Hackers Backdooring Cisco WebVPN To Steal Customers’ Passwords

Virtual Private Networks VPNs, which is widely used by many businesses and organisations to provide secure access to their workers, are being abused to pilfer corporate user credentials. Researchers from security firm Volexity discovered a new attack campaign that targets a widely used VPN produc...

Cisco ASA VPN XML Parser DoS Vulnerability (cisco-sa-20150408-asa)

Cisco ASA is prone to a DoS vulnerability in the VPN XML Parser. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

CVE-2015-0677: Improper Input Validation

The XML parser in Cisco Adaptive Security Appliance ASA Software 8.4 before 8.47.28, 8.6 before 8.61.17, 9.0 before 9.04.33, 9.1 before 9.16, 9.2 before 9.23.4, and 9.3 before 9.33, when Clientless SSL VPN, AnyConnect SSL VPN, or AnyConnect IKEv2 VPN is used, allows remote attackers to cause a...

PT-2015-1057 · Cisco · Cisco Asa

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software versions 8.4 through 8.47.27 Cisco Adaptive Security Appliance ASA Software versions 8.6 through 8.61.16 Cisco Adaptive Security Appliance ASA Software versions 9.0 through 9.04.32 Cisco Adaptive...

Cisco ASA Challenge-Response Tunnel Group Selection Bypass Vulnerability

A vulnerability in the authentication code of Cisco ASA Software could allow an authenticated, remote attacker to access resources of a VPN tunnel group. The vulnerability is due to improper implementation of the tunnel group selection when a user authenticates to the remote access VPN via the...

CVE-2014-3393

The Clientless SSL VPN portal customization framework in Cisco ASA Software (versions 8.2 before 8.2(5.51), 8.3 before 8.3(2.42), 8.4 before 8.4(7.23), 8.6 before 8.6(1.14), 9.0 before 9.0(4.24), 9.1 before 9.1(5.12), and 9.2 before 9.2(2.4)) fails to properly implement authentication. This flaw ...

CVE-2014-3392: Undefined Security Weakness

The Clientless SSL VPN portal in Cisco ASA Software 8.2 before 8.25.51, 8.3 before 8.32.42, 8.4 before 8.47.23, 8.6 before 8.61.15, 9.0 before 9.04.24, 9.1 before 9.15.12, 9.2 before 9.22.8, and 9.3 before 9.31.1 allows remote attackers to obtain sensitive information from process memory or modif...

Cisco ASA Software Multiple Vulnerabilities (cisco-sa-20141008-asa)

The remote Cisco ASA device is affected by one or more of the following vulnerabilities : - A flaw exists in the SQLNET Inspection Engine due to improper handling of SQL REDIRECT packets. An attacker can exploit this vulnerability by sending a crafted sequence of REDIRECT packets through the...

CVE-2014-3393: Improper Authentication

The Clientless SSL VPN portal customization framework in Cisco ASA Software 8.2 before 8.25.51, 8.3 before 8.32.42, 8.4 before 8.47.23, 8.6 before 8.61.14, 9.0 before 9.04.24, 9.1 before 9.15.12, and 9.2 before 9.22.4 does not properly implement authentication, which allows remote attackers to...

Cisco ASA Clientless SSL VPN Portal Customization Integrity Vulnerability

A vulnerability in the Clientless SSL VPN portal customization framework could allow an unauthenticated, remote attacker to modify the content of the Clientless SSL VPN portal, which could lead to several attacks including the stealing of credentials, cross-site scripting XSS, and other types of...

PT-2014-5283 · Cisco · Cisco Asa

Name of the Vulnerable Software and Affected Versions: Cisco ASA Software versions 8.2 through 8.25.50 Cisco ASA Software versions 8.3 through 8.32.41 Cisco ASA Software versions 8.4 through 8.47.22 Cisco ASA Software versions 8.6 through 8.61.13 Cisco ASA Software versions 9.0 through 9.04.23...

Cisco ASA <= 8.x VPN SSL module Clientless URL-list control bypass

No description provided by source...

CVE-2013-5551: Improper Restriction of Operations within the Bounds of a Memory Buffer

Cisco Adaptive Security Appliance ASA Software, when certain same-security-traffic and management-access options are enabled, allows remote authenticated users to cause a denial of service stack overflow and device reload by using the clientless SSL VPN portal for internal-resource browsing, aka...

PT-2013-5632 · Cisco · Cisco Asa

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software affected versions not specified Description: The issue allows remote authenticated users to cause a denial of service, resulting in a stack overflow and device reload. This can be achieved by usi...

CVE-2013-5515: Improper Restriction of Operations within the Bounds of a Memory Buffer

The Clientless SSL VPN feature in Cisco Adaptive Security Appliance ASA Software 8.x before 8.25.44, 8.3.x before 8.32.39, 8.4.x before 8.45.7, 8.6.x before 8.61.12, 9.0.x before 9.02.6, and 9.1.x before 9.11.7 allows remote attackers to cause a denial of service device reload via crafted HTTPS...

PT-2013-5598 · Cisco · Cisco Asa

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software versions 8.x through 8.25.43 Cisco Adaptive Security Appliance ASA Software versions 8.3.x through 8.32.38 Cisco Adaptive Security Appliance ASA Software versions 8.4.x through 8.45.6 Cisco...

Barracuda SSL VPN 680 2.2.2.203 - Redirect Vulnerability

Document Title: =============== Barracuda SSL VPN 680 2.2.2.203 - Redirect Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=755 Barracuda Networks Security ID BNSEC: 727 Release Date: ============= 2013-05-24 Vulnerability Laboratory ID VL-I...

CVE-2013-1199: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in the CIFS implementation in the rewriter module in the Clientless SSL VPN component on Cisco Adaptive Security Appliances ASA devices allows remote authenticated users to cause a denial of service device reload by accessing resources within multiple sessions, aka Bug ID CSCub5899...

Cisco ASA 5500 Series Adaptive Security Appliance Clientless WebVPN Remote Denial of Service Vulnerability

The Cisco ASA 5500 Series Adaptive Security Appliance contains a vulnerability that could allow an authenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to the improper handling of user-supplied requests by an affected system when configured to use th...

Memory corruption

Memory leak on Cisco Adaptive Security Appliances ASA 5500 series devices with software 8.2 through 8.4 allows remote authenticated users to cause a denial of service memory consumption and blank response page by using the clientless WebVPN feature, aka Bug ID CSCth34278...