CVE-2013-6956

Cross-site scripting XSS vulnerability in the Secure Access Service Web rewriting feature in Juniper Junos Pulse Secure Access Service aka SSL VPN with IVE OS before 7.1r17, 7.3 before 7.3r8, 7.4 before 7.4r6, and 8.0 before 8.0r1, when web rewrite is enabled, allows remote authenticated users to...

CVE-2013-6695

The RBAC implementation in Cisco Secure Access Control System ACS does not properly verify privileges for support-bundle downloads, which allows remote authenticated users to obtain sensitive information via a download action, as demonstrated by obtaining read access to the user database, aka Bug...

Code injection

Cisco Secure Access Control System ACS does not properly implement an incoming-packet firewall rule, which allows remote attackers to cause a denial of service process crash via a flood of crafted packets, aka Bug ID CSCui51521...

Juniper Junos Pulse Secure Access Service IVE OS (SSL VPN) Multiple XSS (JSA10589)

According to its self-reported version, the version of Juniper Junos Pulse Secure Access Service IVE OS running on the remote host is affected by multiple unspecified cross-site scripting vulnerabilities that are present on the login and support pages hosted on the device's web server. An attacke...

Cisco Secure Access Control Server for Windows Remote Code Execution

The version of Cisco Secure Access Control Server for Windows 4.x is earlier than 4.2.1.15.11. It is, therefore, potentially affected by a remote code execution vulnerability. Due to improper parsing of user identities used for EAP-FAST authentication, a remote, unauthenticated attacker could...

CVE-2013-5650

Junos Pulse Secure Access Service IVE 7.1 before 7.1r5, 7.2 before 7.2r10, 7.3 before 7.3r6, and 7.4 before 7.4r3 and Junos Pulse Access Control Service UAC 4.1 before 4.1r8.1, 4.2 before 4.2r5, 4.3 before 4.3r6 and 4.4 before 4.4r3, when a hardware SSL acceleration card is enabled, allows remote...

CVE-2013-5650

Junos Pulse Secure Access Service IVE 7.1 before 7.1r5, 7.2 before 7.2r10, 7.3 before 7.3r6, and 7.4 before 7.4r3 and Junos Pulse Access Control Service UAC 4.1 before 4.1r8.1, 4.2 before 4.2r5, 4.3 before 4.3r6 and 4.4 before 4.4r3, when a hardware SSL acceleration card is enabled, allows remote...

Design/Logic Flaw

Junos Pulse Secure Access Service IVE 7.1 before 7.1r5, 7.2 before 7.2r10, 7.3 before 7.3r6, and 7.4 before 7.4r3 and Junos Pulse Access Control Service UAC 4.1 before 4.1r8.1, 4.2 before 4.2r5, 4.3 before 4.3r6 and 4.4 before 4.4r3, when a hardware SSL acceleration card is enabled, allows remote...

CVE-2013-5649

Multiple cross-site scripting XSS vulnerabilities in Juniper Junos Pulse Secure Access Service aka SSL VPN with IVE OS 7.1 before 7.1r15, 7.2 before 7.2r11, 7.3 before 7.3r6, and 7.4 before 7.4r3 allow 1 remote attackers to inject arbitrary web script or HTML via vectors involving login pages, an...

CVE-2013-5649

CVE-2013-5649 affects Juniper Junos Pulse Secure Access Service (IVE OS) SSL VPN. Vulnerable components are web login and a support page where input validation is insufficient, allowing XSS by unauthenticated users and authenticated users. Impact includes arbitrary script execution in the browser...

Cisco Secure Access Control System (ACS) Multiple Vulnerabilities

The version of Cisco Secure Access Control System installed on the remote host is potentially affected by multiple vulnerabilities : - An unspecified cross-site scripting vulnerability exists in the web interface. CVE-2013-3423 - An unspecified cross-site request forgery vulnerability exists in t...

Siemens SINAMICS S/G Authentication Bypass Vulnerability

OVERVIEW Siemens has identified an authentication bypass vulnerability in the SINAMICS S/G product family. Siemens has produced a firmware update that mitigates this vulnerability and has tested the update to validate that it resolves the vulnerability. Exploitation of this vulnerability could...

CVE-2013-5470

Cisco Secure Access Control System ACS does not properly handle requests to read from the TACACS+ socket, which allows remote attackers to cause a denial of service process crash via malformed TCP packets, aka Bug ID CSCuh12488...

Code injection

Cisco Secure Access Control System ACS does not properly handle requests to read from the TACACS+ socket, which allows remote attackers to cause a denial of service process crash via malformed TCP packets, aka Bug ID CSCuh12488...

CVE-2013-5470

Cisco Secure Access Control System ACS does not properly handle requests to read from the TACACS+ socket, which allows remote attackers to cause a denial of service process crash via malformed TCP packets, aka Bug ID CSCuh12488...

CVE-2013-5470

Cisco Secure ACS is affected by CVE-2013-5470 due to a flaw in the TACACS+ socket read function that allows an unauthenticated, remote attacker to crash the runtime process and cause a denial of service. The issue stems from improper processing of read requests on the TACACS+ socket, and can be t...

CISCO vulnerability allows remote attacker to take control of Windows system

Cisco has fixed a critical vulnerability in Secure Access Control Server for Windows that could allow remote attackers to execute arbitrary commands and take control of the underlying operating system. Cisco Secure ACS is an application that allows companies to centrally manage access to network...

CISCO vulnerability allows remote attacker to take control of Windows system

Cisco has fixed a critical vulnerability in Secure Access Control Server for Windows that could allow remote attackers to execute arbitrary commands and take control of the underlying operating system. Cisco Secure ACS is an application that allows companies to centrally manage access to network...

Design/Logic Flaw

The EAP-FAST authentication module in Cisco Secure Access Control Server ACS 4.x before 4.2.1.15.11, when a RADIUS server configuration is enabled, does not properly parse user identities, which allows remote attackers to execute arbitrary commands via crafted EAP-FAST packets, aka Bug ID...

CVE-2013-3466

The EAP-FAST authentication module in Cisco Secure Access Control Server ACS 4.x before 4.2.1.15.11, when a RADIUS server configuration is enabled, does not properly parse user identities, which allows remote attackers to execute arbitrary commands via crafted EAP-FAST packets, aka Bug ID...