Cross site scripting

Cross-site scripting XSS vulnerability in the web interface in the Solution Engine in Cisco Secure Access Control Server ACS 5.70.15 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2015-6346

CVE-2015-6346 is a cross-site scripting (XSS) vulnerability in Cisco Secure Access Control Server (ACS) web interface, specifically in ACS 5.7(0.15). The root cause, per Cisco’s advisory, is a lack of input validation in DOM handling, enabling a DOM-based XSS when a crafted URL is processed. The ...

CVE-2015-6347

CVE-2015-6347 affects Cisco Secure Access Control Server (ACS) 5.7(0.15) where the Solution Engine allows remote authenticated users to bypass RBAC and create a dashboard or portlet by visiting an unrestricted web page. The root cause is flawed RBAC validation when creating administrative dashboa...

CVE-2015-6349

CVE-2015-6349 affects Cisco Secure Access Control Server (ACS) 5.7(0.15) Solution Engine, where the web interface is vulnerable to reflecte d cross-site scripting due to lack of input validation on user-supplied input. An unauthenticated, remote attacker could exploit a crafted URL to inject arbi...

CVE-2015-6348

The CVE-2015-6348 issue affects Cisco Secure Access Control Server (ACS) 5.7(0.15) where the report-generation web interface contains RBAC validation weaknesses. An authenticated remote user could access restricted report/status pages via the report-generation web interface, potentially exposing ...

CVE-2015-6349: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the web interface in the Solution Engine in Cisco Secure Access Control Server ACS 5.70.15 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2015-6346: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Cisco Secure Access Control Server ACS 5.70.15 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

PT-2015-2591

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control Server ACS version 5.70.15 Description The issue is related to a SQL injection vulnerability in the Solution Engine component. This vulnerability allows remote authenticated users to execute arbitrary SQL commands v...

PT-2015-2589

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control Server ACS version 5.70.15 Description The issue concerns a component of the Cisco Secure Access Control System, specifically the Solution Engine, which has inadequate access restrictions to certain functions. This...

CVE-2015-6348: Undefined Security Weakness

The report-generation web interface in the Solution Engine in Cisco Secure Access Control Server ACS 5.70.15 allows remote authenticated users to bypass intended RBAC restrictions, and read report or status information, by visiting an unspecified web page...

CVE-2015-6347: Undefined Security Weakness

The Solution Engine in Cisco Secure Access Control Server ACS 5.70.15 allows remote authenticated users to bypass intended RBAC restrictions, and create a dashboard or portlet, by visiting an unspecified web page...

PT-2015-2587

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control Server ACS version 5.70.15 Description The issue exists due to insufficient protection of the web page structure in the Solution Engine component of the Cisco Secure Access Control System. This allows a remote...

CVE-2015-6345: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Solution Engine in Cisco Secure Access Control Server ACS 5.70.15 allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCuw24700...

PT-2015-2590

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control Server versions 5.70.15 Description The issue exists due to insufficient protection of the web page structure, allowing for the injection of arbitrary web script or HTML code. This can be exploited by a remote...

PT-2015-2588

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control Server ACS version 5.70.15 Description The issue concerns the report-generation web interface in the Solution Engine component, which has inadequate access control restrictions. This allows a remote authenticated us...

Cisco Secure Access Control Server Role-Based Access Control Weak Protection Vulnerability

A vulnerability in the role-based access control RBAC implementation of the Cisco Secure Access Control Server ACS could allow an authenticated, remote attacker to view system administrator reports and status. The vulnerability is due to improper RBAC validation when a user accesses the report...

Cisco Secure Access Control Server Dom-Based Cross-Site Scripting Vulnerability

A vulnerability in the Cisco Secure Access Control Server ACS web interface could allow an unauthenticated, remote attacker to impact the integrity of the system by executing a Document Object Model DOM-based, environment or client side, cross-site scripting XSS attack. The vulnerability is due t...

Cisco Secure Access Control Server Role-Based Access Control URL Lack of Protection Vulnerability

A vulnerability in the role-based access control RBAC implementation of the Cisco Secure Access Control Server ACS could allow an authenticated, remote attacker to impact the integrity of the system by modifying dashboard portlets that should be restricted. The vulnerability is due to improper...

Cisco Secure Access Control Server Reflective Cross-Site Scripting Vulnerability

A vulnerability in the Cisco Secure Access Control Server ACS web interface could allow an unauthenticated, remote attacker to impact the integrity of the system by executing a reflective cross-site scripting XSS attack. The vulnerability is due to a lack of input validation on user-supplied...

Kemoge Malicious Adware Campaign

Google has been busy removing a number of apps from Google Play that are disguised as popular selections that are actually pushing what starts out as adware but eventually turns more malicious. Google has already yanked down a file-transfer app called ShareIt, developed by Zhang Long of China, wh...