CVE-2015-6346: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Cisco Secure Access Control Server ACS 5.70.15 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

PT-2015-2591

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control Server ACS version 5.70.15 Description The issue is related to a SQL injection vulnerability in the Solution Engine component. This vulnerability allows remote authenticated users to execute arbitrary SQL commands v...

CVE-2015-6348: Undefined Security Weakness

The report-generation web interface in the Solution Engine in Cisco Secure Access Control Server ACS 5.70.15 allows remote authenticated users to bypass intended RBAC restrictions, and read report or status information, by visiting an unspecified web page...

CVE-2015-6347: Undefined Security Weakness

The Solution Engine in Cisco Secure Access Control Server ACS 5.70.15 allows remote authenticated users to bypass intended RBAC restrictions, and create a dashboard or portlet, by visiting an unspecified web page...

PT-2015-2587

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control Server ACS version 5.70.15 Description The issue exists due to insufficient protection of the web page structure in the Solution Engine component of the Cisco Secure Access Control System. This allows a remote...

PT-2015-2588

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control Server ACS version 5.70.15 Description The issue concerns the report-generation web interface in the Solution Engine component, which has inadequate access control restrictions. This allows a remote authenticated us...

PT-2015-7164

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control Server ACS Solution Engine version 5.70.15 Description The issue allows remote authenticated users to cause a denial of service, resulting in an SSH screen process crash. This can be achieved via crafted commands,...

CVE-2015-6300: Improper Input Validation

Cisco Secure Access Control Server ACS Solution Engine 5.70.15 allows remote authenticated users to cause a denial of service SSH screen process crash via crafted 1 CLI or 2 GUI commands, aka Bug ID CSCuw24694...

CVE-2014-2130: Undefined Security Weakness

Cisco Secure Access Control Server ACS provides an unintentional administration web interface based on Apache Tomcat, which allows remote authenticated users to modify application files and configuration files, and consequently execute arbitrary code, by leveraging administrative privileges, aka...

CVE-2013-3466: Improper Authentication

The EAP-FAST authentication module in Cisco Secure Access Control Server ACS 4.x before 4.2.1.15.11, when a RADIUS server configuration is enabled, does not properly parse user identities, which allows remote attackers to execute arbitrary commands via crafted EAP-FAST packets, aka Bug ID...

PT-2012-1684

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control Server ACS version 5.2 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities in the Solution Engine. These vulnerabilities allow remote attackers to hijack the authentication of...

PT-2012-1687

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control Server ACS version 5.2 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the Solution Engine of Cisco Secure Access Control Server ACS. These vulnerabilities allow remote attackers ...

CVE-2011-3317: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Solution Engine in Cisco Secure Access Control Server ACS 5.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCtr78192...

CVE-2011-3293: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Solution Engine in Cisco Secure Access Control Server ACS 5.2 allow remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting XSS sequences, aka Bug ID CSCtr78143...

CVE-2006-4098: Undefined Security Weakness

Stack-based buffer overflow in the CSRadius service in Cisco Secure Access Control Server ACS for Windows before 4.1 and ACS Solution Engine before 4.1 allows remote attackers to execute arbitrary code via a crafted RADIUS Accounting-Request packet...

CVE-2006-3226: Undefined Security Weakness

Cisco Secure Access Control Server ACS 4.x for Windows uses the client's IP address and the server's port number to grant access to an HTTP server port for an administration session, which allows remote attackers to bypass authentication via various methods, aka "ACS Weak Session Management...

CVE-2006-0561: Undefined Security Weakness

Cisco Secure Access Control Server ACS 3.x for Windows stores ACS administrator passwords and the master key in the registry with insecure permissions, which allows local users and remote administrators to decrypt the passwords by using Microsoft's cryptographic API functions to obtain the...

CVE-2004-1458: Undefined Security Weakness

The CSAdmin web administration interface for Cisco Secure Access Control Server ACS 3.22 build 15 allows remote attackers to cause a denial of service hang via a flood of TCP connections to port 2002...

CVE-2004-1460: Undefined Security Weakness

Cisco Secure Access Control Server ACS 3.23 and earlier, when configured with an anonymous bind in Novell Directory Services NDS and authenticating NDS users with NDS, allows remote attackers to gain unauthorized access to AAA clients via a blank password...

CVE-2004-1459: Undefined Security Weakness

Cisco Secure Access Control Server ACS 3.2, when configured as a Light Extensible Authentication Protocol LEAP RADIUS proxy, allows remote attackers to cause a denial of service device crash via certain LEAP authentication requests...