CVE-2012-3088

Cisco AnyConnect Secure Mobility Client 3.1.x (before 3.1.00495) and 3.2.x fails to verify whether an HTTP request contains ScanSafe headers, enabling remote attackers to trigger an unspecified impact via a crafted request (Bug ID CSCua13166). Affected component: AnyConnect client; root cause: la...

CVE-2012-3088

Cisco AnyConnect Secure Mobility Client 3.1.x before 3.1.00495, and 3.2.x, does not check whether an HTTP request originally contains ScanSafe headers, which allows remote attackers to have an unspecified impact via a crafted request, aka Bug ID CSCua13166...

CVE-2012-3094

The CVE-2012-3094 entry concerns Cisco AnyConnect Secure Mobility Client 3.1.x prior to 3.1.00495 on Linux, where the VPN downloader in the download_install component accepts arbitrary X.509 server certificates without user interaction. This root cause enables remote attackers to obtain sensitive...

Cisco Products ActiveX Control Multiple Vulnerabilities

Cisco ASMC/Hostscan/Secure Desktop or Cisco ActiveX controls is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Cisco AnyConnect Secure Mobility Client multiple security vulnerabilities

Code execution, protection bypass...

CVE-2012-4592

The Portal in McAfee Enterprise Mobility Manager EMM before 10.0 does not set the secure flag for the ASP.NET session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

CVE-2012-4591

About.aspx in the Portal in McAfee Enterprise Mobility Manager EMM before 10.0 discloses the name of the user account for an IIS worker process, which allows remote attackers to obtain potentially sensitive information by visiting this page...

Design/Logic Flaw

Login.aspx in the Portal in McAfee Enterprise Mobility Manager EMM before 10.0 does not have an off autocomplete attribute for unspecified form fields, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation...

Code injection

McAfee Enterprise Mobility Manager EMM Agent before 4.8 and Server before 10.1 record all invalid usernames presented in failed login attempts, and place them on a list of accounts that an administrator may wish to unlock, which allows remote attackers to cause a denial of service excessive list...

Code injection

About.aspx in the Portal in McAfee Enterprise Mobility Manager EMM before 10.0 discloses the name of the user account for an IIS worker process, which allows remote attackers to obtain potentially sensitive information by visiting this page...

CVE-2012-4588

McAfee Enterprise Mobility Manager EMM Agent before 4.8 and Server before 10.1 record all invalid usernames presented in failed login attempts, and place them on a list of accounts that an administrator may wish to unlock, which allows remote attackers to cause a denial of service excessive list...

CVE-2012-4589

CVE-2012-4589 affects McAfee Enterprise Mobility Manager (EMM) Portal login.aspx prior to version 10.0. The issue is that the login form fields lack the off autocomplete attribute, which can let an unattended workstation be abused to gain access. This is described in the NVD entry for CVE-2012-45...

CVE-2012-4589

Login.aspx in the Portal in McAfee Enterprise Mobility Manager EMM before 10.0 does not have an off autocomplete attribute for unspecified form fields, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation...

Cisco AnyConnect Secure Mobility Client 3.1 < 3.1(495) MiTM

The remote host has a version of Cisco AnyConnect 3.1 prior to 3.1495. As such, it prompts the user to decide whether or not to proceed when an untrusted certificate is seen. Accepting an untrusted certificate could result in a man-in-the-middle attack. C Tenable Network Security, Inc...

Cisco AnyConnect Secure Mobility Client WebLaunch Session Hijack Vulnerability

Cisco AnyConnect Secure Mobility Client contains a vulnerability that could allow an unauthenticated, remote attacker to hijack WebLaunch sessions, which could allow the attacker to intercept sensitive information. The vulnerability is due to the failure to perform certificate name checking in an...

Cisco AnyConnect Secure Mobility Client IPsec Certificate Validation Vulnerability

Cisco AnyConnect Secure Mobility Client contains a vulnerability that could allow an unauthenticated, remote attacker to conduct man-in-the-middle attacks. The vulnerability exists because the affected software does not perform certificate name checking in an X.509 certificate when the software i...

CVE-2012-2500

Cisco AnyConnect Secure Mobility Client 3.0 before 3.0.08057 is vulnerable to a WebLaunch IPsec certificate name check bypass. The root cause is failure to verify the X.509 certificate name, enabling MITM attackers to spoof servers via a crafted certificate. Impact is interception of WebLaunch se...

CVE-2012-2498

CVE-2012-2498 affects Cisco AnyConnect Secure Mobility Client 3.0–3.0.08066, where authentication may accept crafted certificates, allowing user-assisted or unauthenticated MITM to spoof servers due to insufficient certificate validation (Bug CSCtz29197). Cisco issued the advisory Cisco-SA-201208...

CVE-2012-2499

CVE-2012-2499 affects Cisco AnyConnect Secure Mobility Client prior to 3.0.08057. The IPsec implementation fails to verify the certificate name in an X.509 certificate, enabling MITM with a crafted certificate and potential server spoofing. Root cause: missing certificate-name validation for IPse...

CVE-2012-1370

Cisco AnyConnect Secure Mobility Client 3.0 is affected by CVE-2012-1370 when using versions before 3.0.08057. The issue allows remote authenticated users to cause a denial of service by sending a crafted packet that crashes the vpnagentd process (Bug ID CSCty01670). The connected documents consi...