Cisco Mobility Services Engine sshd_config Trust Management Vulnerability

Cisco Mobility Services Engine MSE is a platform Mobility Services Engine that provides Wi-Fi services from Cisco. The platform collects, stores and manages data from wireless clients, Cisco access points and controllers. A security vulnerability exists in the default configuration of sshdconfig ...

Cisco Mobility Services Engine Elevation of Privilege Vulnerability

Cisco Mobility Services Engine MSE is a platform Mobility Services Engine that provides Wi-Fi services from Cisco. The platform collects, stores and manages data from wireless clients, Cisco access points and controllers. A security vulnerability exists in Cisco MSE 8.0.120.7 and prior versions...

Hardcoded credentials

The default configuration of sshdconfig in Cisco Mobility Services Engine MSE through 8.0.120.7 allows logins by the oracle account, which makes it easier for remote attackers to obtain access by entering this account's hardcoded password in an SSH session, aka Bug ID CSCuv40501...

Code injection

Cisco Mobility Services Engine MSE through 8.0.120.7 uses weak permissions for unspecified binary files, which allows local users to obtain root privileges by writing to a file, aka Bug ID CSCuv40504...

Cisco Mobility Services Engine Static Credential Vulnerability

A vulnerability in the Cisco Mobility Services Engine MSE could allow an unauthenticated, remote attacker to log in to the MSE with the default oracle account. This account does not have full administrator privileges. The vulnerability is due to a user account that has a default and static...

Cisco Mobility Services Engine Privilege Escalation Vulnerability

A vulnerability in the installation procedure of the Cisco Mobility Services Engine MSE appliance could allow an authenticated, local attacker to escalate to the root level. The vulnerability is due to incorrect installation and permissions settings on binary files during the MSE physical or...

CVE-2015-6322

CVE-2015-6322 affects Cisco AnyConnect Secure Mobility Client IPC channel. The vulnerability arises from missing source-path validation in IPC commands, allowing a local attacker to bypass access restrictions and move arbitrary files with elevated privileges. Affected products include AnyConnect ...

Aruba Networks Mobility Controller Cross-Site Request Forgery Vulnerability

Aruba Networks Mobility Controller is a suite of solutions that provide mobile access for the enterprise. A cross-site request forgery vulnerability exists in Aruba Networks Mobility Controller, which allows remote attackers to construct malicious URIs, trick users into parsing them, and can...

Aruba Networks Mobility Controller Cross-Site Scripting Vulnerability

Aruba Networks Mobility Controller is a suite of solutions that provide mobile access for the enterprise. A cross-site scripting vulnerability in Aruba Networks Mobility Controller allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to...

CVE-2015-6306

Cisco AnyConnect Secure Mobility Client 4.18 on OS X and Linux does not verify pathnames before installation actions, which allows local users to obtain root privileges via a crafted installation file, aka Bug ID CSCuv11947...

CVE-2015-6305

CVE-2015-6305 affects Cisco AnyConnect Secure Mobility Client for Windows (versions 2.0–4.1). The issue arises from untrusted search path handling in vpndownloader.exe’s CMainThread::launchDownloader, enabling a local attacker with valid credentials to plant a malicious DLL in the current working...

CVE-2015-6306

Cisco AnyConnect Secure Mobility Client 4.18 on OS X and Linux does not verify pathnames before installation actions, which allows local users to obtain root privileges via a crafted installation file, aka Bug ID CSCuv11947...

CVE-2015-6306

Cisco AnyConnect Secure Mobility Client 4.1(8) on OS X and Linux is affected by an elevation-of-privilege vulnerability (CVE-2015-6306) due to not verifying pathnames before installation actions, enabling local users to obtain root privileges via a crafted installation file. Public writeups descr...

Cisco AnyConnect 3.1.08009 - Local Privilege Escalation (via DMG Install Script)

Cisco AnyConnect 3.1.08009 - Local Privilege Escalation via DMG Install Script / Cisco AnyConnect elevation of privileges via DMG install script - proof of concept Yorick Koster, July 2015 https://securify.nl/advisory/SFY20150701/ciscoanyconnectelevationofprivilegesviadmginstallscript.html based ...

Important: Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update

Updated kernel-rt packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, whic...

Cisco AnyConnect Secure Mobility Client 3.x < 3.1.10010.0 / 4.x < 4.1.4011.0 Arbitrary File Write

The Cisco AnyConnect Secure Mobility Client installed on the remote host is version 3.x prior to 3.1.10010.0 or 4.x prior to 4.1.4011.0. It is, therefore, affected by a flaw due to improper sanitization of user-supplied input. An unauthenticated, remote attacker can exploit this issue, by...

Mac OS X : Cisco AnyConnect Secure Mobility Client < 3.1.8009.0 / 4.0.x < 4.0.2052.0 / 4.1.x < 4.1.28.0 Multiple Vulnerabilities

The Cisco AnyConnect Secure Mobility Client installed on the remote Mac OS X host is a version prior to 3.1.8009.0, or is version 4.0.x prior to 4.0.2052.0, or version 4.1.x prior to 4.1.28.0. It is, therefore, affected by the following vulnerabilities : - A flaw exists due to not sanitizing the...

Cisco AnyConnect Secure Mobility Client < 3.1.10010.0 / 4.0.x < 4.0.4013.0 / 4.1.x < 4.1.4011.0 IPC File Write Vulnerability

The Cisco AnyConnect Secure Mobility Client installed on the remote host is a version prior to 3.1.10010.0, or is version 4.0.x prior to 4.0.4013.0, or version 4.1.x prior to 4.1.4011.0. It is, therefore, affected by a flaw that allows unauthenticated IPC commands to write files. A local,...

Cisco AnyConnect Secure Mobility Client < 3.1.8009.0 / 4.0.x < 4.0.2052.0 / 4.1.x < 4.1.28.0 Multiple Vulnerabilities

The Cisco AnyConnect Secure Mobility Client installed on the remote host is a version prior to 3.1.8009.0, or is version 4.0.x prior to 4.0.2052.0, or version 4.1.x prior to 4.1.28.0. It is, therefore, affected by the following vulnerabilities : - A flaw exists due to not sanitizing the input of...

Cisco AnyConnect Secure Mobility Client Directory Traversal Vulnerability

The Cisco AnyConnect Secure Mobility Client is Cisco's next-generation VPN client. Cisco AnyConnect Secure Mobility Client 4.0 2049 has a directory traversal vulnerability in the implementation of the connection establishment process that could allow an unauthenticated, remote attacker to perform...