CVE-2013-3466

Cisco Secure ACS (Windows) 4.x (including 4.0–4.2.1.15) is affected when configured as a RADIUS server. The EAP-FAST authentication module fails to properly parse user identities, allowing remote attackers to send crafted EAP-FAST packets to execute arbitrary commands on the ACS host. The vulnera...

CVE-2013-3466

The EAP-FAST authentication module in Cisco Secure Access Control Server ACS 4.x before 4.2.1.15.11, when a RADIUS server configuration is enabled, does not properly parse user identities, which allows remote attackers to execute arbitrary commands via crafted EAP-FAST packets, aka Bug ID...

PT-2013-4416

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control Server ACS versions 4.x before 4.2.1.15.11 Description The issue concerns the EAP-FAST authentication module, which does not properly parse user identities when a RADIUS server configuration is enabled. This allows...

Cisco Releases Security Advisory

Cisco has released a security advisory to address a vulnerability in Cisco Secure Access Control Server ACS versions 4.0 through 4.2.1.15. This vulnerability could allow an unauthenticated, remote attacker to execute arbitrary commands. The vulnerability is only present when Cisco ACS is configur...

CVE-2013-3466: Improper Authentication

The EAP-FAST authentication module in Cisco Secure Access Control Server ACS 4.x before 4.2.1.15.11, when a RADIUS server configuration is enabled, does not properly parse user identities, which allows remote attackers to execute arbitrary commands via crafted EAP-FAST packets, aka Bug ID...

CVE-2012-5460

Cross-site scripting XSS vulnerability in the help page in Juniper Secure Access SA with IVE OS before 7.1r13, 7.2.x before 7.2r7, and 7.3.x before 7.3r2 allows remote attackers to inject arbitrary web script or HTML via the WWHSearchWordsText parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in the help page in Juniper Secure Access SA with IVE OS before 7.1r13, 7.2.x before 7.2r7, and 7.3.x before 7.3r2 allows remote attackers to inject arbitrary web script or HTML via the WWHSearchWordsText parameter...

CVE-2012-5460

Cross-site scripting XSS vulnerability in the help page in Juniper Secure Access SA with IVE OS before 7.1r13, 7.2.x before 7.2r7, and 7.3.x before 7.3r2 allows remote attackers to inject arbitrary web script or HTML via the WWHSearchWordsText parameter...

CVE-2012-5460

CVE-2012-5460 is a documented XSS in Juniper Secure Access (IVE OS) on the help page, exploitable via the WWHSearchWordsText parameter. Affected versions are IVE OS before 7.1r13, 7.2.x before 7.2r7, and 7.3.x before 7.3r2. The vulnerability can allow an attacker to inject arbitrary web script/HT...

PT-2013-1799

Name of the Vulnerable Software and Affected Versions Juniper Secure Access SA with IVE OS versions prior to 7.1r13 Juniper Secure Access SA with IVE OS versions 7.2.x prior to 7.2r7 Juniper Secure Access SA with IVE OS versions 7.3.x prior to 7.3r2 Description A cross-site scripting XSS issue...

CVE-2012-5460: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the help page in Juniper Secure Access SA with IVE OS before 7.1r13, 7.2.x before 7.2r7, and 7.3.x before 7.3r2 allows remote attackers to inject arbitrary web script or HTML via the WWHSearchWordsText parameter...

Cisco Secure Access Control System TACACS+ Authentication Bypass (cisco-sa-20121107-acs)

The version of Cisco Secure Access Control ACS running on the remote host has an authentication bypass vulnerability. When the system is configured with an LDAP external identity store and TACACS+ is the authentication protocol, the user-supplied password is not properly validated. A remote...

Cisco Secure Access Control System Version

The remote host is running Cisco Secure Access Control System ACS, an access control management and appliance system. It is possible to get the ACS version number via SSH. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid69133; scriptversion"1.5";...

Cisco Secure ACS EAP Parsing Vulnerability (cisco-sr-20080903-csacs)

The version of Cisco Secure Access Control System ACS running on the remote host has a memory corruption vulnerability. The length of EAP-Response packets is not properly parsed. Remote code execution could be possible, but has not been confirmed. A remote, unauthenticated attacker could exploit...

Juniper Secure Access crossite scripting

Crossite scripting in SSLVPN...

Juniper Secure Access XSS Vulnerability

------------------------------------------------------------------------------- | Juniper Secure Access XSS Vulnerability| -------------------------------------------------------------------------------- Summary =============== Juniper Secure Access software has reflected XSS vulnerability CVE...

CVE-2013-3428

The web interface in Cisco Secure Access Control System ACS does not properly suppress error-condition details, which allows remote authenticated users to obtain sensitive information via an unspecified request that triggers an error, aka Bug ID CSCue65957...

CVE-2013-3428

CVE-2013-3428 affects Cisco Secure Access Control System (ACS). The web interface does not properly suppress error-condition details due to insufficient filtering of error output, allowing remote authenticated users to obtain sensitive information via an error-triggering request (Bug ID CSCue6595...

CVE-2013-3428: Exposure of Sensitive Information to an Unauthorized Actor

The web interface in Cisco Secure Access Control System ACS does not properly suppress error-condition details, which allows remote authenticated users to obtain sensitive information via an unspecified request that triggers an error, aka Bug ID CSCue65957...

PT-2013-4384

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control System ACS affected versions not specified Description The issue concerns the web interface in Cisco Secure Access Control System ACS, which fails to properly suppress error-condition details. This allows remote...