GEOVAP Reliance 4 Control Server Unquoted Service Path Elevation Of Privilege

Summary Reliance is a professional SCADA/HMI system designed for the visualization and control of industrial processes and for building automation. Description The application suffers from an unquoted search path issue impacting the service 'RelianceOpcDaWrapper' for Windows deployed as part of...

Cisco Secure Access Control Server Security Restriction Bypass Vulnerability (CNVD-2015-07358)

Cisco Secure Access Control Server that is ACS, is the United States Cisco Cisco a security access control server. A security restriction bypass vulnerability exists in Cisco Secure Access Control Server 5.7. It allows an authenticated remote user to bypass expected RBAC restrictions and create...

Cisco Secure Access Control Server Security Restriction Bypass Vulnerability

Cisco Secure Access Control Server that is ACS, is the United States Cisco Cisco a security access control server. A security restriction bypass vulnerability exists in Cisco Secure Access Control Server 5.7. It allows an authenticated remote user to bypass expected RBAC restrictions by accessing...

Cisco Secure Access Control Server Cross-Site Scripting Vulnerability

Cisco Secure Access Control Server that is ACS, is the United States Cisco Cisco a security access control server. A cross-site scripting vulnerability exists in Cisco Secure Access Control Server 5.7. This allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

Shuanet Adware Roots Android Devices

A new strain of adware buried in repackaged popular Android applications is able to root devices and earn its keepers a tidy $2 per installation. Shuanet behaves more like malware and shares some heritage with two other adware families—Kemoge and Shedun—that also root devices and give their...

Cisco ACS Solution Engine Cross-Site Scripting Vulnerability

Cisco Secure Access Control Server ACS is a security access control server from Cisco, Inc.Solution Engine is one of the server engine solutions. Cisco Secure Access Control Server ACS version 5.70.15, an XSS vulnerability exists in the web interface of Solution Engine. A remote attacker could...

CVE-2015-6349

Cross-site scripting XSS vulnerability in the web interface in the Solution Engine in Cisco Secure Access Control Server ACS 5.70.15 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

Cross site scripting

Cross-site scripting XSS vulnerability in the web interface in the Solution Engine in Cisco Secure Access Control Server ACS 5.70.15 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2015-6347

CVE-2015-6347 affects Cisco Secure Access Control Server (ACS) 5.7(0.15) where the Solution Engine allows remote authenticated users to bypass RBAC and create a dashboard or portlet by visiting an unrestricted web page. The root cause is flawed RBAC validation when creating administrative dashboa...

CVE-2015-6348

The CVE-2015-6348 issue affects Cisco Secure Access Control Server (ACS) 5.7(0.15) where the report-generation web interface contains RBAC validation weaknesses. An authenticated remote user could access restricted report/status pages via the report-generation web interface, potentially exposing ...

CVE-2015-6349

CVE-2015-6349 affects Cisco Secure Access Control Server (ACS) 5.7(0.15) Solution Engine, where the web interface is vulnerable to reflecte d cross-site scripting due to lack of input validation on user-supplied input. An unauthenticated, remote attacker could exploit a crafted URL to inject arbi...

CVE-2015-6346

CVE-2015-6346 is a cross-site scripting (XSS) vulnerability in Cisco Secure Access Control Server (ACS) web interface, specifically in ACS 5.7(0.15). The root cause, per Cisco’s advisory, is a lack of input validation in DOM handling, enabling a DOM-based XSS when a crafted URL is processed. The ...

PT-2015-2589

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control Server ACS version 5.70.15 Description The issue concerns a component of the Cisco Secure Access Control System, specifically the Solution Engine, which has inadequate access restrictions to certain functions. This...

PT-2015-2590

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control Server versions 5.70.15 Description The issue exists due to insufficient protection of the web page structure, allowing for the injection of arbitrary web script or HTML code. This can be exploited by a remote...

CVE-2015-6346: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Cisco Secure Access Control Server ACS 5.70.15 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2015-6349: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the web interface in the Solution Engine in Cisco Secure Access Control Server ACS 5.70.15 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2015-6347: Undefined Security Weakness

The Solution Engine in Cisco Secure Access Control Server ACS 5.70.15 allows remote authenticated users to bypass intended RBAC restrictions, and create a dashboard or portlet, by visiting an unspecified web page...

CVE-2015-6348: Undefined Security Weakness

The report-generation web interface in the Solution Engine in Cisco Secure Access Control Server ACS 5.70.15 allows remote authenticated users to bypass intended RBAC restrictions, and read report or status information, by visiting an unspecified web page...

CVE-2015-6345: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Solution Engine in Cisco Secure Access Control Server ACS 5.70.15 allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCuw24700...

PT-2015-2591

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control Server ACS version 5.70.15 Description The issue is related to a SQL injection vulnerability in the Solution Engine component. This vulnerability allows remote authenticated users to execute arbitrary SQL commands v...