CVE-2015-6346

CVE-2015-6346 is a cross-site scripting (XSS) vulnerability in Cisco Secure Access Control Server (ACS) web interface, specifically in ACS 5.7(0.15). The root cause, per Cisco’s advisory, is a lack of input validation in DOM handling, enabling a DOM-based XSS when a crafted URL is processed. The ...

CVE-2015-6348

The CVE-2015-6348 issue affects Cisco Secure Access Control Server (ACS) 5.7(0.15) where the report-generation web interface contains RBAC validation weaknesses. An authenticated remote user could access restricted report/status pages via the report-generation web interface, potentially exposing ...

CVE-2015-6347

CVE-2015-6347 affects Cisco Secure Access Control Server (ACS) 5.7(0.15) where the Solution Engine allows remote authenticated users to bypass RBAC and create a dashboard or portlet by visiting an unrestricted web page. The root cause is flawed RBAC validation when creating administrative dashboa...

CVE-2015-6349

CVE-2015-6349 affects Cisco Secure Access Control Server (ACS) 5.7(0.15) Solution Engine, where the web interface is vulnerable to reflecte d cross-site scripting due to lack of input validation on user-supplied input. An unauthenticated, remote attacker could exploit a crafted URL to inject arbi...

Cisco Secure Access Control Server Dom-Based Cross-Site Scripting Vulnerability

A vulnerability in the Cisco Secure Access Control Server ACS web interface could allow an unauthenticated, remote attacker to impact the integrity of the system by executing a Document Object Model DOM-based, environment or client side, cross-site scripting XSS attack. The vulnerability is due t...

Cisco Secure Access Control Server Reflective Cross-Site Scripting Vulnerability

A vulnerability in the Cisco Secure Access Control Server ACS web interface could allow an unauthenticated, remote attacker to impact the integrity of the system by executing a reflective cross-site scripting XSS attack. The vulnerability is due to a lack of input validation on user-supplied...

Cisco Secure Access Control Server Role-Based Access Control URL Lack of Protection Vulnerability

A vulnerability in the role-based access control RBAC implementation of the Cisco Secure Access Control Server ACS could allow an authenticated, remote attacker to impact the integrity of the system by modifying dashboard portlets that should be restricted. The vulnerability is due to improper...

Microsoft repair SharePoint 2 0 1 3 XSS vulnerabilities-the vulnerabilities and early warning-the black bar safety net

SharePoint is the Microsoft Office Suite in a tool for individuals and companies to create a portal page. The vulnerabilityCVE-2 0 1 5-2 5 2 2by FortiNet's FortiGuard Labs security researchers discovered the vulnerability affects SharePoint 2 0 1 3 15.0.4571.1502 early version. SharePoint is a...

CVE-2015-6300

CVE-2015-6300 affects Cisco Secure Access Control Server (ACS) Solution Engine 5.7(0.15). A vulnerability in the SSH feature allows remote authenticated users to cause a denial of service by issuing crafted commands via CLI or GUI, triggering an SSH screen process crash (Bug ID CSCuw24694). The C...

Cisco Secure Access Control Server SSH Login Denial of Service Vulnerability

A vulnerability in the Secure Shell SSH feature of the Cisco Secure Access Control Server ACS could allow an authenticated, remote attacker to cause a partial denial of service DoS condition due to the SSH screen process unexpectedly terminating. The vulnerability is due to improper input...

Improper access control

Cisco Secure Access Control System before 5.40.46.2 and 5.5 before 5.50.46 and Cisco Identity Services Engine 1.04.573 do not properly implement access control for support bundles, which allows remote authenticated users to obtain sensitive information via brute-force attempts to send valid...

CVE-2015-4219

The CVE-2015-4219 issue affects Cisco Secure Access Control System and Cisco Identity Services Engine. The root cause is improper access control for support bundles, allowing an authenticated remote attacker to brute-force credentials and download the bundle contents, potentially leading to infor...

Cisco Identity Services Engine and Secure Access Control System Support Bundle Download Vulnerability

A vulnerability in Cisco Identity Services Engine and Secure Access Control System could allow an authenticated, remote attacker to gain unauthorized access to program data. The vulnerability is due to weak authentication and authorization used to control access to support bundles stored on a...

Cisco Access Control Server Remote Denial of Service Vulnerability

The Cisco Secure Access Control System is the access policy control platform. A remote denial of service vulnerability exists in the REST API in Cisco Access Control Server ACS version 5.5 0.46.2, which can be exploited by a remote attacker to cause a denial of service by sending numerous request...

Cisco Secure Access Control Server Cross-Site Scripting Vulnerability

The Cisco Secure Access Control Server Solution Engine is a Cisco Secure Access Control Server solution engine. A cross-site scripting vulnerability exists in Cisco Secure Access Control Server, where the program fails to properly validate some parameters, which allows remote attackers to exploit...

Cisco Secure ACS EAPTLS Authentication Bypass - Ver2 (CVE-2004-1099)

An authentication bypass vulnerability has been reported in Cisco Secure Access Control Server Solution Engine, Cisco Secure ACS Solution Engine and Cisco Secure Access Control Server Solution Engine. Successful exploitation of this vulnerability would allow remote attackers to gain unauthorized...

Cisco Secure Access Control Server Dashboard Page Cross-Site Request Forgery Vulnerability

The Cisco Secure Access Control Server Solution Engine is a Cisco Secure Access Control Server solution engine. A cross-site request forgery vulnerability exists in the Dashboard page of the Cisco Secure Access Control Server Solution Engine monitoring-and-report segment, which allows a remote...

CVE-2015-0700

Cross-site request forgery CSRF vulnerability in the Dashboard page in the monitoring-and-report section in Cisco Secure Access Control Server Solution Engine before 5.50.46.5 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj62924...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Dashboard page in the monitoring-and-report section in Cisco Secure Access Control Server Solution Engine before 5.50.46.5 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj62924...

CVE-2015-0700

Cisco Secure Access Control Server Solution Engine Dashboard page in the monitoring-and-report section is affected by a CSRF vulnerability (CVE-2015-0700) prior to 5.5(0.46.5). An unauthenticated remote attacker can lure a user to a malicious link to perform actions in the context of that user. R...