CVE-2010-4148

CVE-2010-4148 affects AnyConnect 1.2.3.0 (and possibly earlier). The issue is a directory traversal vulnerability caused by insufficient sanitization of downloaded filenames, allowing a remote FTP server to write arbitrary files by crafting a filename with traversal sequences (e.g., ......\…). In...

CVE-2010-4148

Directory traversal vulnerability in AnyConnect 1.2.3.0, and possibly earlier, allows remote FTP servers to write arbitrary files via a ".." dot dot backslash in a filename...

CVE-2010-3903

Unspecified vulnerability in OpenConnect before 2.23 allows remote AnyConnect SSL VPN servers to cause a denial of service application crash via a 404 HTTP status code...

DEBIAN-CVE-2010-3903

Unspecified vulnerability in OpenConnect before 2.23 allows remote AnyConnect SSL VPN servers to cause a denial of service application crash via a 404 HTTP status code...

CVE-2010-3901

OpenConnect before 2.25 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary AnyConnect SSL VPN servers via a crafted server certificate that 1 does not correspond to the server hostname or 2 is presented in circumstances involving a missing...

Code injection

Unspecified vulnerability in OpenConnect before 2.23 allows remote AnyConnect SSL VPN servers to cause a denial of service application crash via a 404 HTTP status code...

Design/Logic Flaw

OpenConnect before 2.25 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary AnyConnect SSL VPN servers via a crafted server certificate that 1 does not correspond to the server hostname or 2 is presented in circumstances involving a missing...

CVE-2010-3903

Unspecified vulnerability in OpenConnect before 2.23 allows remote AnyConnect SSL VPN servers to cause a denial of service application crash via a 404 HTTP status code...

CVE-2010-3901

OpenConnect before 2.25 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary AnyConnect SSL VPN servers via a crafted server certificate that 1 does not correspond to the server hostname or 2 is presented in circumstances involving a missing...

CVE-2009-5009

Double free vulnerability in OpenConnect before 1.40 might allow remote AnyConnect SSL VPN servers to cause a denial of service application crash or possibly have unspecified other impact via a crafted DTLS Cipher option during a reconnect operation...

CVE-2009-5007

The Cisco trial client on Linux for Cisco AnyConnect SSL VPN allows local users to overwrite arbitrary files via a symlink attack on unspecified temporary files...

Code injection

Cisco Secure Desktop CSD, when used in conjunction with an AnyConnect SSL VPN server, does not properly perform verification, which allows local users to bypass intended policy restrictions via a modified executable file...

Directory Traversal Vulnerability in AnyConnect

Vulnerability ID: HTB22629 Reference: http://www.htbridge.ch/advisory/directorytraversalvulnerabilityinanyconnect.html Product: AnyConnect Vendor: AnyConnect http://www.anyconnect.net Vulnerable Version: 1.2.3.0 and Probably Prior Versions Vendor Notification: 27 September 2010 Vulnerability Type...

CVE-2010-3901

OpenConnect before 2.25 is affected by CVE-2010-3901 due to improper validation of X.509 certificates, enabling MITM attacks where an attacker can spoof AnyConnect SSL VPN servers with a certificate that either does not match the server hostname or is presented when --cafile is not configured. Im...

CVE-2010-3903

Unspecified vulnerability in OpenConnect before 2.23 allows remote AnyConnect SSL VPN servers to cause a denial of service application crash via a 404 HTTP status code...

CVE-2009-5008

Cisco Secure Desktop CSD, when used in conjunction with an AnyConnect SSL VPN server, does not properly perform verification, which allows local users to bypass intended policy restrictions via a modified executable file...

CVE-2009-5007

The CVE-2009-5007 entry concerns the Cisco trial client on Linux for Cisco AnyConnect SSL VPN, where local users can overwrite arbitrary files via a symlink attack on unspecified temporary files. Affected component is the Linux client; root cause is a symlink-related path/temporary file handling ...

CVE-2009-5009

OpenConnect vulnerability CVE-2009-5009: a double-free in the DTLS cipher option handling during reconnect on OpenConnect before 1.40 can cause denial of service (application crash) or unspecified impact on remote AnyConnect SSL VPN servers. Affected: OpenConnect

CVE-2009-5009

Double free vulnerability in OpenConnect before 1.40 might allow remote AnyConnect SSL VPN servers to cause a denial of service application crash or possibly have unspecified other impact via a crafted DTLS Cipher option during a reconnect operation...

CVE-2010-3903

CVE-2010-3903 affects OpenConnect (before 2.23). The vulnerability allows remote denial of service (application crash) of an AnyConnect SSL VPN server by triggering a 404 HTTP response. The exact root cause, vulnerable component/file, and remediation are not detailed in the provided documents; ex...