CVE-2017-3839

CVE-2017-3839 is an XML External Entity (XXE) vulnerability in Cisco Secure Access Control System (ACS) web UI. An unauthenticated, remote attacker could read part of the information stored on the affected device. Root cause: improper handling of XML entities in the web framework. Affected releas...

CVE-2017-3838

Cisco Secure Access Control System (ACS) contains a DOM-based XSS vulnerability that could be exploited by an unauthenticated, remote attacker via the web interface. The issue arises from insufficient input validation of a user-supplied value and affects at least release 5.8(2.5). The CVE entry i...

Cisco Secure Access Control System Cross-Site Scripting Vulnerability

A vulnerability in Cisco Secure Access Control System ACS could allow an unauthenticated, remote attacker to conduct a DOM-based cross-site scripting XSS attack against the user of the web interface of the affected system. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be...

Cisco Secure Access Control System Information Disclosure Vulnerability

A vulnerability in the web interface of the Cisco Secure Access Control System ACS could allow an unauthenticated, remote attacker to disclose sensitive information. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C ...

Cisco Secure Access Control System Open Redirect Vulnerability

A vulnerability in the web interface of the Cisco Secure Access Control System ACS could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are...

Cisco Secure Access Control System XML External Entity Vulnerability

A vulnerability in the web-based user interface of the Cisco Secure Access Control System ACS could allow an unauthenticated, remote attacker to have read access to part of the information stored in the affected system. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be...

Cisco Secure Access Control System Open Redirect Vulnerability

A vulnerability in the web interface of the Cisco Secure Access Control System ACS could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of the parameters in the HTTP request. An attacker could exploit thi...

Cisco Secure Access Control System Cross-Site Scripting Vulnerability

A vulnerability in Cisco Secure Access Control System ACS could allow an unauthenticated, remote attacker to conduct a DOM-based cross-site scripting XSS attack against the user of the web interface of the affected system. The vulnerability is due to insufficient input validation of a user-suppli...

Cisco Secure Access Control System XML External Entity Vulnerability

A vulnerability in the web-based user interface of the Cisco Secure Access Control System ACS could allow an authenticated, remote attacker to have read access to part of the information stored in the affected system. The vulnerability is due to improper handling of the XML External Entity XXE wh...

Cisco Secure Access Control System Information Disclosure Vulnerability

A vulnerability in the web interface of the Cisco Secure Access Control System ACS could allow an unauthenticated, remote attacker to disclose sensitive information. The vulnerability is due to the inclusion of sensitive information in a server response when certain pages of the web interface are...

Cisco Secure Access Control System Detection

This script performs ssh based detection of Cisco Secure Access Control System SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

The vulnerability of the Cisco Secure Access Control System’s access control mechanism allows a perpetrator to execute arbitrary web or HTML code.

The vulnerability of the Solution Engine web interface of the Cisco Secure Access Control System exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary web or HTML code using a specially crafte...

The vulnerability of the Cisco Secure Access Control System allows a perpetrator to bypass access restrictions and read log files as well as device status information.

The vulnerability of the report generation web interface of the Solution Engine component of the Cisco Secure Access Control System relates to deficiencies in access control for certain functions. Exploiting this vulnerability could allow a malicious actor to bypass access restrictions and read l...

The vulnerability of the Cisco Secure Access Control System allows a perpetrator to bypass existing access restrictions and create a new information panel.

The vulnerability of the Solution Engine component of the Cisco Secure Access Control System relates to deficiencies in access control for certain functions. Exploiting this vulnerability could allow a malicious actor to bypass existing access restrictions and create a new information panel by...

Cisco ACS Solution Engine Cross-Site Scripting Vulnerability

Cisco Secure Access Control Server ACS is a security access control server from Cisco, Inc.Solution Engine is one of the server engine solutions. Cisco Secure Access Control Server ACS version 5.70.15, an XSS vulnerability exists in the web interface of Solution Engine. A remote attacker could...

CVE-2015-6349

Cross-site scripting XSS vulnerability in the web interface in the Solution Engine in Cisco Secure Access Control Server ACS 5.70.15 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

Design/Logic Flaw

The report-generation web interface in the Solution Engine in Cisco Secure Access Control Server ACS 5.70.15 allows remote authenticated users to bypass intended RBAC restrictions, and read report or status information, by visiting an unspecified web page...

Cross site scripting

Cross-site scripting XSS vulnerability in the web interface in the Solution Engine in Cisco Secure Access Control Server ACS 5.70.15 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2015-6348

The CVE-2015-6348 issue affects Cisco Secure Access Control Server (ACS) 5.7(0.15) where the report-generation web interface contains RBAC validation weaknesses. An authenticated remote user could access restricted report/status pages via the report-generation web interface, potentially exposing ...

CVE-2015-6347

CVE-2015-6347 affects Cisco Secure Access Control Server (ACS) 5.7(0.15) where the Solution Engine allows remote authenticated users to bypass RBAC and create a dashboard or portlet by visiting an unrestricted web page. The root cause is flawed RBAC validation when creating administrative dashboa...