Lucene search

K
CiscoSecure Access Control Server

34 matches found

CVE
CVE
added 2006/06/21 1:2 a.m.137 views

CVE-2006-3101

Cross-site scripting (XSS) vulnerability in LogonProxy.cgi in Cisco Secure ACS for UNIX 2.3 allows remote attackers to inject arbitrary web script or HTML via the (1) error, (2) SSL, and (3) Ok parameters.

4.3CVSS5.7AI score0.25627EPSS
CVE
CVE
added 2005/05/31 4:0 a.m.114 views

CVE-2005-0356

Multiple TCP implementations with Protection Against Wrapped Sequence Numbers (PAWS) with the timestamps option enabled allow remote attackers to cause a denial of service (connection loss) via a spoofed packet with a large timer value, which causes the host to discard later packets because they ap...

5CVSS6.2AI score0.86024EPSS
CVE
CVE
added 2005/12/22 11:3 a.m.59 views

CVE-2005-4499

The Downloadable RADIUS ACLs feature in Cisco PIX and VPN 3000 concentrators, when creating an ACL on the Cisco Secure Access Control Server (CS ACS), generates a random internal name for an ACL that is also used as a hidden user name and password, which allows remote attackers to gain privileges b...

7.5CVSS7.4AI score0.01897EPSS
CVE
CVE
added 2015/05/16 2:59 p.m.50 views

CVE-2015-0729

Cross-site scripting (XSS) vulnerability in Cisco Secure Access Control Server Solution Engine (ACSE) 5.5(0.1) allows remote attackers to inject arbitrary web script or HTML via a file-inclusion attack, aka Bug ID CSCuu11005.

4.3CVSS5.8AI score0.00263EPSS
CVE
CVE
added 2001/01/22 5:0 a.m.48 views

CVE-2000-1055

Buffer overflow in CiscoSecure ACS Server 2.4(2) and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a large TACACS+ packet.

10CVSS8.2AI score0.01521EPSS
CVE
CVE
added 2001/01/22 5:0 a.m.48 views

CVE-2000-1056

CiscoSecure ACS Server 2.4(2) and earlier allows remote attackers to bypass LDAP authentication on the server if the LDAP server allows null passwords.

7.5CVSS7.4AI score0.00515EPSS
CVE
CVE
added 2002/06/25 4:0 a.m.44 views

CVE-2002-0160

The administration function in Cisco Secure Access Control Server (ACS) for Windows, 2.6.x and earlier and 3.x through 3.01 (build 40), allows remote attackers to read HTML, Java class, and image files outside the web root via a .... (modified ..) in the URL to port 2002.

5CVSS6.6AI score0.00558EPSS
CVE
CVE
added 2005/02/13 5:0 a.m.44 views

CVE-2004-1460

Cisco Secure Access Control Server (ACS) 3.2(3) and earlier, when configured with an anonymous bind in Novell Directory Services (NDS) and authenticating NDS users with NDS, allows remote attackers to gain unauthorized access to AAA clients via a blank password.

7.5CVSS6.8AI score0.00717EPSS
CVE
CVE
added 2015/09/20 2:59 p.m.44 views

CVE-2015-6300

Cisco Secure Access Control Server (ACS) Solution Engine 5.7(0.15) allows remote authenticated users to cause a denial of service (SSH screen process crash) via crafted (1) CLI or (2) GUI commands, aka Bug ID CSCuw24694.

4CVSS6.5AI score0.00388EPSS
CVE
CVE
added 2008/09/04 4:41 p.m.43 views

CVE-2008-2441

Cisco Secure ACS 3.x before 3.3(4) Build 12 patch 7, 4.0.x, 4.1.x before 4.1(4) Build 13 Patch 11, and 4.2.x before 4.2(0) Build 124 Patch 4 does not properly handle an EAP Response packet in which the value of the length field exceeds the actual packet length, which allows remote authenticated use...

7.5CVSS7.4AI score0.03198EPSS
CVE
CVE
added 2012/11/07 11:55 p.m.41 views

CVE-2012-5424

Cisco Secure Access Control System (ACS) 5.x before 5.2 Patch 11 and 5.3 before 5.3 Patch 7, when a certain configuration involving TACACS+ and LDAP is used, does not properly validate passwords, which allows remote attackers to bypass authentication by sending a valid username and a crafted passwo...

5CVSS7.2AI score0.00219EPSS
CVE
CVE
added 2015/10/30 10:59 a.m.41 views

CVE-2015-6346

Cross-site scripting (XSS) vulnerability in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

4.3CVSS5.7AI score0.00263EPSS
CVE
CVE
added 2013/08/29 12:7 p.m.40 views

CVE-2013-3466

The EAP-FAST authentication module in Cisco Secure Access Control Server (ACS) 4.x before 4.2.1.15.11, when a RADIUS server configuration is enabled, does not properly parse user identities, which allows remote attackers to execute arbitrary commands via crafted EAP-FAST packets, aka Bug ID CSCui57...

9.3CVSS8AI score0.00722EPSS
CVE
CVE
added 2001/01/22 5:0 a.m.39 views

CVE-2000-1054

Buffer overflow in CSAdmin module in CiscoSecure ACS Server 2.4(2) and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a large packet.

10CVSS8.2AI score0.07131EPSS
CVE
CVE
added 2007/01/09 12:28 a.m.39 views

CVE-2007-0105

Stack-based buffer overflow in the CSAdmin service in Cisco Secure Access Control Server (ACS) for Windows before 4.1 and ACS Solution Engine before 4.1 allows remote attackers to execute arbitrary code via a crafted HTTP GET request.

7.5CVSS8AI score0.01869EPSS
CVE
CVE
added 2015/10/30 10:59 a.m.39 views

CVE-2015-6345

SQL injection vulnerability in the Solution Engine in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCuw24700.

6.5CVSS8AI score0.00311EPSS
CVE
CVE
added 2015/10/30 10:59 a.m.39 views

CVE-2015-6348

The report-generation web interface in the Solution Engine in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote authenticated users to bypass intended RBAC restrictions, and read report or status information, by visiting an unspecified web page.

4CVSS6.4AI score0.00156EPSS
CVE
CVE
added 2005/02/13 5:0 a.m.38 views

CVE-2004-1458

The CSAdmin web administration interface for Cisco Secure Access Control Server (ACS) 3.2(2) build 15 allows remote attackers to cause a denial of service (hang) via a flood of TCP connections to port 2002.

5CVSS6.7AI score0.01122EPSS
CVE
CVE
added 2007/01/08 11:0 p.m.38 views

CVE-2006-4098

Stack-based buffer overflow in the CSRadius service in Cisco Secure Access Control Server (ACS) for Windows before 4.1 and ACS Solution Engine before 4.1 allows remote attackers to execute arbitrary code via a crafted RADIUS Accounting-Request packet.

10CVSS8AI score0.13864EPSS
CVE
CVE
added 2002/06/25 4:0 a.m.37 views

CVE-2002-0159

Format string vulnerability in the administration function in Cisco Secure Access Control Server (ACS) for Windows, 2.6.x and earlier and 3.x through 3.01 (build 40), allows remote attackers to crash the CSADMIN module only (denial of service of administration function) or execute arbitrary code vi...

7.5CVSS7.7AI score0.02343EPSS
CVE
CVE
added 2005/01/10 5:0 a.m.37 views

CVE-2004-1099

Cisco Secure Access Control Server for Windows (ACS Windows) and Cisco Secure Access Control Server Solution Engine (ACS Solution Engine) 3.3.1, when the EAP-TLS protocol is enabled, does not properly handle expired or untrusted certificates, which allows remote attackers to bypass authentication a...

10CVSS7.1AI score0.1073EPSS
CVE
CVE
added 2006/06/26 4:5 p.m.37 views

CVE-2006-3226

Cisco Secure Access Control Server (ACS) 4.x for Windows uses the client's IP address and the server's port number to grant access to an HTTP server port for an administration session, which allows remote attackers to bypass authentication via various methods, aka "ACS Weak Session Management Vulne...

7.5CVSS7.4AI score0.01898EPSS
CVE
CVE
added 2005/02/13 5:0 a.m.36 views

CVE-2004-1461

Cisco Secure Access Control Server (ACS) 3.2(3) and earlier spawns a separate unauthenticated TCP connection on a random port when a user authenticates to the ACS GUI, which allows remote attackers to bypass authentication by connecting to that port from the same IP address.

7.5CVSS7AI score0.00624EPSS
CVE
CVE
added 2003/04/02 5:0 a.m.35 views

CVE-2002-0241

NDSAuth.DLL in Cisco Secure Authentication Control Server (ACS) 3.0.1 does not check the Expired or Disabled state of users in the Novell Directory Services (NDS), which could allow those users to authenticate to the server.

7.5CVSS6.5AI score0.00189EPSS
CVE
CVE
added 2003/04/02 5:0 a.m.34 views

CVE-2002-0938

Cross-site scripting vulnerability in CiscoSecure ACS 3.0 allows remote attackers to execute arbitrary script or HTML as other web users via the action argument in a link to setup.exe.

7.5CVSS7.1AI score0.03109EPSS
CVE
CVE
added 2004/09/01 4:0 a.m.34 views

CVE-2002-1095

Cisco VPN 3000 Concentrator before 2.5.2(F), with encryption enabled, allows remote attackers to cause a denial of service (reload) via a Windows-based PPTP client with the "No Encryption" option set.

5CVSS6.6AI score0.00398EPSS
CVE
CVE
added 2007/01/08 11:0 p.m.34 views

CVE-2006-4097

Multiple unspecified vulnerabilities in the CSRadius service in Cisco Secure Access Control Server (ACS) for Windows before 4.1 and ACS Solution Engine before 4.1 allow remote attackers to cause a denial of service (crash) via a crafted RADIUS Access-Request packet. NOTE: it has been reported that ...

7.8CVSS7.3AI score0.01756EPSS
CVE
CVE
added 2012/05/02 10:9 a.m.34 views

CVE-2011-3293

Multiple cross-site request forgery (CSRF) vulnerabilities in the Solution Engine in Cisco Secure Access Control Server (ACS) 5.2 allow remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting (XSS) sequences, aka Bug ID CSCtr78143.

6.8CVSS6.6AI score0.00126EPSS
CVE
CVE
added 2012/05/02 10:9 a.m.34 views

CVE-2011-3317

Multiple cross-site scripting (XSS) vulnerabilities in the Solution Engine in Cisco Secure Access Control Server (ACS) 5.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCtr78192.

4.3CVSS5.8AI score0.00254EPSS
CVE
CVE
added 2015/05/22 12:59 a.m.34 views

CVE-2015-0746

The REST API in Cisco Access Control Server (ACS) 5.5(0.46.2) allows remote attackers to cause a denial of service (API outage) by sending many requests, aka Bug ID CSCut62022.

5CVSS6.8AI score0.00474EPSS
CVE
CVE
added 2015/10/30 10:59 a.m.34 views

CVE-2015-6347

The Solution Engine in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote authenticated users to bypass intended RBAC restrictions, and create a dashboard or portlet, by visiting an unspecified web page.

4CVSS6.4AI score0.00135EPSS
CVE
CVE
added 2015/10/30 10:59 a.m.34 views

CVE-2015-6349

Cross-site scripting (XSS) vulnerability in the web interface in the Solution Engine in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

4.3CVSS5.7AI score0.00263EPSS
CVE
CVE
added 2006/05/10 2:14 a.m.31 views

CVE-2006-0561

Cisco Secure Access Control Server (ACS) 3.x for Windows stores ACS administrator passwords and the master key in the registry with insecure permissions, which allows local users and remote administrators to decrypt the passwords by using Microsoft's cryptographic API functions to obtain the plaint...

7.2CVSS6.4AI score0.00049EPSS
CVE
CVE
added 2003/05/12 4:0 a.m.30 views

CVE-2003-0210

Buffer overflow in the administration service (CSAdmin) for Cisco Secure ACS before 3.1.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long user parameter to port 2002.

7.5CVSS7.9AI score0.02296EPSS