bug ID CSCud95787...

CVE-2013-1200

Cisco Secure Access Control System (ACS) is affected by a session fixation vulnerability tied to the lack of session identifier regeneration. An unauthenticated, remote attacker could hijack another user’s web session by capturing or reusing an existing session ID. The issue is documented as CVE-...

CVE-2013-1200

Session fixation vulnerability in Cisco Secure Access Control System ACS allows remote attackers to hijack web sessions via unspecified vectors, aka Bug ID CSCud95787...

CVE-2013-1196

The command-line interface in Cisco Secure Access Control System ACS, Identity Services Engine Software, Context Directory Agent, Application Networking Manager ANM, Prime Network Control System, Prime LAN Management Solution LMS, Prime Collaboration, Unified Provisioning Manager, Network Service...

Cisco Secure Access Control System authentication bypass

Insufficient password check if TACACS+ authentication is used with LDAP...

CVE-2012-5424

Cisco Secure Access Control System ACS 5.x before 5.2 Patch 11 and 5.3 before 5.3 Patch 7, when a certain configuration involving TACACS+ and LDAP is used, does not properly validate passwords, which allows remote attackers to bypass authentication by sending a valid username and a crafted passwo...