CVE-2018-0373: Improper Input Validation

A vulnerability in vpnva-6.sys for 32-bit Windows and vpnva64-6.sys for 64-bit Windows of Cisco AnyConnect Secure Mobility Client for Windows Desktop could allow an authenticated, local attacker to cause a denial of service DoS condition on an affected system. The vulnerability is due to improper...

PT-2018-8799

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client for Windows Desktop affected versions not specified Description A denial of service DoS condition can be caused by an authenticated, local attacker on an affected system due to improper validation of...

Cisco AnyConnect Secure Mobility Client < 4.6.01098 Certificate Bypass Vulnerability

The version of Cisco AnyConnect Secure Mobility Client installed on the remote Windows host is prior to 4.6.01098. It is, therefore, affected by a certificate bypass vulnerability. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid110563; scriptversion"1.7";...

Cisco AnyConnect Network Access Manager and AnyConnect Secure Mobility Client Certificate Bypass Vulnerability

Cisco AnyConnect Network Access Manager and AnyConnect Secure Mobility Client are both products of Cisco, U.S.A. Cisco Network Access Manager NAM is one of the network access managers. AnyConnect Secure Mobility Client is a secure mobility client that provides secure access to networks and...

CVE-2018-0334: Improper Certificate Validation

A vulnerability in the certificate management subsystem of Cisco AnyConnect Network Access Manager and of Cisco AnyConnect Secure Mobility Client for iOS, Mac OS X, Android, Windows, and Linux could allow an unauthenticated, remote attacker to bypass the TLS certificate check when downloading...

PT-2018-8762

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Network Access Manager and Cisco AnyConnect Secure Mobility Client for iOS, Mac OS X, Android, Windows, and Linux affected versions not specified Description A vulnerability in the certificate management subsystem could allow ...

Cisco AnyConnect Secure Mobility Client Certificate Bypass Vulnerability

A vulnerability in the certificate management subsystem of Cisco AnyConnect Network Access Manager and of Cisco AnyConnect Secure Mobility Client for iOS, Mac OS X, Android, Windows, and Linux could allow an unauthenticated, remote attacker to bypass the TLS certificate check when downloading...

CVE-2018-0229: Session Fixation

A vulnerability in the implementation of Security Assertion Markup Language SAML Single Sign-On SSO authentication for Cisco AnyConnect Secure Mobility Client for Desktop Platforms, Cisco Adaptive Security Appliance ASA Software, and Cisco Firepower Threat Defense FTD Software could allow an...

CVE-2018-0100: Improper Restriction of XML External Entity Reference

A vulnerability in the Profile Editor of the Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, local attacker to have read and write access to information stored in the affected system. The vulnerability is due to improper handling of the XML External Entity XXE entries when...

PT-2018-8610

Name of the Vulnerable Software and Affected Versions: Cisco AnyConnect Secure Mobility Client affected versions not specified Description: A vulnerability in the Profile Editor could allow an unauthenticated, local attacker to have read and write access to information stored in the affected...

Security feature bypass

A vulnerability in the Network Access Manager NAM of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker to enable multiple network adapters, aka a Dual-Homed Interface vulnerability. The vulnerability is due to insufficient NAM policy enforcement. An attacker cou...

CVE-2017-12268: Undefined Security Weakness

A vulnerability in the Network Access Manager NAM of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker to enable multiple network adapters, aka a Dual-Homed Interface vulnerability. The vulnerability is due to insufficient NAM policy enforcement. An attacker cou...

PT-2017-12443

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client affected versions not specified Description A vulnerability in the Network Access Manager NAM of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker to enable multiple...

CVE-2017-6788: Improper Neutralization of Input During Web Page Generation

The WebLaunch functionality of Cisco AnyConnect Secure Mobility Client Software contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the affected software. The vulnerability is due to insufficient input...

PT-2017-17321

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client Software version 98.8940 Description The issue is related to the WebLaunch functionality, which contains a flaw that could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS...

CVE-2017-6638: Improper Input Validation

A vulnerability in how DLL files are loaded with Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to install and run an executable file with privileges equivalent to the Microsoft Windows SYSTEM account. The vulnerability is due to incomplete input...

PT-2017-2260

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client for Windows versions prior to 4.4.02034 Description A vulnerability in how DLL files are loaded could allow an authenticated, local attacker to install and run an executable file with privileges equivale...

CVE-2017-3813

CVE-2017-3813 | Cisco AnyConnect Secure Mobility Client for Windows contains a Start Before Logon (SBL) privilege-escalation vulnerability. The issue arises from insufficient access controls in the SBL module, allowing an unauthenticated, local attacker to start Internet Explorer with SYSTEM priv...

PT-2017-16115

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client Software for Windows versions prior to 4.4.00243 and 4.3.05017 Description The issue is due to insufficient implementation of access controls in the Start Before Logon SBL module. An unauthenticated, loc...

CVE-2017-3813: Missing Authorization

A vulnerability in the Start Before Logon SBL module of Cisco AnyConnect Secure Mobility Client Software for Windows could allow an unauthenticated, local attacker to open Internet Explorer with the privileges of the SYSTEM user. The vulnerability is due to insufficient implementation of the acce...