CVE-2021-1561 Cisco Secure Email and Web Manager Spam Quarantine Unauthorized Access Vulnerability

A vulnerability in the spam quarantine feature of Cisco Secure Email and Web Manager, formerly Cisco Security Management Appliance SMA, could allow an authenticated, remote attacker to gain unauthorized access and modify the spam quarantine settings of another user. This vulnerability exists...

Threat Source newsletter (March 4, 2021)

Newsletter compiled by Jon Munshaw. Of course, we will start things off talking about the Microsoft Exchange Server zero-day vulnerabilities disclosed earlier this week. Microsoft said in a statement that a threat actor is exploiting these vulnerabilities in the wild to steal users’ emails,...

Cisco Secure Web Appliance Elevation of Privilege Vulnerability

Cisco AsyncOS is an operating system for Cisco devices from Cisco USA. Cisco AsyncOS for the Cisco Secure Web Appliance suffers from an operating system command injection vulnerability that stems from insufficient validation of user-supplied web interface and CLI input. The vulnerability can be...

CVE-2020-3367 Cisco Secure Web Appliance Privilege Escalation Vulnerability

A vulnerability in the log subscription subsystem of Cisco AsyncOS for the Cisco Secure Web Appliance formerly Web Security Appliance could allow an authenticated, local attacker to perform command injection and elevate privileges to root. This vulnerability is due to insufficient validation of...

CVE-2020-3367

The CVE-2020-3367 issue affects Cisco AsyncOS for the Cisco Secure Web Appliance (WSA). It targets the log subscription subsystem where insufficient validation of user-supplied input enables an authenticated, local attacker to inject commands via the web interface or CLI and elevate to root. Impa...

Cisco Secure ACS Unauthorized Password Change

This module exploits an authentication bypass issue which allows arbitrary password change requests to be issued for any user in the local store. Instances of Secure ACS running version 5.1 with patches 3, 4, or 5 as well as version 5.2 with either no patches or patches 1 and 2 are vulnerable. Th...

PT-2019-2446 · Cisco · Cisco Secure Boot +1

Name of the Vulnerable Software and Affected Versions: Cisco products that support hardware-based Secure Boot functionality affected versions not specified Description: A vulnerability in the logic that handles access control to one of the hardware components in Cisco's proprietary Secure Boot...

The vulnerability of the web interface of the Cisco Secure Access Control System allows a perpetrator to access confidential information.

The vulnerability of the Cisco Secure Access Control System’s web interface is related to incorrect processing of external XML entities when working with XML files. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information...

The vulnerability in the web interface of the Cisco Secure ACS control system allows a perpetrator to execute stored scripts across sites.

The vulnerability in the Cisco Secure ACS access control system’s web interface management interface is related to improper verification and the absence of encryption for user data. Exploiting this vulnerability allows a malicious actor to remotely execute stored scripts against the user’s web...

The vulnerability of the Cisco Secure ACS access control system’s web interface allows a perpetrator to gain access to confidential information.

The vulnerability in the Cisco Secure ACS access control system’s web interface is related to improper processing of external XML entities when working with XML files. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information...

Xxe

A vulnerability in the web-based UI of Cisco Secure Access Control Server could allow an authenticated, remote attacker to gain read access to certain information in an affected system. The vulnerability is due to improper handling of XML External Entities XXEs when parsing an XML file. An attack...

CVE-2018-15370

CVE-2018-15370 affects Cisco IOS ROM Monitor (ROMMON) on Catalyst 6800 Series switches. A hidden command in ROMMON enables an unauthenticated, local attacker to force the device into ROMMON mode via the console and write a malicious pattern to a memory address, bypassing Cisco Secure Boot signatu...

Local Security Bypass Vulnerability in IOS ROM Monitor Software for Multiple Cisco Products

Cisco Catalyst 6800 Series Supervisor Engine 6T and others are switch products from Cisco USA. the IOS ROM Monitor ROMMON Software is one of the set of ROM monitoring software for iOS devices. A privilege license and access control vulnerability exists in IOS ROMMON Software in multiple Cisco...

Cisco Secure Access Control System Remote Code Execution Vulnerability

Cisco Secure Access Control System ACS is the United States Cisco Cisco a set of security access control system. The system can be through the RADIUS, TACACS protocol for network access and network device access control respectively. ACS Report is one of the system report generation component. An...

CVE-2018-0253

A vulnerability in the ACS Report component of Cisco Secure Access Control System ACS could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected system. Commands executed by the attacker are processed at the targeted user's privilege level. The vulnerability is d...

CVE-2018-0253

A vulnerability in the ACS Report component of Cisco Secure Access Control System ACS could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected system. Commands executed by the attacker are processed at the targeted user's privilege level. The vulnerability is d...

Cisco Secure Access Control Multiple Vulnerabilities (cisco-sa-20180307-acs1 / cisco-sa-20180307-acs2)

The version of Cisco Secure Access Control System ACS running on the remote host is prior to 5.8.0.32.9 Cumulative Patch. It is, therefore, affected by multiple vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Cisco Secure Access Control Server XML External Entity Injection Vulnerability (CNVD-2018-05230)

Cisco Secure Access Control Server ACS is a secure access control server from Cisco USA. The server provides a comprehensive identity-based access control solution for Cisco intelligent information networks. An XML external entity injection vulnerability exists in the Web-based user interface in...

Hard-Coded Password in Cisco Software Lets Attackers Take Over Linux Servers

A medium yet critical vulnerability has been discovered in Cisco Prime Collaboration Provisioning software that could allow a local attacker to elevate privileges to root and take full control of a system. Cisco Prime Collaboration Provisioning PCP application allows administrators to remotely...

CVE-2018-0147

A vulnerability in Java deserialization used by Cisco Secure Access Control System ACS prior to release 5.8 patch 9 could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by...