CVE-2015-0665

CVE-2015-0665 affects Cisco AnyConnect Secure Mobility Client via the Hostscan IPC path traversal. A local authenticated attacker can exploit crafted IPC commands to write or overwrite arbitrary files. Affected: 4.0(.00051) and earlier Hostscan IPC handling (path traversal vulnerability). Impact:...

CVE-2015-0665

The Hostscan module in Cisco AnyConnect Secure Mobility Client 4.0.00051 and earlier allows local users to write to arbitrary files via crafted IPC messages, aka Bug ID CSCus79173...

PT-2015-4792

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client version 4.0.00051 and earlier Description The issue allows local users to write to arbitrary files via crafted IPC messages. Recommendations For Cisco AnyConnect Secure Mobility Client version 4.0.00051...

CVE-2015-0665: Improper Limitation of a Pathname to a Restricted Directory

The Hostscan module in Cisco AnyConnect Secure Mobility Client 4.0.00051 and earlier allows local users to write to arbitrary files via crafted IPC messages, aka Bug ID CSCus79173...

CVE-2015-0663: Undefined Security Weakness

Cisco AnyConnect Secure Mobility Client 4.0.00051 and earlier does not properly implement access control for IPC messages, which allows local users to write to arbitrary files via crafted messages, aka Bug ID CSCus79392...

CVE-2015-0662: Undefined Security Weakness

Cisco AnyConnect Secure Mobility Client 4.0.00051 and earlier allows local users to gain privileges via crafted IPC messages that trigger use of root privileges for a software-package installation, aka Bug ID CSCus79385...

PT-2015-4790

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client version 4.0.00051 and earlier Description The issue is related to improper implementation of access control for IPC messages, allowing local users to write to arbitrary files via crafted messages...

PT-2015-4789

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client version 4.0.00051 and earlier Description The issue allows local users to gain privileges via crafted IPC messages, triggering the use of root privileges for software-package installation. Recommendation...

CVE-2014-8021

CVE-2014-8021 is an XSS vulnerability in Cisco AnyConnect Secure Mobility Client <= 3.1.x and Cisco HostScan Engine

PT-2015-3986

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client version 3.1.02043 and earlier Cisco HostScan Engine version 3.1.05183 and earlier Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via vectors...

CVE-2014-8021: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Cisco AnyConnect Secure Mobility Client 3.1.02043 and earlier and Cisco HostScan Engine 3.1.05183 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving an applet-path URL, aka Bug IDs CSCup82990 and CSCuq80149...

Mac OS X : Cisco AnyConnect Secure Mobility Client < 3.1(6042) Host Validation Vulnerability

The remote Mac OS X host has a version of Cisco AnyConnect Secure Mobility Client prior to 3.16042. It is, therefore, affected by a vulnerability due to insufficient validation of the type of host which the client is connecting to. An attacker, by tricking users to connect to a malicious host, ca...

Buffer overflow

Buffer overflow in the Active Template Library ATL framework in the VPNAPI COM module in Cisco AnyConnect Secure Mobility Client 2.x allows user-assisted remote attackers to execute arbitrary code via a crafted HTML document, aka Bug ID CSCuj58139...

CVE-2013-5559: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the Active Template Library ATL framework in the VPNAPI COM module in Cisco AnyConnect Secure Mobility Client 2.x allows user-assisted remote attackers to execute arbitrary code via a crafted HTML document, aka Bug ID CSCuj58139...

PT-2013-5639

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client versions 2.x Description The issue is related to a buffer overflow in the Active Template Library ATL framework within the VPNAPI COM module. This allows remote attackers to execute arbitrary code when a...

CVE-2013-1130

Cisco AnyConnect Secure Mobility Client on macOS is affected by weak permissions in a library directory (root cause: misconfigured library directory permissions), enabling local privilege escalation via a crafted library file (Bug ID CSCue33619). No patch/version details are provided in the suppl...

PT-2013-2900

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client affected versions not specified Description The issue is related to weak permissions for a library directory in Cisco AnyConnect Secure Mobility Client on Mac OS X, allowing local users to gain privilege...

CVE-2013-1130: Undefined Security Weakness

Cisco AnyConnect Secure Mobility Client on Mac OS X uses weak permissions for a library directory, which allows local users to gain privileges via a crafted library file, aka Bug ID CSCue33619...

CVE-2013-1173

CVE-2013-1173 is a heap-based buffer overflow in ciscod.exe within the Cisco Security Service of Cisco AnyConnect Secure Mobility Client. Exploitation enables local privilege escalation to SYSTEM. Affected: Cisco AnyConnect Secure Mobility Client (Host Scan component) with vulnerable host-scan ha...

CVE-2013-1172

CVE-2013-1172 affects Cisco AnyConnect Secure Mobility Client (VPN Client) via the Host Scan component. The issue arises from how the Cisco Security Service/Host Scan handles messages for file manipulation, failing to verify files properly. This root cause enables a local, unprivileged user with ...