Sql injection

SQL injection vulnerability in the Enterprise Mobility Application EMApp interface in Cisco Unified Communications Manager UCM allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05302...

Mac OS X : Cisco AnyConnect Secure Mobility Client 2.x / 3.x < 3.0(629) Multiple Vulnerabilities

The remote host has a version of Cisco AnyConnect 2.x or 3.x prior to 3.0629 and is, therefore, affected by the following vulnerabilities : - When the client is obtained from the VPN headend using a web browser, a helper application performs the download and installation. This helper application...

Buffer overflow

Buffer overflow in the Active Template Library ATL framework in the VPNAPI COM module in Cisco AnyConnect Secure Mobility Client 2.x allows user-assisted remote attackers to execute arbitrary code via a crafted HTML document, aka Bug ID CSCuj58139...

College students concerned about information security

Universities and colleges have been under significant pressure to upgrade their technology both in and out of the classroom. For instance, many organizations turn to mobility as a way to engage students and facilitate learning campus-wide. While much of the discussion is around issues such as the...

CVE-2013-1130

Cisco AnyConnect Secure Mobility Client on macOS is affected by weak permissions in a library directory (root cause: misconfigured library directory permissions), enabling local privilege escalation via a crafted library file (Bug ID CSCue33619). No patch/version details are provided in the suppl...

CVE-2013-3469

Cisco Mobility Services Engine does not properly set up the Oracle SSL service, which allows remote attackers to obtain an unauthenticated session to the database-replication port, and consequently obtain sensitive information, via an SSL connection, aka Bug ID CSCue50794...

Design/Logic Flaw

Cisco Mobility Services Engine does not properly set up the Oracle SSL service, which allows remote attackers to obtain an unauthenticated session to the database-replication port, and consequently obtain sensitive information, via an SSL connection, aka Bug ID CSCue50794...

CVE-2013-3469

CVE-2013-3469 concerns Cisco Mobility Services Engine where the Oracle SSL service is misconfigured, allowing an unauthenticated user to establish a session on the database-replication port via SSL and potentially access sensitive information. Cisco notes an anonymous login vulnerability and indi...

CVE-2013-3469

Cisco Mobility Services Engine does not properly set up the Oracle SSL service, which allows remote attackers to obtain an unauthenticated session to the database-replication port, and consequently obtain sensitive information, via an SSL connection, aka Bug ID CSCue50794...

Cisco Mobility Services Engine Anonymous Login Vulnerability

A vulnerability in Cisco Mobility Services Engine could allow an unauthenticated, remote attacker to connect to a database replication port anonymously via Secure Sockets Layer SSL. The vulnerability is due to the misconfiguration of the Oracle SSL service. An attacker could exploit this...

CVE-2013-1173

CVE-2013-1173 is a heap-based buffer overflow in ciscod.exe within the Cisco Security Service of Cisco AnyConnect Secure Mobility Client. Exploitation enables local privilege escalation to SYSTEM. Affected: Cisco AnyConnect Secure Mobility Client (Host Scan component) with vulnerable host-scan ha...

CVE-2013-1172

CVE-2013-1172 affects Cisco AnyConnect Secure Mobility Client (VPN Client) via the Host Scan component. The issue arises from how the Cisco Security Service/Host Scan handles messages for file manipulation, failing to verify files properly. This root cause enables a local, unprivileged user with ...

Cross site scripting

Cross-site scripting XSS vulnerability in the WebAAA login functionality wbalogin.html in Juniper Networks Mobility System Software MSS 7.6.x before 7.6.3, 7.7.x before 7.7.1, 7.5.x before 7.5.3, and other unspecified versions before 7.4 and 7.3 allows remote attackers to inject arbitrary web...

CVE-2012-1038

Cross-site scripting XSS vulnerability in the WebAAA login functionality wbalogin.html in Juniper Networks Mobility System Software MSS 7.6.x before 7.6.3, 7.7.x before 7.7.1, 7.5.x before 7.5.3, and other unspecified versions before 7.4 and 7.3 allows remote attackers to inject arbitrary web...

CVE-2012-1038

CVE-2012-1038 describes a cross-site scripting (XSS) vulnerability in Juniper Networks Mobility System Software (MSS) WebAAA login (wba_login.html). The issue arises in MSS 7.6.x before 7.6.3, 7.7.x before 7.7.1, 7.5.x before 7.5.3, and other unspecified versions prior to 7.4 and 7.3, where a cra...

Samsung's new OS Tizen 2.0 source code released

The Tizen 2.0 source code and SDK has officially been released. Tizen is a Linux-based open-source software platform backed by Intel and Samsung Electronics, that is designed for smartphones, tablets, smart TVs and in-car systems and it’s designed to run apps written using web technologies...

Cisco VPN Client Denial of Service Vulnerability

Cisco VPN Client contains a vulnerability that could allow an authenticated, local attacker to cause a denial of service DoS condition on a targeted system. The vulnerability is due to improper interaction between the VPN driver and the operating system kernel on a device running the vulnerable...

Broadcom BCM4325 and BCM4329 wireless chipset denial-of-service vulnerability

Overview Broadcom BCM4325 and BCM4329 wireless chipsets have been reported to contain an out-of-bounds read error condition that may be exploited to produce a denial-of-service condition. Description The CORE Security Technologies advisory states:"An out-of-bounds read error condition exists in...

CVE-2012-3088

Cisco AnyConnect Secure Mobility Client 3.1.x before 3.1.00495, and 3.2.x, does not check whether an HTTP request originally contains ScanSafe headers, which allows remote attackers to have an unspecified impact via a crafted request, aka Bug ID CSCua13166...

CVE-2012-3094

The VPN downloader in the downloadinstall component in Cisco AnyConnect Secure Mobility Client 3.1.x before 3.1.00495 on Linux accepts arbitrary X.509 server certificates without user interaction, which allows remote attackers to obtain sensitive information via vectors involving an invalid...