Cisco Releases Security Advisory for Cisco Secure Access Control Systems (ACS)

Cisco Secure Access Control Systems ACS contains a vulnerability that could allow an unauthenticated, remote attacker to bypass the TACACS+ based authentication service offered by the product. Cisco has released software updates that address this vulnerability. US-CERT encourages users and...

CVE-2012-5424

Cisco Secure Access Control System ACS 5.x before 5.2 Patch 11 and 5.3 before 5.3 Patch 7, when a certain configuration involving TACACS+ and LDAP is used, does not properly validate passwords, which allows remote attackers to bypass authentication by sending a valid username and a crafted passwo...

CVE-2012-5424

CVE-2012-5424 affects Cisco Secure Access Control System (ACS) 5.x prior to 5.2 Patch 11 and 5.3 prior to 5.3 Patch 7. When configured with LDAP as external identity store and TACACS+ for authentication, the system fails to properly validate the user-supplied password, enabling an unauthenticated...

PT-2012-5974

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control System ACS versions 5.x before 5.2 Patch 11 Cisco Secure Access Control System ACS versions 5.3 before 5.3 Patch 7 Description The issue allows remote attackers to bypass authentication by sending a valid username a...

CVE-2012-5424: Improper Input Validation

Cisco Secure Access Control System ACS 5.x before 5.2 Patch 11 and 5.3 before 5.3 Patch 7, when a certain configuration involving TACACS+ and LDAP is used, does not properly validate passwords, which allows remote attackers to bypass authentication by sending a valid username and a crafted passwo...

CVE-2011-3293

Multiple cross-site request forgery CSRF vulnerabilities in the Solution Engine in Cisco Secure Access Control Server ACS 5.2 allow remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting XSS sequences, aka Bug ID CSCtr78143...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Solution Engine in Cisco Secure Access Control Server ACS 5.2 allow remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting XSS sequences, aka Bug ID CSCtr78143...

CVE-2011-3293

Multiple cross-site request forgery CSRF vulnerabilities in the Solution Engine in Cisco Secure Access Control Server ACS 5.2 allow remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting XSS sequences, aka Bug ID CSCtr78143...

CVE-2011-3317: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Solution Engine in Cisco Secure Access Control Server ACS 5.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCtr78192...

PT-2012-1684

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control Server ACS version 5.2 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities in the Solution Engine. These vulnerabilities allow remote attackers to hijack the authentication of...

CVE-2011-3293: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Solution Engine in Cisco Secure Access Control Server ACS 5.2 allow remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting XSS sequences, aka Bug ID CSCtr78143...

PT-2012-1687

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control Server ACS version 5.2 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the Solution Engine of Cisco Secure Access Control Server ACS. These vulnerabilities allow remote attackers ...

CVE-2011-3008

The default configuration of Avaya Secure Access Link SAL Gateway 1.5, 1.8, and 2.0 contains certain domain names in the Secondary Core Server URL and Secondary Remote Server URL fields, which allows remote attackers to obtain sensitive information by leveraging administrative access to these...

Default configuration

The default configuration of Avaya Secure Access Link SAL Gateway 1.5, 1.8, and 2.0 contains certain domain names in the Secondary Core Server URL and Secondary Remote Server URL fields, which allows remote attackers to obtain sensitive information by leveraging administrative access to these...

CVE-2011-3008

The default configuration of Avaya Secure Access Link SAL Gateway 1.5, 1.8, and 2.0 contains certain domain names in the Secondary Core Server URL and Secondary Remote Server URL fields, which allows remote attackers to obtain sensitive information by leveraging administrative access to these...

CVE-2011-3008

CVE-2011-3008 affects Avaya Secure Access Link (SAL) Gateway versions 1.5, 1.8, and 2.0. The default configuration places certain domain names in the Secondary Core Server URL and Secondary Remote Server URL fields, enabling remote attackers with administrative access to these domain names to obt...

CVE-2011-3008: Undefined Security Weakness

The default configuration of Avaya Secure Access Link SAL Gateway 1.5, 1.8, and 2.0 contains certain domain names in the Secondary Core Server URL and Secondary Remote Server URL fields, which allows remote attackers to obtain sensitive information by leveraging administrative access to these...

PT-2011-4246

Name of the Vulnerable Software and Affected Versions Avaya Secure Access Link SAL Gateway versions 1.5, 1.8, and 2.0 Description The default configuration of the Avaya Secure Access Link SAL Gateway contains certain domain names in the Secondary Core Server URL and Secondary Remote Server URL...

[SECURITY] Fedora 13 Update: cyrus-imapd-2.3.16-5.fc13

The cyrus-imapd package contains the core of the Cyrus IMAP server. It is a scaleable enterprise mail system designed for use from small to large enterprise environments using standards-based internet mail technologies. A full Cyrus IMAP implementation allows a seamless mail and bulletin board...

[SECURITY] Fedora 14 Update: cyrus-imapd-2.3.16-8.fc14

The cyrus-imapd package contains the core of the Cyrus IMAP server. It is a scaleable enterprise mail system designed for use from small to large enterprise environments using standards-based internet mail technologies. A full Cyrus IMAP implementation allows a seamless mail and bulletin board...