CVE-2018-0253: Improper Input Validation

A vulnerability in the ACS Report component of Cisco Secure Access Control System ACS could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected system. Commands executed by the attacker are processed at the targeted user's privilege level. The vulnerability is d...

CVE-2018-0147: Improper Input Validation

A vulnerability in Java deserialization used by Cisco Secure Access Control System ACS prior to release 5.8 patch 9 could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by...

CVE-2017-6769: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of the Cisco Secure Access Control System ACS could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the web interface of the affected system. More Information: CSCve70587. Known...

PT-2017-3756

Name of the Vulnerable Software and Affected Versions: Cisco Secure Access Control System ACS versions prior to 5.8 Patch 7 Description: A vulnerability in the ACS Report component of Cisco Secure Access Control System ACS could allow an unauthenticated, remote attacker to execute arbitrary...

CVE-2017-3840: URL Redirection to Untrusted Site

A vulnerability in the web interface of the Cisco Secure Access Control System ACS could allow an unauthenticated, remote attacker to redirect a user to a malicious web page, aka an Open Redirect Vulnerability. More Information: CSCvc04849. Known Affected Releases: 5.82.5...

PT-2017-16134

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control System ACS version 5.82.5 Description A DOM-based cross-site scripting XSS attack can be conducted by an unauthenticated, remote attacker against the user of the web interface of the affected system. Recommendations...

PT-2017-16135

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control System ACS version 5.82.5 Description An XML External Entity issue in the web-based user interface could allow an unauthenticated, remote attacker to have read access to part of the information stored in the affecte...

PT-2017-16137

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control System ACS version 5.82.5 Description A vulnerability in the web interface could allow an unauthenticated, remote attacker to disclose sensitive information. Recommendations For version 5.82.5, at the moment, there ...

CVE-2017-3839: Improper Restriction of XML External Entity Reference

An XML External Entity vulnerability in the web-based user interface of the Cisco Secure Access Control System ACS could allow an unauthenticated, remote attacker to have read access to part of the information stored in the affected system. More Information: CSCvc04845. Known Affected Releases:...

CVE-2017-3841: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability in the web interface of the Cisco Secure Access Control System ACS could allow an unauthenticated, remote attacker to disclose sensitive information. More Information: CSCvc04854. Known Affected Releases: 5.82.5...

CVE-2017-3838: Improper Neutralization of Input During Web Page Generation

A vulnerability in Cisco Secure Access Control System ACS could allow an unauthenticated, remote attacker to conduct a DOM-based cross-site scripting XSS attack against the user of the web interface of the affected system. More Information: CSCvc04838. Known Affected Releases: 5.82.5...

PT-2017-16136

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control System ACS version 5.82.5 Description A vulnerability in the web interface could allow an unauthenticated, remote attacker to redirect a user to a malicious web page, also known as an Open Redirect issue...

PT-2015-1024

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control System ACS versions prior to 5.5 patch 7 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands via crafted HTTPS requests. This is due to multiple SQL injection...

PT-2015-3990

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control System ACS affected versions not specified Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the web framework of Cisco Secure Access Control System ACS. These vulnerabilities allow...

PT-2015-3991

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control System ACS affected versions not specified Description The issue concerns an open redirect vulnerability in the web interface. This allows remote attackers to redirect users to arbitrary web sites, potentially leadi...

PT-2015-3989

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control System ACS affected versions not specified Description The issue in the RBAC component allows remote authenticated users to gain Network Device Administrator privileges for certain operations by sending crafted HTTP...

CVE-2014-8028: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the web framework in Cisco Secure Access Control System ACS allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuq79019...

PT-2014-3773

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control System ACS affected versions not specified Description The issue concerns the portal interface in Cisco Secure Access Control System ACS that does not properly manage sessions. This allows remote authenticated users...

PT-2014-3763

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control System ACS affected versions not specified Description A cross-site scripting XSS issue in the portal of Cisco Secure Access Control System ACS allows remote attackers to inject arbitrary web script or HTML via an...

CVE-2014-0668: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the portal in Cisco Secure Access Control System ACS allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCue65949...