Cisco Mobility Services Engine Anonymous Login Vulnerability

A vulnerability in Cisco Mobility Services Engine could allow an unauthenticated, remote attacker to connect to a database replication port anonymously via Secure Sockets Layer SSL. The vulnerability is due to the misconfiguration of the Oracle SSL service. An attacker could exploit this...

CVE-2013-1173

CVE-2013-1173 is a heap-based buffer overflow in ciscod.exe within the Cisco Security Service of Cisco AnyConnect Secure Mobility Client. Exploitation enables local privilege escalation to SYSTEM. Affected: Cisco AnyConnect Secure Mobility Client (Host Scan component) with vulnerable host-scan ha...

CVE-2013-1172

CVE-2013-1172 affects Cisco AnyConnect Secure Mobility Client (VPN Client) via the Host Scan component. The issue arises from how the Cisco Security Service/Host Scan handles messages for file manipulation, failing to verify files properly. This root cause enables a local, unprivileged user with ...

Cross site scripting

Cross-site scripting XSS vulnerability in the WebAAA login functionality wbalogin.html in Juniper Networks Mobility System Software MSS 7.6.x before 7.6.3, 7.7.x before 7.7.1, 7.5.x before 7.5.3, and other unspecified versions before 7.4 and 7.3 allows remote attackers to inject arbitrary web...

CVE-2012-1038

CVE-2012-1038 describes a cross-site scripting (XSS) vulnerability in Juniper Networks Mobility System Software (MSS) WebAAA login (wba_login.html). The issue arises in MSS 7.6.x before 7.6.3, 7.7.x before 7.7.1, 7.5.x before 7.5.3, and other unspecified versions prior to 7.4 and 7.3, where a cra...

CVE-2012-1038

Cross-site scripting XSS vulnerability in the WebAAA login functionality wbalogin.html in Juniper Networks Mobility System Software MSS 7.6.x before 7.6.3, 7.7.x before 7.7.1, 7.5.x before 7.5.3, and other unspecified versions before 7.4 and 7.3 allows remote attackers to inject arbitrary web...

Samsung's new OS Tizen 2.0 source code released

The Tizen 2.0 source code and SDK has officially been released. Tizen is a Linux-based open-source software platform backed by Intel and Samsung Electronics, that is designed for smartphones, tablets, smart TVs and in-car systems and it’s designed to run apps written using web technologies...

Cisco VPN Client Denial of Service Vulnerability

Cisco VPN Client contains a vulnerability that could allow an authenticated, local attacker to cause a denial of service DoS condition on a targeted system. The vulnerability is due to improper interaction between the VPN driver and the operating system kernel on a device running the vulnerable...

Broadcom BCM4325 and BCM4329 wireless chipset denial-of-service vulnerability

Overview Broadcom BCM4325 and BCM4329 wireless chipsets have been reported to contain an out-of-bounds read error condition that may be exploited to produce a denial-of-service condition. Description The CORE Security Technologies advisory states:"An out-of-bounds read error condition exists in...

CVE-2012-3088

Cisco AnyConnect Secure Mobility Client 3.1.x before 3.1.00495, and 3.2.x, does not check whether an HTTP request originally contains ScanSafe headers, which allows remote attackers to have an unspecified impact via a crafted request, aka Bug ID CSCua13166...

CVE-2012-3094

The VPN downloader in the downloadinstall component in Cisco AnyConnect Secure Mobility Client 3.1.x before 3.1.00495 on Linux accepts arbitrary X.509 server certificates without user interaction, which allows remote attackers to obtain sensitive information via vectors involving an invalid...

CVE-2012-3088

Cisco AnyConnect Secure Mobility Client 3.1.x (before 3.1.00495) and 3.2.x fails to verify whether an HTTP request contains ScanSafe headers, enabling remote attackers to trigger an unspecified impact via a crafted request (Bug ID CSCua13166). Affected component: AnyConnect client; root cause: la...

CVE-2012-3088

Cisco AnyConnect Secure Mobility Client 3.1.x before 3.1.00495, and 3.2.x, does not check whether an HTTP request originally contains ScanSafe headers, which allows remote attackers to have an unspecified impact via a crafted request, aka Bug ID CSCua13166...

CVE-2012-3094

The CVE-2012-3094 entry concerns Cisco AnyConnect Secure Mobility Client 3.1.x prior to 3.1.00495 on Linux, where the VPN downloader in the download_install component accepts arbitrary X.509 server certificates without user interaction. This root cause enables remote attackers to obtain sensitive...

Cisco Products ActiveX Control Multiple Vulnerabilities

Cisco ASMC/Hostscan/Secure Desktop or Cisco ActiveX controls is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Cisco AnyConnect Secure Mobility Client multiple security vulnerabilities

Code execution, protection bypass...

CVE-2012-4591

About.aspx in the Portal in McAfee Enterprise Mobility Manager EMM before 10.0 discloses the name of the user account for an IIS worker process, which allows remote attackers to obtain potentially sensitive information by visiting this page...

CVE-2012-4592

The Portal in McAfee Enterprise Mobility Manager EMM before 10.0 does not set the secure flag for the ASP.NET session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

Code injection

About.aspx in the Portal in McAfee Enterprise Mobility Manager EMM before 10.0 discloses the name of the user account for an IIS worker process, which allows remote attackers to obtain potentially sensitive information by visiting this page...

Design/Logic Flaw

Login.aspx in the Portal in McAfee Enterprise Mobility Manager EMM before 10.0 does not have an off autocomplete attribute for unspecified form fields, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation...