CVE-2015-0663: Undefined Security Weakness

Cisco AnyConnect Secure Mobility Client 4.0.00051 and earlier does not properly implement access control for IPC messages, which allows local users to write to arbitrary files via crafted messages, aka Bug ID CSCus79392...

CVE-2014-8021

CVE-2014-8021 is an XSS vulnerability in Cisco AnyConnect Secure Mobility Client <= 3.1.x and Cisco HostScan Engine

PT-2015-3986

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client version 3.1.02043 and earlier Cisco HostScan Engine version 3.1.05183 and earlier Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via vectors...

CVE-2014-8021: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Cisco AnyConnect Secure Mobility Client 3.1.02043 and earlier and Cisco HostScan Engine 3.1.05183 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving an applet-path URL, aka Bug IDs CSCup82990 and CSCuq80149...

Mac OS X : Cisco AnyConnect Secure Mobility Client < 3.1(6042) Host Validation Vulnerability

The remote Mac OS X host has a version of Cisco AnyConnect Secure Mobility Client prior to 3.16042. It is, therefore, affected by a vulnerability due to insufficient validation of the type of host which the client is connecting to. An attacker, by tricking users to connect to a malicious host, ca...

Buffer overflow

Buffer overflow in the Active Template Library ATL framework in the VPNAPI COM module in Cisco AnyConnect Secure Mobility Client 2.x allows user-assisted remote attackers to execute arbitrary code via a crafted HTML document, aka Bug ID CSCuj58139...

PT-2013-5639

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client versions 2.x Description The issue is related to a buffer overflow in the Active Template Library ATL framework within the VPNAPI COM module. This allows remote attackers to execute arbitrary code when a...

CVE-2013-5559: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the Active Template Library ATL framework in the VPNAPI COM module in Cisco AnyConnect Secure Mobility Client 2.x allows user-assisted remote attackers to execute arbitrary code via a crafted HTML document, aka Bug ID CSCuj58139...

CVE-2013-1130

Cisco AnyConnect Secure Mobility Client on macOS is affected by weak permissions in a library directory (root cause: misconfigured library directory permissions), enabling local privilege escalation via a crafted library file (Bug ID CSCue33619). No patch/version details are provided in the suppl...

PT-2013-2900

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client affected versions not specified Description The issue is related to weak permissions for a library directory in Cisco AnyConnect Secure Mobility Client on Mac OS X, allowing local users to gain privilege...

CVE-2013-1130: Undefined Security Weakness

Cisco AnyConnect Secure Mobility Client on Mac OS X uses weak permissions for a library directory, which allows local users to gain privileges via a crafted library file, aka Bug ID CSCue33619...

CVE-2013-1172

CVE-2013-1172 affects Cisco AnyConnect Secure Mobility Client (VPN Client) via the Host Scan component. The issue arises from how the Cisco Security Service/Host Scan handles messages for file manipulation, failing to verify files properly. This root cause enables a local, unprivileged user with ...

CVE-2013-1173

CVE-2013-1173 is a heap-based buffer overflow in ciscod.exe within the Cisco Security Service of Cisco AnyConnect Secure Mobility Client. Exploitation enables local privilege escalation to SYSTEM. Affected: Cisco AnyConnect Secure Mobility Client (Host Scan component) with vulnerable host-scan ha...

PT-2013-2940

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client affected versions not specified Description The issue is related to the Cisco Security Service in Cisco AnyConnect Secure Mobility Client, which does not properly verify files. This allows local users to...

PT-2013-2941

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client affected versions not specified Description A heap-based buffer overflow issue in the ciscod.exe component of the Cisco Security Service allows local users to gain privileges. The issue can be exploited...

CVE-2013-1172: Improper Input Validation

The Cisco Security Service in Cisco AnyConnect Secure Mobility Client aka AnyConnect VPN Client does not properly verify files, which allows local users to gain privileges via unspecified vectors, aka Bug ID CSCud14153...

CVE-2013-1173: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in ciscod.exe in the Cisco Security Service in Cisco AnyConnect Secure Mobility Client aka AnyConnect VPN Client allows local users to gain privileges via unspecified vectors, aka Bug ID CSCud14143...

Cisco VPN Client Denial of Service Vulnerability

Cisco VPN Client contains a vulnerability that could allow an authenticated, local attacker to cause a denial of service DoS condition on a targeted system. The vulnerability is due to improper interaction between the VPN driver and the operating system kernel on a device running the vulnerable...

CVE-2012-3088

Cisco AnyConnect Secure Mobility Client 3.1.x before 3.1.00495, and 3.2.x, does not check whether an HTTP request originally contains ScanSafe headers, which allows remote attackers to have an unspecified impact via a crafted request, aka Bug ID CSCua13166...

CVE-2012-3094

The VPN downloader in the downloadinstall component in Cisco AnyConnect Secure Mobility Client 3.1.x before 3.1.00495 on Linux accepts arbitrary X.509 server certificates without user interaction, which allows remote attackers to obtain sensitive information via vectors involving an invalid...