CVE-2008-2735

The HTTP server in Cisco Adaptive Security Appliance ASA 5500 devices 8.0 before 8.0315 and 8.1 before 8.115, when configured as a clientless SSL VPN endpoint, does not properly process URIs, which allows remote attackers to cause a denial of service device reload via a URI in a crafted SSL or HT...

CVE-2008-2736

Unspecified vulnerability in Cisco Adaptive Security Appliance ASA 5500 devices 8.0315, 8.0316, 8.114, and 8.115, when configured as a clientless SSL VPN endpoint, allows remote attackers to obtain usernames and passwords via unknown vectors, aka Bug ID CSCsq45636...

CVE-2008-2736

CVE-2008-2736 affects Cisco ASA 5500 series and PIX/ASA devices enabling clientless SSL VPN; vulnerability allows an attacker to obtain usernames and passwords via clientless VPN connections. Affected versions include ASA 5500 software 8.0(3)15, 8.0(3)16, 8.1(1)4, and 8.1(1)5. Root cause relates ...

CVE-2008-2734

Memory leak in the crypto functionality in Cisco Adaptive Security Appliance ASA 5500 devices 7.2 before 7.242, 8.0 before 8.0314, and 8.1 before 8.114, when configured as a clientless SSL VPN endpoint, allows remote attackers to cause a denial of service memory consumption and VPN hang via a...

CVE-2008-2734

CVE-2008-2734 arises from a memory leak in the crypto subsystem of Cisco ASA 5500 series when configured as a clientless SSL VPN endpoint. The affected versions are ASA 7.2 before 7.2(4)2, ASA 8.0 before 8.0(3)14, and ASA 8.1 before 8.1(1)4. A crafted SSL or HTTP packet can cause memory consumpti...

CVE-2008-2736: Exposure of Sensitive Information to an Unauthorized Actor

Unspecified vulnerability in Cisco Adaptive Security Appliance ASA 5500 devices 8.0315, 8.0316, 8.114, and 8.115, when configured as a clientless SSL VPN endpoint, allows remote attackers to obtain usernames and passwords via unknown vectors, aka Bug ID CSCsq45636...

Cisco Security Advisory: Remote Access VPN and SIP Vulnerabilities in Cisco PIX and Cisco ASA

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Remote Access VPN and SIP Vulnerabilities in Cisco PIX and Cisco ASA Advisory ID: cisco-sa-20080903-asa Revision 1.0 For Public Release 2008 September 3 1600 UTC GMT...

CVE-2008-2734: Undefined Security Weakness

Memory leak in the crypto functionality in Cisco Adaptive Security Appliance ASA 5500 devices 7.2 before 7.242, 8.0 before 8.0314, and 8.1 before 8.114, when configured as a clientless SSL VPN endpoint, allows remote attackers to cause a denial of service memory consumption and VPN hang via a...

CVE-2008-2735: Improper Input Validation

The HTTP server in Cisco Adaptive Security Appliance ASA 5500 devices 8.0 before 8.0315 and 8.1 before 8.115, when configured as a clientless SSL VPN endpoint, does not properly process URIs, which allows remote attackers to cause a denial of service device reload via a URI in a crafted SSL or HT...

F5 FirePass SSL VPN多个跨站请求伪造漏洞

BUGTRAQ ID: 29574 CNCAN ID:CNCAN-2008061002 F5 FirePass SSL VPN是一款VPN实现。 F5 FirePass SSL VPN WEB接口不正确过滤用户提供的输入，远程攻击者可以利用漏洞进行跨站请求伪造攻击。 问题存在于/vdesk/admincon/webyfiers.php对cssexceptions参数的过滤及/vdesk/admincon/index.php对sqlmatchscope参数的过滤，由于不正确处理引号，允许攻击者注入恶意代码。 F5 FirePass 6.0.2.3 目前没有解决方案提供：...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in F5 FirePass SSL VPN 6.0.2 hotfix 3, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via quotes in 1 the cssexceptions parameter in vdesk/admincon/webyfiers.php and 2 the sqlmatchscope parameter in...

CVE-2008-2637

Multiple cross-site scripting XSS vulnerabilities in F5 FirePass SSL VPN 6.0.2 hotfix 3, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via quotes in 1 the cssexceptions parameter in vdesk/admincon/webyfiers.php and 2 the sqlmatchscope parameter in...

CVE-2008-2637

In CVE-2008-2637, the affected product is F5 FirePass SSL VPN 6.0.2 hotfix 3 (and possibly earlier). The vulnerability is multiple cross-site scripting (XSS) flaws in two parameters: css_exceptions (vdesk/admincon/webyfiers.php) and sql_matchscope (vdesk/admincon/index.php), allowing remote attac...

CVE-2008-2637

Multiple cross-site scripting XSS vulnerabilities in F5 FirePass SSL VPN 6.0.2 hotfix 3, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via quotes in 1 the cssexceptions parameter in vdesk/admincon/webyfiers.php and 2 the sqlmatchscope parameter in...

CVE-2008-2637: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in F5 FirePass SSL VPN 6.0.2 hotfix 3, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via quotes in 1 the cssexceptions parameter in vdesk/admincon/webyfiers.php and 2 the sqlmatchscope parameter in...

F5 FirePass Content Inspection Management XSS

F5 FirePass Content Inspection Management XSS Product: F5 FirePass http://www.f5.com/products/firepass/ The F5 FirePass SSL VPN appliance provides rudimentary web request sanitization for resources exposed through the appliance via Portal Access. This Content Inspection feature can be configured...

f5firepass-xss.txt

F5 FirePass Content Inspection Management XSS Product: F5 FirePass http://www.f5.com/products/firepass/ The F5 FirePass SSL VPN appliance provides rudimentary web request sanitization for resources exposed through the appliance via Portal Access. This Content Inspection feature can be configured...

F5 FirePass 6.0.2.3 - vdeskadminconwebyfiers.php?css_exceptions Cross-Site Scripting

F5 FirePass 6.0.2.3 - vdeskadminconwebyfiers.php?cssexceptions Cross-Site Scripting source: https://www.securityfocus.com/bid/29574/info F5 FirePass SSL VPN is prone to multiple cross-site request-forgery vulnerabilities because it fails to adequately sanitize user-supplied input. Exploiting thes...

F5 FirePass 6.0.2.3 - vdeskadminconindex.php?sql_matchscope Cross-Site Scripting

F5 FirePass 6.0.2.3 - vdeskadminconindex.php?sqlmatchscope Cross-Site Scripting source: https://www.securityfocus.com/bid/29574/info F5 FirePass SSL VPN is prone to multiple cross-site request-forgery vulnerabilities because it fails to adequately sanitize user-supplied input. Exploiting these...

F5 FirePass 6.0.2.3 - '/vdesk/admincon/webyfiers.php?css_exceptions' Cross-Site Scripting

source: https://www.securityfocus.com/bid/29574/info F5 FirePass SSL VPN is prone to multiple cross-site request-forgery vulnerabilities because it fails to adequately sanitize user-supplied input. Exploiting these issues may allow a remote attacker to execute arbitrary actions in the context of...