Security feature bypass

A vulnerability in the Network Access Manager NAM of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker to enable multiple network adapters, aka a Dual-Homed Interface vulnerability. The vulnerability is due to insufficient NAM policy enforcement. An attacker cou...

CVE-2017-12268

Cisco AnyConnect Secure Mobility Client’s Network Access Manager (NAM) contains a local, authenticated vulnerability that allows enabling multiple network adapters (Dual-Homed Interface) due to insufficient NAM policy enforcement. An attacker could manipulate device interfaces to sustain multiple...

CVE-2017-12268

A vulnerability in the Network Access Manager NAM of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker to enable multiple network adapters, aka a Dual-Homed Interface vulnerability. The vulnerability is due to insufficient NAM policy enforcement. An attacker cou...

Cisco AnyConnect Network Access Manager Dual-Homed Interface Vulnerability

A vulnerability in the Network Access Manager NAM of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker to enable multiple network adapters. The vulnerability is due to insufficient NAM policy enforcement. An attacker could exploit this vulnerability by...

XenMobile Server and support for Cisco AnyConnect and Legacy AnyConnect clients

Last June 9 2017, Cisco announced the transition from the VPNPlugin deprecated VPN framework to the latest iOS VPN framework Network Extension in order to provide a more reliable connection to internal resources and support for UDP and TCP applications with Per-App VPN. On June 14 2017, Cisco...

CVE-2017-6788

The WebLaunch functionality of Cisco AnyConnect Secure Mobility Client Software contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the affected software. The vulnerability is due to insufficient input...

Cross site scripting

The WebLaunch functionality of Cisco AnyConnect Secure Mobility Client Software contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the affected software. The vulnerability is due to insufficient input...

CVE-2017-6788

The WebLaunch functionality of Cisco AnyConnect Secure Mobility Client Software contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the affected software. The vulnerability is due to insufficient input...

CVE-2017-6788

The CVE-2017-6788 issue affects Cisco AnyConnect Secure Mobility Client’s WebLaunch feature. Root cause: insufficient input validation of parameters passed to WebLaunch enables stored/reflected XSS when a user is induced to visit a crafted link or when a request is intercepted and modified. Affec...

CVE-2017-6788

The WebLaunch functionality of Cisco AnyConnect Secure Mobility Client Software contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the affected software. The vulnerability is due to insufficient input...

Cisco AnyConnect Secure Mobility Client Software Cross-Site Scripting Vulnerability

The Cisco AnyConnect Secure Mobility Client is Cisco's next-generation VPN client. Cisco AnyConnect Secure Mobility Client suffers from a cross-site scripting vulnerability in the WebLaunch feature, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code...

Cisco AnyConnect WebLaunch Cross-Site Scripting Vulnerability

The WebLaunch functionality of Cisco AnyConnect Secure Mobility Client Software contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the affected software. The vulnerability is due to insufficient input...

The vulnerability in the loading of DLL files of the Cisco AnyConnect Secure Mobility Client software allows a perpetrator to install or execute a file with privileges equivalent to those of a Microsoft Windows system administrator account.

The vulnerability related to the loading of DLL files in the Cisco AnyConnect Secure Mobility Client encryption solution stems from deficiencies in access control. Exploiting this vulnerability allows a malicious actor, operating locally, to install or execute a DLL file with privileges equivalen...

Cisco AnyConnect Secure Mobility Client < 4.4.02034 Local Privilege Escalation

The version of Cisco AnyConnect Secure Mobility Client installed on the remote Windows host is prior to 4.4.02034. It is, therefore, affected by a local privilege escalation vulnerability due to improper validation of paths and filenames of dynamic-link library DLL files before they are loaded. A...

Cisco AnyConnect Secure Mobility Client Local Elevation of Privilege Vulnerability

The Cisco AnyConnect Secure Mobility Client is Cisco's next-generation VPN client. The Cisco AnyConnect Secure Mobility Client has a security vulnerability in the way DLL files are loaded, which can be exploited by a remote attacker to install and run executable files with system privileges...

Input validation

A vulnerability in how DLL files are loaded with Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to install and run an executable file with privileges equivalent to the Microsoft Windows SYSTEM account. The vulnerability is due to incomplete input...

CVE-2017-6638

A vulnerability in how DLL files are loaded with Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to install and run an executable file with privileges equivalent to the Microsoft Windows SYSTEM account. The vulnerability is due to incomplete input...

CVE-2017-6638

A vulnerability in how DLL files are loaded with Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to install and run an executable file with privileges equivalent to the Microsoft Windows SYSTEM account. The vulnerability is due to incomplete input...

CVE-2017-6638

A vulnerability in how DLL files are loaded with Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to install and run an executable file with privileges equivalent to the Microsoft Windows SYSTEM account. The vulnerability is due to incomplete input...

CVE-2017-6638

Cisco AnyConnect Secure Mobility Client for Windows versions prior to 4.4.02034 are affected by a local privilege escalation vulnerability due to incomplete input validation when loading DLLs. An authenticated local attacker who can place a malicious DLL in a system directory could exploit this t...