8504 matches found
CVE-2002-1092
Cisco VPN 3000 Concentrator 3.6Rel and earlier, and 2.x.x, when configured to use internal authentication with group accounts and without any user accounts, allows remote VPN clients to log in using PPTP or IPSEC user authentication...
CVE-2002-1102
CVE-2002-1102 affects Cisco VPN 3000 Concentrator LAN-to-LAN IPSEC capability (versions 2.2.x and 3.x before 3.5.4). A remote attacker can trigger a denial of service by initiating a LAN-to-LAN connection that conflicts with an existing security association, causing the concentrator to terminate ...
CVE-2002-1104
CVE-2002-1104 concerns Cisco VPN Client software (versions 2.x.x and 3.x prior to 3.0.5). The vulnerability allows remote attackers to trigger a denial of service (crash) by sending TCP packets with both source and destination ports equal to 137 (NETBIOS). The available description states the imp...
CVE-2002-1108
Cisco VPN Client software 2.x.x and 3.x before 3.6(Rel) are affected when configured with all tunnel mode. The issue arises because the client can be forced into acknowledging a TCP packet from outside the tunnel, indicating a potential tunnel bypass/traffic handling anomaly. The connected docume...
CVE-2002-1093
The CVE-2002-1093 issue concerns Cisco VPN 3000 Concentrator HTML interface DoS caused by a flaw in the HTML parser when handling excessively long URL requests. A remote attacker could trigger CPU exhaustion, leading to a denial of service on affected devices (2.x.x and 3.x.x prior to 3.0.3(B)). ...
CVE-2002-1106
Cisco Virtual Private Network VPN Client software 2.x.x, and 3.x before 3.5.1C, does not properly verify that certificate DN fields match those of the certificate from the VPN Concentrator, which allows remote attackers to conduct man-in-the-middle attacks...
CVE-2002-1095
The vulnerability CVE-2002-1095 affects Cisco VPN 3000 Concentrator firmware prior to 2.5.2(F). When encryption is enabled, a remote attacker using a Windows PPTP client with the No Encryption option can trigger a denial of service (reload). The description does not provide additional root-cause ...
CVE-2002-1096
CVE-2002-1096 affects Cisco VPN 3000 Concentrator (2.2.x and 3.x before 3.5.1). The root cause is that user passwords are stored in plaintext inside HTML source code of the embedded web server, allowing restricted administrators to obtain passwords. Documents confirm the vulnerability and impacte...
CVE-2002-1105
CVE-2002-1105 affects Cisco VPN Client software 2.x.x and 3.x before 3.5.1C. A local user can use a utility program to obtain the group password, indicating a credential exposure/removal of password material on affected clients. The description does not specify a root cause beyond the existence o...
CVE-2004-0190
Symantec FireWall/VPN Appliance model 200 records a cleartext password for the password administration page, which may be cached on the administrator's local system or in a proxy, which allows attackers to steal the password and gain privileges...
CVE-2002-1098
Cisco VPN 3000 Concentrator 2.2.x, and 3.x before 3.5.3, adds an "HTTPS on Public Inbound XML-Autoforward/in" rule but sets the protocol to "ANY" when the XML filter configuration is enabled, which ultimately allows arbitrary traffic to pass through the concentrator...
CVE-2002-1099
Cisco VPN 3000 Concentrator 2.2.x, and 3.x before 3.5.3, allows remote attackers to obtain potentially sensitive information without authentication by directly accessing certain HTML pages...
CVE-2002-1092
CVE-2002-1092 affects Cisco VPN 3000 Concentrator 3.6(Rel) and earlier, and 2.x.x, where using internal authentication with group accounts and no user accounts allows remote VPN clients to log in via PPTP or IPSEC user authentication. Root cause identified in multiple advisories for the Cisco VPN...
CVE-2002-1098
CVE-2002-1098 affects Cisco VPN 3000 Concentrator 2.2.x and 3.x prior to 3.5.3. When the XML filter configuration is enabled, the device’s HTTPS on Public Inbound (XML-Auto)(forward/in) rule sets the protocol to ANY, allowing arbitrary traffic to pass through the concentrator. The available docum...
CVE-2002-1106
Cisco VPN Client software 2.x.x and 3.x prior to 3.5.1C is vulnerable because it does not properly verify that certificate DN fields match the VPN Concentrator certificate, enabling potential remote man-in-the-middle attacks. This is the explicit vulnerability described in CVE-2002-1106. The prov...
Cisco Security Advisory: Vulnerabilities in Kerberos 5 Implementation
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Vulnerabilities in Kerberos 5 Implementation Revision 1.0 For Public Release 2004 August 31 1830 UTC GMT - ---------------------------------------------------------------------- Contents ======== Summary Affected Products...
GLSA-200404-05 : ipsec-tools contains an X.509 certificates vulnerability.
The remote host is affected by the vulnerability described in GLSA-200404-05 ipsec-tools contains an X.509 certificates vulnerability. racoon a utility in the ipsec-tools package does not verify digital signatures on Phase1 packets. This means that anybody holding the correct X.509 certificate...
ISS Protection Brief: Entrust Libkmp Library Buffer Overflow
-----BEGIN PGP SIGNED MESSAGE----- Internet Security Systems Protection Brief August 26, 2004 Entrust LibKmp Library Buffer Overflow Summary: ISS X-Force has discovered a flaw in the Entrust LibKmp ISAKMP library. This library is used by multiple VPN vendors to facilitate IKE key exchange for...
Novell Bordermanager VPN Service denial-of-service vulnerability
Overview A vulnerability exists in the Novell Bordermanager VPN service that could allow a remote attacker to cause a denial of service. Description The Novell Bordermanager product includes Virtual Private Network VPN capabilities, including support for the standard Internet Key Exchange IKE...