Design/Logic Flaw

The RMI interface in Cisco Secure Access Control System ACS 5.x before 5.5 does not properly enforce authorization requirements, which allows remote authenticated users to obtain superadmin access via a request to this interface, aka Bug ID CSCud75180...

CVE-2014-0648

The RMI interface in Cisco Secure Access Control System ACS 5.x before 5.5 does not properly enforce authentication and authorization requirements, which allows remote attackers to obtain administrative access via a request to this interface, aka Bug ID CSCud75187...

CVE-2014-0667

The RMI interface in Cisco Secure Access Control System ACS does not properly enforce authorization requirements, which allows remote authenticated users to read arbitrary files via a request to this interface, aka Bug ID CSCud75169...

CVE-2014-0649

The RMI interface in Cisco Secure Access Control System ACS 5.x before 5.5 does not properly enforce authorization requirements, which allows remote authenticated users to obtain superadmin access via a request to this interface, aka Bug ID CSCud75180...

CVE-2014-0667

Cisco Secure Access Control System (ACS) is affected by CVE-2014-0667 due to insufficient authorization enforcement in the Remote Method Invocation (RMI) interface. A remote, authenticated attacker can read arbitrary files on the ACS server by issuing a crafted request to the RMI interface. The i...

CVE-2014-0648: Undefined Security Weakness

The RMI interface in Cisco Secure Access Control System ACS 5.x before 5.5 does not properly enforce authentication and authorization requirements, which allows remote attackers to obtain administrative access via a request to this interface, aka Bug ID CSCud75187...

Multiple Vulnerabilities in Cisco Secure Access Control System (cisco-sa-20140115-csacs)

The version of Cisco Secure Access Control System ACS running on the remote host is affected by one or more of the following issues : - A flaw in the authorization enforcement of the RMI interface could allow a remote, authenticated attacker to perform actions as superadmin. CVE-2014-0649 - A fla...

CVE-2014-0649: Undefined Security Weakness

The RMI interface in Cisco Secure Access Control System ACS 5.x before 5.5 does not properly enforce authorization requirements, which allows remote authenticated users to obtain superadmin access via a request to this interface, aka Bug ID CSCud75180...

PT-2014-3762

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control System ACS affected versions not specified Description The issue concerns the RMI interface in Cisco Secure Access Control System ACS, which fails to properly enforce authorization requirements. This allows remote...

CVE-2014-0667: Undefined Security Weakness

The RMI interface in Cisco Secure Access Control System ACS does not properly enforce authorization requirements, which allows remote authenticated users to read arbitrary files via a request to this interface, aka Bug ID CSCud75169...

PT-2014-3743

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control System ACS versions 5.x before 5.5 Description The issue concerns the RMI interface, which does not properly enforce authentication and authorization requirements. This allows remote attackers to obtain administrati...

PT-2014-3744

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control System ACS versions 5.0 through 5.4 Description The issue concerns the RMI interface, which does not properly enforce authorization requirements. This allows remote authenticated users to obtain superadmin access vi...

Multiple Vulnerabilities in Cisco Secure Access Control System

Cisco Secure Access Control System ACS is affected by the following vulnerabilities: Cisco Secure ACS RMI Privilege Escalation Vulernability Cisco Secure ACS RMI Unauthenticated User Access Vulnerability Cisco Secure ACS Operating System Command Injection Vulnerability Cisco Secure ACS uses the...

Cisco Fixes Three Bugs in Secure ACS Platform

Cisco has released patches for three vulnerabilities in its Secure Access Control System, including two flaws that could enable a remote attacker to take complete control of an affected system. Cisco’s Secure ACS is part of the company’s TrustSec solution, which the company says “supports the...

EMC Data Protection Advisor DPA Illuminator - EJBInvokerServlet Remote Code Execution

EMC Data Protection Advisor DPA Illuminator - EJBInvokerServlet Remote Code Execution EMC Data Protection Advisor DPA Illuminator EJBInvokerServlet Remote Code Execution tested against: Microsoft Windows Server 2008 r2 sp1 EMC Data Protection Advisor 5.8 sp5 vulnerability: the "DPA Illuminator"...

OpenJDK: RMIConnection stub missing permission check (CORBA, 8011157)

Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA...

weblogic-t3-info NSE Script

Detect the T3 RMI protocol and Weblogic version Example Usage nmap -sV Requires comm string shortport nmap local comm = require "comm" local string = require "string" local shortport = require "shortport" local nmap = require "nmap" description = "Detect the T3 RMI protocol and Weblogic version"...

GE Proficy Real-Time Information Portal Information Disclosure Vulnerabilities

Overview This advisory provides mitigation details for multiple vulnerabilities that impact the GE Intelligent Platforms Proficy Real-Time Information Portal. General Electric GE has addressed two vulnerabilities in the GE Intelligent Platforms Proficy Real-Time Information Portal. Exploitation o...

OpenJDK: RMI CGIHandler XSS issue (RMI, 6563318)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.240 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via vectors related to RMI. NOTE: the previous information...

OpenJDK: RMIConnectionImpl information disclosure (JMX, 7169888)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect confidentiality, related to JMX...