PT-2014-3773

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control System ACS affected versions not specified Description The issue concerns the portal interface in Cisco Secure Access Control System ACS that does not properly manage sessions. This allows remote authenticated users...

CVE-2014-0678: Undefined Security Weakness

The portal interface in Cisco Secure Access Control System ACS does not properly manage sessions, which allows remote authenticated users to hijack sessions and gain privileges via unspecified vectors, aka Bug ID CSCue65951...

Cross site scripting

Cross-site scripting XSS vulnerability in the portal in Cisco Secure Access Control System ACS allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCue65949...

CVE-2014-0668

Cisco Secure ACS Portal suffers a cross-site scripting (XSS) vulnerability due to insufficient input validation of a parameter in the ACS portal. This could allow a remote attacker to inject arbitrary script or HTML when a user visits a malicious link. Cisco’s advisory Cisco-SA-20140121-CVE-2014-...

CVE-2014-0668: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the portal in Cisco Secure Access Control System ACS allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCue65949...

PT-2014-3763

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control System ACS affected versions not specified Description A cross-site scripting XSS issue in the portal of Cisco Secure Access Control System ACS allows remote attackers to inject arbitrary web script or HTML via an...

CVE-2014-0650

The web interface in Cisco Secure Access Control System ACS 5.x before 5.4 Patch 3 allows remote attackers to execute arbitrary operating-system commands via a request to this interface, aka Bug ID CSCue65962...

Design/Logic Flaw

The web interface in Cisco Secure Access Control System ACS 5.x before 5.4 Patch 3 allows remote attackers to execute arbitrary operating-system commands via a request to this interface, aka Bug ID CSCue65962...

Authorization

The RMI interface in Cisco Secure Access Control System ACS 5.x before 5.5 does not properly enforce authentication and authorization requirements, which allows remote attackers to obtain administrative access via a request to this interface, aka Bug ID CSCud75187...

Cisco Secure ACS RMI Arbitrary File Read Vulnerability

A vulnerability in the Remote Method Invocation RMI interface of the Cisco Secure Access Control System ACS could allow an authenticated, remote attacker to read arbitrary files on the Cisco Secure ACS server. The vulnerability is due to insufficient authorization enforcement. An attacker could...

CVE-2014-0648

The RMI interface in Cisco Secure Access Control System ACS 5.x before 5.5 does not properly enforce authentication and authorization requirements, which allows remote attackers to obtain administrative access via a request to this interface, aka Bug ID CSCud75187...

CVE-2014-0649

The CVE-2014-0649 issue affects Cisco Secure Access Control System (ACS) 5.x before 5.5, where the RMI interface does not properly enforce authorization, enabling a remote authenticated user to gain superadmin access via the RMI interface (Bug ID CSCud75180). Connected Cisco advisories confirm an...

CVE-2014-0667

The RMI interface in Cisco Secure Access Control System ACS does not properly enforce authorization requirements, which allows remote authenticated users to read arbitrary files via a request to this interface, aka Bug ID CSCud75169...

CVE-2014-0667

Cisco Secure Access Control System (ACS) is affected by CVE-2014-0667 due to insufficient authorization enforcement in the Remote Method Invocation (RMI) interface. A remote, authenticated attacker can read arbitrary files on the ACS server by issuing a crafted request to the RMI interface. The i...

CVE-2014-0648

Cisco Secure ACS is affected by CVE-2014-0648 via the RMI interface, where improper authentication/authorization could let remote attackers obtain administrative access through RMI endpoints (ports 2020/2030). The related Cisco advisory (cisco-sa-20140115-csacs) also documents additional RMI-rela...

CVE-2014-0650

CVE-2014-0650 affects Cisco Secure Access Control System (ACS) 5.x up to, but not including, 5.4 Patch 3. The issue is in the web interface input validation that could allow a remote attacker to inject operating-system commands via a request to the web interface. The vulnerability is part of a se...

CVE-2014-0648: Undefined Security Weakness

The RMI interface in Cisco Secure Access Control System ACS 5.x before 5.5 does not properly enforce authentication and authorization requirements, which allows remote attackers to obtain administrative access via a request to this interface, aka Bug ID CSCud75187...

PT-2014-3762

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control System ACS affected versions not specified Description The issue concerns the RMI interface in Cisco Secure Access Control System ACS, which fails to properly enforce authorization requirements. This allows remote...

CVE-2014-0650: Improper Input Validation

The web interface in Cisco Secure Access Control System ACS 5.x before 5.4 Patch 3 allows remote attackers to execute arbitrary operating-system commands via a request to this interface, aka Bug ID CSCue65962...

PT-2014-3743

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control System ACS versions 5.x before 5.5 Description The issue concerns the RMI interface, which does not properly enforce authentication and authorization requirements. This allows remote attackers to obtain administrati...