575 matches found
Buffer overflow
Multiple buffer overflows in securecgi-bin/CSuserCGI.exe in User-Changeable Password UCP before 4.2 in Cisco Secure Access Control Server ACS for Windows and ACS Solution Engine allow remote attackers to execute arbitrary code via a long argument located immediately after the Logout argument, and...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in securecgi-bin/CSuserCGI.exe in User-Changeable Password UCP before 4.2 in Cisco Secure Access Control Server ACS for Windows and ACS Solution Engine allow remote attackers to inject arbitrary web script or HTML via an argument located immediate...
CVE-2008-0532
CVE-2008-0532 describes a vulnerability in Cisco Secure Access Control Server (ACS) UCP, where multiple buffer overflows in CSuserCGI.exe allow remote code execution. An attacker can exploit a long argument following the Logout parameter to inject and run arbitrary code on affected systems. Affec...
CVE-2008-0532
Multiple buffer overflows in securecgi-bin/CSuserCGI.exe in User-Changeable Password UCP before 4.2 in Cisco Secure Access Control Server ACS for Windows and ACS Solution Engine allow remote attackers to execute arbitrary code via a long argument located immediately after the Logout argument, and...
CVE-2008-0532: Improper Restriction of Operations within the Bounds of a Memory Buffer
Multiple buffer overflows in securecgi-bin/CSuserCGI.exe in User-Changeable Password UCP before 4.2 in Cisco Secure Access Control Server ACS for Windows and ACS Solution Engine allow remote attackers to execute arbitrary code via a long argument located immediately after the Logout argument, and...
CVE-2008-0533: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in securecgi-bin/CSuserCGI.exe in User-Changeable Password UCP before 4.2 in Cisco Secure Access Control Server ACS for Windows and ACS Solution Engine allow remote attackers to inject arbitrary web script or HTML via an argument located immediate...
RecurityLabs_Cisco_ACS_UCP_advisory.txt
Recurity Labs GmbH http://www.recurity-labs.com [email protected] Date: 12.03.2008 Vendor: Cisco Systems Product: Cisco Secure Access Control Server ACS for Windows User-Changeable Password UCP application Vulnerability: Multiple remote pre-authentication buffer overflows Cross Site...
Cisco Secure Access Control Server for Windows User-Changeable Password Vulnerabilities
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES TH...
Authentication flaw
Cisco Trust Agent CTA before 2.1.104.0, when running on MacOS X, allows attackers with physical access to bypass authentication and modify System Preferences, including passwords, by invoking the Apple Menu when the Access Control Server ACS produces a user notification message after posture...
CVE-2007-3184: Improper Authentication
Cisco Trust Agent CTA before 2.1.104.0, when running on MacOS X, allows attackers with physical access to bypass authentication and modify System Preferences, including passwords, by invoking the Apple Menu when the Access Control Server ACS produces a user notification message after posture...
Cisco Trust Agent Vulnerability
Vulnerability: There is a vulnerability affecting the latest version v2.1.103.0 of the Cisco Trust Agent software for MacOS X that can allow an individual with physical access to an endpoint to bypass authentication and gain administrative access to the local machine. Description: When Cisco Secu...
CVE-2007-1467
Multiple cross-site scripting XSS vulnerabilities in 1 PreSearch.html and 2 PreSearch.class in Cisco Secure Access Control Server ACS, VPN Client, Unified Personal Communicator, MeetingPlace, Unified MeetingPlace, Unified MeetingPlace Express, CallManager, IP Communicator, Unified Video Advantage...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in 1 PreSearch.html and 2 PreSearch.class in Cisco Secure Access Control Server ACS, VPN Client, Unified Personal Communicator, MeetingPlace, Unified MeetingPlace, Unified MeetingPlace Express, CallManager, IP Communicator, Unified Video Advantage...
CVE-2007-1467: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in 1 PreSearch.html and 2 PreSearch.class in Cisco Secure Access Control Server ACS, VPN Client, Unified Personal Communicator, MeetingPlace, Unified MeetingPlace, Unified MeetingPlace Express, CallManager, IP Communicator, Unified Video Advantage...
CVE-2007-0105
The CVE-2007-0105 issue affects Cisco Secure Access Control Server (ACS) and ACS Solution Engine prior to version 4.1, where the CSAdmin web server mishandles specially crafted HTTP GET requests, causing a stack-based buffer overflow. This allows a remote attacker to execute arbitrary code or cra...
CVE-2007-0105: Undefined Security Weakness
Stack-based buffer overflow in the CSAdmin service in Cisco Secure Access Control Server ACS for Windows before 4.1 and ACS Solution Engine before 4.1 allows remote attackers to execute arbitrary code via a crafted HTTP GET request...
CVE-2006-4098
Stack-based buffer overflow in the CSRadius service in Cisco Secure Access Control Server ACS for Windows before 4.1 and ACS Solution Engine before 4.1 allows remote attackers to execute arbitrary code via a crafted RADIUS Accounting-Request packet...
CVE-2006-4097
Multiple unspecified vulnerabilities in the CSRadius service in Cisco Secure Access Control Server ACS for Windows before 4.1 and ACS Solution Engine before 4.1 allow remote attackers to cause a denial of service crash via a crafted RADIUS Access-Request packet. NOTE: it has been reported that at...
CVE-2006-4097: Undefined Security Weakness
Multiple unspecified vulnerabilities in the CSRadius service in Cisco Secure Access Control Server ACS for Windows before 4.1 and ACS Solution Engine before 4.1 allow remote attackers to cause a denial of service crash via a crafted RADIUS Access-Request packet. NOTE: it has been reported that at...
CVE-2006-4098: Undefined Security Weakness
Stack-based buffer overflow in the CSRadius service in Cisco Secure Access Control Server ACS for Windows before 4.1 and ACS Solution Engine before 4.1 allows remote attackers to execute arbitrary code via a crafted RADIUS Accounting-Request packet...