CVE-2014-0667

The RMI interface in Cisco Secure Access Control System ACS does not properly enforce authorization requirements, which allows remote authenticated users to read arbitrary files via a request to this interface, aka Bug ID CSCud75169...

CVE-2014-0650

CVE-2014-0650 affects Cisco Secure Access Control System (ACS) 5.x up to, but not including, 5.4 Patch 3. The issue is in the web interface input validation that could allow a remote attacker to inject operating-system commands via a request to the web interface. The vulnerability is part of a se...

CVE-2014-0648

The RMI interface in Cisco Secure Access Control System ACS 5.x before 5.5 does not properly enforce authentication and authorization requirements, which allows remote attackers to obtain administrative access via a request to this interface, aka Bug ID CSCud75187...

Multiple Vulnerabilities in Cisco Secure Access Control System (cisco-sa-20140115-csacs)

The version of Cisco Secure Access Control System ACS running on the remote host is affected by one or more of the following issues : - A flaw in the authorization enforcement of the RMI interface could allow a remote, authenticated attacker to perform actions as superadmin. CVE-2014-0649 - A fla...

Multiple Vulnerabilities in Cisco Secure Access Control System

Cisco Secure Access Control System ACS is affected by the following vulnerabilities: Cisco Secure ACS RMI Privilege Escalation Vulernability Cisco Secure ACS RMI Unauthenticated User Access Vulnerability Cisco Secure ACS Operating System Command Injection Vulnerability Cisco Secure ACS uses the...

Cisco Releases Security Advisory for Cisco Secure Access Control System

Cisco has released a security advisory to address multiple vulnerabilities in Cisco Secure Access Control System ACS. These vulnerabilities affect the following: Cisco Secure ACS RMI Privilege Escalation Vulnerability Cisco Secure ACS RMI Unauthenticated User Access Vulnerability Cisco Secure ACS...

Cross site scripting

Cross-site scripting XSS vulnerability in the web framework in Cisco Secure Access Control System ACS allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCum03625...

CVE-2014-0663

Cisco Secure Access Control System (ACS) web framework contains a Cross‑Site Scripting (XSS) flaw due to insufficient input validation of an unspecified parameter. An unauthenticated, remote attacker can lure a user to a malicious link to execute arbitrary web script or HTML in the web interface....

CVE-2014-0663

Cross-site scripting XSS vulnerability in the web framework in Cisco Secure Access Control System ACS allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCum03625...

Cisco Secure Access Control System Cross-Site Scripting Vulnerability

A vulnerability in Cisco Secure Access Control System ACS could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of the affected system. The vulnerability is due to insufficient input validation of a parameter. An attacke...

CVE-2013-6974

CVE-2013-6974 affects Cisco Secure Access Control System (ACS) web interface. The vulnerability is a Cross-Site Scripting (XSS) flaw caused by insufficient input validation of a parameter, enabling an unauthenticated, remote attacker to inject arbitrary web script or HTML via a crafted link. Cisc...

CVE-2013-6695

The RBAC implementation in Cisco Secure Access Control System ACS does not properly verify privileges for support-bundle downloads, which allows remote authenticated users to obtain sensitive information via a download action, as demonstrated by obtaining read access to the user database, aka Bug...

Code injection

Cisco Secure Access Control System ACS does not properly implement an incoming-packet firewall rule, which allows remote attackers to cause a denial of service process crash via a flood of crafted packets, aka Bug ID CSCui51521...

Cisco Secure Access Control System (ACS) Multiple Vulnerabilities

The version of Cisco Secure Access Control System installed on the remote host is potentially affected by multiple vulnerabilities : - An unspecified cross-site scripting vulnerability exists in the web interface. CVE-2013-3423 - An unspecified cross-site request forgery vulnerability exists in t...

CVE-2013-5470

Cisco Secure Access Control System ACS does not properly handle requests to read from the TACACS+ socket, which allows remote attackers to cause a denial of service process crash via malformed TCP packets, aka Bug ID CSCuh12488...

Code injection

Cisco Secure Access Control System ACS does not properly handle requests to read from the TACACS+ socket, which allows remote attackers to cause a denial of service process crash via malformed TCP packets, aka Bug ID CSCuh12488...

CVE-2013-5470

Cisco Secure Access Control System ACS does not properly handle requests to read from the TACACS+ socket, which allows remote attackers to cause a denial of service process crash via malformed TCP packets, aka Bug ID CSCuh12488...

CVE-2013-5470

Cisco Secure ACS is affected by CVE-2013-5470 due to a flaw in the TACACS+ socket read function that allows an unauthenticated, remote attacker to crash the runtime process and cause a denial of service. The issue stems from improper processing of read requests on the TACACS+ socket, and can be t...

Cisco Secure Access Control System Version

The remote host is running Cisco Secure Access Control System ACS, an access control management and appliance system. It is possible to get the ACS version number via SSH. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid69133; scriptversion"1.5";...

Cisco Secure Access Control System Help Index Cross-Site Scripting Vulnerability

A vulnerability in the Access Control System Help index page of Cisco Access Control System ACS could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of the affected system. The vulnerability is due to insufficient input...