CVE-2014-3393

The CVE-2014-3393 issue affects Cisco ASA Software’s Clientless SSL VPN Portal Customization framework. The vulnerability arises from improper authentication checks in the portal customization framework, allowing an unauthenticated, remote attacker to modify RAMFS customization objects and potent...

CVE-2014-3385

CVE-2014-3385 is a race condition in the Health and Performance Monitoring (HPM) feature of Cisco ASA Software that can be exploited by sending a large number of half-open TCP connections to trigger a device reload and DoS. Affected ASA versions include 8.3 (before 8.3(2.42)), 8.4 (before 8.4(7.1...

CVE-2014-3392

CVE-2014-3392 affects Cisco ASA Clientless SSL VPN Portal. A memory disclosure/memory modification flaw in the portal could be exploited remotely by crafting parameters, impacting multiple software branches. Affected versions include ASA 8.2 (up to 8.2(5.50)), 8.3 (up to 8.3(2.41)), 8.4 (up to 8....

CVE-2014-3394

The Smart Call Home SCH implementation in Cisco ASA Software 8.2 before 8.25.50, 8.4 before 8.47.15, 8.6 before 8.61.14, 8.7 before 8.71.13, 9.0 before 9.04.8, and 9.1 before 9.15.1 allows remote attackers to bypass certificate validation via an arbitrary VeriSign certificate, aka Bug ID CSCun109...

CVE-2014-3388

The DNS inspection engine in Cisco ASA Software 9.0 before 9.04.13, 9.1 before 9.15.7, and 9.2 before 9.22 allows remote attackers to cause a denial of service device reload via crafted DNS packets, aka Bug ID CSCuo68327...

CVE-2014-3391

Untrusted search path vulnerability in Cisco ASA Software 8.x before 8.43, 8.5, and 8.7 before 8.71.13 allows local users to gain privileges by placing a Trojan horse library file in external memory, leading to library use after device reload because of an incorrect LDLIBRARYPATH value, aka Bug I...

CVE-2014-3391

CVE-2014-3391 is a local privilege escalation in Cisco ASA Software caused by an untrusted LD_LIBRARY_PATH that enables a Trojan-horse library to be loaded from external memory, triggering a library load after reload. Affected products are Cisco ASA Software 8.x, specifically before 8.4(3), 8.5, ...

CVE-2014-3385

Race condition in the Health and Performance Monitoring HPM for ASDM feature in Cisco ASA Software 8.3 before 8.32.42, 8.4 before 8.47.11, 8.5 before 8.51.19, 8.6 before 8.61.13, 8.7 before 8.71.11, 9.0 before 9.04.8, and 9.1 before 9.14.5 allows remote attackers to cause a denial of service devi...

CVE-2014-3387

The SunRPC inspection engine in Cisco ASA Software 7.2 before 7.25.14, 8.2 before 8.25.51, 8.3 before 8.32.42, 8.4 before 8.47.23, 8.5 before 8.51.21, 8.6 before 8.61.14, 8.7 before 8.71.13, 9.0 before 9.04.5, and 9.1 before 9.15.3 allows remote attackers to cause a denial of service device reloa...

CVE-2014-3393

The Clientless SSL VPN portal customization framework in Cisco ASA Software 8.2 before 8.25.51, 8.3 before 8.32.42, 8.4 before 8.47.23, 8.6 before 8.61.14, 9.0 before 9.04.24, 9.1 before 9.15.12, and 9.2 before 9.22.4 does not properly implement authentication, which allows remote attackers to...

CVE-2014-3405

Cisco IOS XE enables the IPv6 Routing Protocol for Low-Power and Lossy Networks aka RPL on both the Autonomic Control Plane ACP and external Autonomic Networking Infrastructure ANI interfaces, which allows remote attackers to conduct route-injection attacks via crafted RPL advertisements on an AN...

CVE-2014-3404

The Autonomic Networking Infrastructure ANI component in Cisco IOS XE does not properly validate certificates, which allows remote attackers to trigger acceptance of an invalid message via crafted messages, aka Bug ID CSCuq22677...

Design/Logic Flaw

The Autonomic Networking Infrastructure ANI component in Cisco IOS XE does not properly validate certificates, which allows remote attackers to spoof devices via crafted messages, aka Bug ID CSCuq22647...

Design/Logic Flaw

Cisco IOS XE enables the IPv6 Routing Protocol for Low-Power and Lossy Networks aka RPL on both the Autonomic Control Plane ACP and external Autonomic Networking Infrastructure ANI interfaces, which allows remote attackers to conduct route-injection attacks via crafted RPL advertisements on an AN...

CVE-2014-3404

The Autonomic Networking Infrastructure ANI component in Cisco IOS XE does not properly validate certificates, which allows remote attackers to trigger acceptance of an invalid message via crafted messages, aka Bug ID CSCuq22677...

Information disclosure

The SSL VPN implementation in Cisco Adaptive Security Appliance ASA Software 9.2.2.4 and earlier does not properly manage session information during creation of a SharePoint handler, which allows remote authenticated users to overwrite arbitrary RAMFS cache files or inject Lua programs, and...

CVE-2014-3399

The SSL VPN implementation in Cisco Adaptive Security Appliance ASA Software 9.2.2.4 and earlier does not properly manage session information during creation of a SharePoint handler, which allows remote authenticated users to overwrite arbitrary RAMFS cache files or inject Lua programs, and...

CVE-2014-3398

The SSL VPN implementation in Cisco Adaptive Security Appliance ASA Software allows remote attackers to obtain potentially sensitive software-version information by reading the verbose response data that is provided for a request to an unspecified URL, aka Bug ID CSCuq65542...

Design/Logic Flaw

The SSL VPN implementation in Cisco Adaptive Security Appliance ASA Software allows remote attackers to obtain potentially sensitive software-version information by reading the verbose response data that is provided for a request to an unspecified URL, aka Bug ID CSCuq65542...

Design/Logic Flaw

Cisco IOS XR on ASR 9000 devices does not properly use compression for port-range and address-range encoding, which allows remote attackers to bypass intended Typhoon line-card ACL restrictions via transit traffic, aka Bug ID CSCup30133...