CVE-2015-0755: Improper Access Control

The Posture module for Cisco Identity Services Engine ISE, as distributed in Cisco AnyConnect Secure Mobility Client 4.064, allows local users to gain privileges via unspecified commands, aka Bug ID CSCut05797...

Mac OS X : Cisco AnyConnect Secure Mobility Client < 3.1.10010.0 / 4.0.x < 4.0.4014.0 / 4.1.x < 4.1.4011.0 Code Execution Vulnerability

The Cisco AnyConnect Secure Mobility Client installed on the remote Mac OS X host is a version prior to 3.1.10010.0, or is version 4.0.x prior to 4.0.4014.0, or version 4.1.x prior to 4.1.4011.0. It is, therefore, affected by a flaw that allows unauthenticated IPC commands to install software as...

CVE-2015-0664: Improper Input Validation

The IPC channel in Cisco AnyConnect Secure Mobility Client 4.0.00051 and earlier allows local users to write to arbitrary userspace memory locations, and consequently gain privileges, via crafted messages, aka Bug ID CSCus79195...

PT-2015-4791

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client version 4.0.00051 and earlier Description The issue allows local users to gain privileges by writing to arbitrary userspace memory locations via crafted messages. Recommendations For Cisco AnyConnect...

CVE-2015-0665

The Hostscan module in Cisco AnyConnect Secure Mobility Client 4.0.00051 and earlier allows local users to write to arbitrary files via crafted IPC messages, aka Bug ID CSCus79173...

CVE-2015-0662: Undefined Security Weakness

Cisco AnyConnect Secure Mobility Client 4.0.00051 and earlier allows local users to gain privileges via crafted IPC messages that trigger use of root privileges for a software-package installation, aka Bug ID CSCus79385...

PT-2015-4792

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client version 4.0.00051 and earlier Description The issue allows local users to write to arbitrary files via crafted IPC messages. Recommendations For Cisco AnyConnect Secure Mobility Client version 4.0.00051...

PT-2015-4790

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client version 4.0.00051 and earlier Description The issue is related to improper implementation of access control for IPC messages, allowing local users to write to arbitrary files via crafted messages...

CVE-2015-0663: Undefined Security Weakness

Cisco AnyConnect Secure Mobility Client 4.0.00051 and earlier does not properly implement access control for IPC messages, which allows local users to write to arbitrary files via crafted messages, aka Bug ID CSCus79392...

CVE-2015-0665: Improper Limitation of a Pathname to a Restricted Directory

The Hostscan module in Cisco AnyConnect Secure Mobility Client 4.0.00051 and earlier allows local users to write to arbitrary files via crafted IPC messages, aka Bug ID CSCus79173...

PT-2015-4789

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client version 4.0.00051 and earlier Description The issue allows local users to gain privileges via crafted IPC messages, triggering the use of root privileges for software-package installation. Recommendation...

CVE-2014-8021: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Cisco AnyConnect Secure Mobility Client 3.1.02043 and earlier and Cisco HostScan Engine 3.1.05183 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving an applet-path URL, aka Bug IDs CSCup82990 and CSCuq80149...

PT-2015-3986

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client version 3.1.02043 and earlier Cisco HostScan Engine version 3.1.05183 and earlier Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via vectors...

Buffer overflow

Buffer overflow in the Active Template Library ATL framework in the VPNAPI COM module in Cisco AnyConnect Secure Mobility Client 2.x allows user-assisted remote attackers to execute arbitrary code via a crafted HTML document, aka Bug ID CSCuj58139...

CVE-2013-5559: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the Active Template Library ATL framework in the VPNAPI COM module in Cisco AnyConnect Secure Mobility Client 2.x allows user-assisted remote attackers to execute arbitrary code via a crafted HTML document, aka Bug ID CSCuj58139...

PT-2013-5639

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client versions 2.x Description The issue is related to a buffer overflow in the Active Template Library ATL framework within the VPNAPI COM module. This allows remote attackers to execute arbitrary code when a...

CVE-2013-1130: Undefined Security Weakness

Cisco AnyConnect Secure Mobility Client on Mac OS X uses weak permissions for a library directory, which allows local users to gain privileges via a crafted library file, aka Bug ID CSCue33619...

PT-2013-2900

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client affected versions not specified Description The issue is related to weak permissions for a library directory in Cisco AnyConnect Secure Mobility Client on Mac OS X, allowing local users to gain privilege...

CVE-2013-1173

CVE-2013-1173 is a heap-based buffer overflow in ciscod.exe within the Cisco Security Service of Cisco AnyConnect Secure Mobility Client. Exploitation enables local privilege escalation to SYSTEM. Affected: Cisco AnyConnect Secure Mobility Client (Host Scan component) with vulnerable host-scan ha...

PT-2013-2940

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client affected versions not specified Description The issue is related to the Cisco Security Service in Cisco AnyConnect Secure Mobility Client, which does not properly verify files. This allows local users to...