CVE-2013-5510

CVE-2013-5510 affects Cisco ASA Software Remote Access VPN authentication. The issue arises from improper parsing of LDAP responses from a remote AAA LDAP server when override-account-disable is enabled, allowing remote attackers to bypass authentication via a VPN connection. Widely documented in...

CVE-2013-5507

CVE-2013-5507 affects Cisco ASA Software 9.1 prior to 9.1(1.7) when an IPsec VPN tunnel is enabled. The issue, due to improper handling of ICMP/ICMPv6 packets during decryption, can cause a denial of service resulting in a device reload. Root cause is an IPsec ICMP handling bug (Bug ID CSCue18975...

CVE-2013-5510

The remote-access VPN implementation in Cisco Adaptive Security Appliance ASA Software 7.x before 7.25.12, 8.x before 8.25.46, 8.3.x before 8.32.39, 8.4.x before 8.46, 8.6.x before 8.61.12, 9.0.x before 9.03.1, and 9.1.x before 9.12.5, when an override-account-disable option is enabled, does not...

Cisco Patches 11 Vulnerabilities in FWSM, ASA Products

Cisco pushed out patches for two products this week, addressing a handful of vulnerabilities in its Firewall Services Module FWSM software and Adaptive Security Appliance ASA software. According to security updates posted on the company’s Advisory page yesterday, at least nine separate...

Cisco Adaptive Security Appliance Software Remote Access VPN Authentication Bypass Vulnerability

A vulnerability in the authentication code of the remote access VPN feature of Cisco ASA Software could allow an unauthenticated, remote attacker to bypass the remote VPN authentication, which could allow remote access to the inside network. The vulnerability is due to improper parsing of the LDA...

Multiple Vulnerabilities in Cisco ASA Software

Cisco Adaptive Security Appliance ASA Software is affected by the following vulnerabilities: IPsec VPN Crafted ICMP Packet Denial of Service Vulnerability SQLNet Inspection Engine Denial of Service Vulnerability Digital Certificate Authentication Bypass Vulnerability Remote Access VPN...

PT-2013-5598 · Cisco · Cisco Asa

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software versions 8.x through 8.25.43 Cisco Adaptive Security Appliance ASA Software versions 8.3.x through 8.32.38 Cisco Adaptive Security Appliance ASA Software versions 8.4.x through 8.45.6 Cisco...

VPN provider 'Proxy.sh' sniffed the traffic of US based server to Catch Hackers

The very first question we always try to figure before choosing a trusted VPN service - Can't a VPN provider just look at my traffic all they want and see what I'm doing? Well, a reputated VPN provider today answers the Question and admitted that they sniffed the traffic on one of its United...

VPN provider 'Proxy.sh' sniffed the traffic of US based server to Catch Hackers

The very first question we always try to figure before choosing a trusted VPN service - Can't a VPN provider just look at my traffic all they want and see what I'm doing? Well, a reputated VPN provider today answers the Question and admitted that they sniffed the traffic on one of its United...

Juniper NetScreen VPN Client Multiple Buffer Overflow Vulnerabilities

The remote host is running a version of Juniper NetScreen VPN client that is affected by multiple buffer overflow vulnerabilities : - The IKE VPN service listening on UDP port 62514 is vulnerable to a stack overflow vulnerability that can be triggered by sending specially crafted packets...

Juniper NetScreen VPN Client Detection

The remote host has the Juniper NetScreen VPN Client installed. C Tenable Network Security. Inc. include"compat.inc"; if description scriptid70120; scriptversion"1.10"; scriptsetattributeattribute:"pluginmodificationdate", value:"2023/02/06"; scriptxrefname:"IAVT", value:"0001-T-0914";...

Juniper Junos Pulse Secure Access Service IVE OS (SSL VPN) Multiple XSS (JSA10589)

According to its self-reported version, the version of Juniper Junos Pulse Secure Access Service IVE OS running on the remote host is affected by multiple unspecified cross-site scripting vulnerabilities that are present on the login and support pages hosted on the device's web server. An attacke...

CVE-2013-5649

Multiple cross-site scripting XSS vulnerabilities in Juniper Junos Pulse Secure Access Service aka SSL VPN with IVE OS 7.1 before 7.1r15, 7.2 before 7.2r11, 7.3 before 7.3r6, and 7.4 before 7.4r3 allow 1 remote attackers to inject arbitrary web script or HTML via vectors involving login pages, an...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Juniper Junos Pulse Secure Access Service aka SSL VPN with IVE OS 7.1 before 7.1r15, 7.2 before 7.2r11, 7.3 before 7.3r6, and 7.4 before 7.4r3 allow 1 remote attackers to inject arbitrary web script or HTML via vectors involving login pages, an...

CVE-2013-5649

Multiple cross-site scripting XSS vulnerabilities in Juniper Junos Pulse Secure Access Service aka SSL VPN with IVE OS 7.1 before 7.1r15, 7.2 before 7.2r11, 7.3 before 7.3r6, and 7.4 before 7.4r3 allow 1 remote attackers to inject arbitrary web script or HTML via vectors involving login pages, an...

CVE-2013-5649

CVE-2013-5649 affects Juniper Junos Pulse Secure Access Service (IVE OS) SSL VPN. Vulnerable components are web login and a support page where input validation is insufficient, allowing XSS by unauthenticated users and authenticated users. Impact includes arbitrary script execution in the browser...

Fear of NSA PRISM : Indian Government may ban US email services for official communication

The Indian Government is planning to ban the use of US based email services like Gmail for official communications to increase the security of confidential government information. The recent disconcerting reports that that India was being spied upon by American intelligence agencies has opened an...

ICONICS GENESIS32 Multiple Memory Corruption

Overview Independent security researchers Billy Rios and Terry McCorkle have identified eight memory corruption vulnerabilities affecting the ICONICS GENESIS32 product. GENESIS32 is a web-deployable human-machine interface HMI supervisory control and data acquisition SCADA product. These...

Ecava IntegraXor DLL Hijacking (Update B)

Overview This advisory is a follow-up to ICS-ALERT-10-362-01—Ecava IntegraXor DLL Hijacking. ICS-CERT has become aware of a Uncontrolled Search Path Element vulnerability, commonly referred to as DLL Hijacking, in the Ecava IntegraXor supervisory control and data acquisition SCADA product. ICS-CE...

Siemens WinCC Exploitable Crashes

Overview ICS-CERT Advisory ICSA-11-175-02P was originally released to the US-CERT Portal on June 24, 2011. This web page release was delayed to allow users sufficient time to download and install the update. ICS-CERT has received a report from independent security researchers Billy Rios and Terry...