Session fixation

Session fixation vulnerability in Cisco Secure Access Control System ACS allows remote attackers to hijack web sessions via unspecified vectors, aka Bug ID CSCud95787...

CVE-2013-1200

Cisco Secure Access Control System (ACS) is affected by a session fixation vulnerability tied to the lack of session identifier regeneration. An unauthenticated, remote attacker could hijack another user’s web session by capturing or reusing an existing session ID. The issue is documented as CVE-...

CVE-2013-1200

Session fixation vulnerability in Cisco Secure Access Control System ACS allows remote attackers to hijack web sessions via unspecified vectors, aka Bug ID CSCud95787...

CVE-2013-1200: Improper Authentication

Session fixation vulnerability in Cisco Secure Access Control System ACS allows remote attackers to hijack web sessions via unspecified vectors, aka Bug ID CSCud95787...

PT-2013-2967

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control System ACS affected versions not specified Description A session fixation issue allows remote attackers to hijack web sessions. The exact vectors used for the attack are not specified. Recommendations At the moment,...

CVE-2013-1196

The command-line interface in Cisco Secure Access Control System ACS, Identity Services Engine Software, Context Directory Agent, Application Networking Manager ANM, Prime Network Control System, Prime LAN Management Solution LMS, Prime Collaboration, Unified Provisioning Manager, Network Service...

PT-2013-2963

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control System ACS affected versions not specified Cisco Identity Services Engine Software affected versions not specified Cisco Context Directory Agent affected versions not specified Cisco Application Networking Manager A...

CVE-2013-1196: Improper Input Validation

The command-line interface in Cisco Secure Access Control System ACS, Identity Services Engine Software, Context Directory Agent, Application Networking Manager ANM, Prime Network Control System, Prime LAN Management Solution LMS, Prime Collaboration, Unified Provisioning Manager, Network Service...

PT-2013-2897

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine Software affected versions not specified Cisco Secure Access Control System ACS affected versions not specified Cisco Application Networking Manager ANM affected versions not specified Cisco Prime LAN Management...

CVE-2012-5424

Cisco Secure Access Control System ACS 5.x before 5.2 Patch 11 and 5.3 before 5.3 Patch 7, when a certain configuration involving TACACS+ and LDAP is used, does not properly validate passwords, which allows remote attackers to bypass authentication by sending a valid username and a crafted passwo...

CVE-2012-5424

CVE-2012-5424 affects Cisco Secure Access Control System (ACS) 5.x prior to 5.2 Patch 11 and 5.3 prior to 5.3 Patch 7. When configured with LDAP as external identity store and TACACS+ for authentication, the system fails to properly validate the user-supplied password, enabling an unauthenticated...

PT-2012-5974

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control System ACS versions 5.x before 5.2 Patch 11 Cisco Secure Access Control System ACS versions 5.3 before 5.3 Patch 7 Description The issue allows remote attackers to bypass authentication by sending a valid username a...

CVE-2012-5424: Improper Input Validation

Cisco Secure Access Control System ACS 5.x before 5.2 Patch 11 and 5.3 before 5.3 Patch 7, when a certain configuration involving TACACS+ and LDAP is used, does not properly validate passwords, which allows remote attackers to bypass authentication by sending a valid username and a crafted passwo...

CVE-2011-0951

The web-based management interface in Cisco Secure Access Control System ACS 5.1 before 5.1.0.44.6 and 5.2 before 5.2.0.26.3 allows remote attackers to change arbitrary user passwords via unspecified vectors, aka Bug ID CSCtl77440...

Design/Logic Flaw

The web-based management interface in Cisco Secure Access Control System ACS 5.1 before 5.1.0.44.6 and 5.2 before 5.2.0.26.3 allows remote attackers to change arbitrary user passwords via unspecified vectors, aka Bug ID CSCtl77440...

CVE-2011-0951

CVE-2011-0951 affects Cisco Secure Access Control System (ACS) 5.1 (with patches 3/4/5) and 5.2 (no patches or patches 1–2). The web-based management interface contains an authentication/authorization flaw that lets a remote, unauthenticated attacker change arbitrary user passwords via unspecifie...

CVE-2011-0951: Undefined Security Weakness

The web-based management interface in Cisco Secure Access Control System ACS 5.1 before 5.1.0.44.6 and 5.2 before 5.2.0.26.3 allows remote attackers to change arbitrary user passwords via unspecified vectors, aka Bug ID CSCtl77440...

PT-2011-2776

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control System ACS versions 5.1 before 5.1.0.44.6 Cisco Secure Access Control System ACS versions 5.2 before 5.2.0.26.3 Description The web-based management interface in Cisco Secure Access Control System ACS allows remote...

Cisco Secure Access Control System privilege escalation

It's possible to reset any user's password...

Cisco Secure Access Control System Password Modification Vulnerability

Cisco Secure Access Control System ACS contains a vulnerability that could allow an unauthenticated, remote attacker to modify user passwords. The vulnerability is due to improper security restrictions on user password change functions in the web-based management interface of the Cisco Secure ACS...