Secure Access Control Server vulnerabilities | LiveThreat CVE Feed

Product

Secure Access Control Server

by Cisco · last CVE Oct 30, 2015

CVEs

On KEV

–

Max CVSS

New 30D

Vulnerabilities34 In the news0 Timeline

Severity mix

Critical 0High 0Medium 0Low 0

Severity

All severities34 Critical0 High0 Medium0 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Secure Access Control Server to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2015-6349	–	1%	Oct 30	Cross-site scripting (XSS) vulnerability in the web interface in the Solution Engine in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote attackers to inject… Affected: 5.7.0.15
CVE-2015-6348	–	1%	Oct 30	The report-generation web interface in the Solution Engine in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote authenticated users to bypass intended RBAC… Affected: 5.7.0.15
CVE-2015-6347	–	1%	Oct 30	The Solution Engine in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote authenticated users to bypass intended RBAC restrictions, and create a dashboard or… Affected: 5.7.0.15
CVE-2015-6346	–	1%	Oct 30	Cross-site scripting (XSS) vulnerability in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote attackers to inject arbitrary web script or HTML via a crafted URL Affected: 5.7.0.15
CVE-2015-6345	–	1%	Oct 30	SQL injection vulnerability in the Solution Engine in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote authenticated users to execute arbitrary SQL commands via a… Affected: 5.7.0.15
CVE-2015-6300	–	2%	Sep 20	Cisco Secure Access Control Server (ACS) Solution Engine 5.7(0.15) allows remote authenticated users to cause a denial of service (SSH screen process crash) via crafted (1) CLI or… Affected: 5.7.0.15
CVE-2015-0746	–	1%	May 22	The REST API in Cisco Access Control Server (ACS) 5.5(0.46.2) allows remote attackers to cause a denial of service (API outage) by sending many requests, aka Bug ID CSCut62022 Affected: 5.5(0.46.2)
CVE-2015-0729	–	1%	May 16	Cross-site scripting (XSS) vulnerability in Cisco Secure Access Control Server Solution Engine (ACSE) 5.5(0.1) allows remote attackers to inject arbitrary web script or HTML via a… Affected: 5.5(0.1)
CVE-2013-3466	–	5%	Aug 29	The EAP-FAST authentication module in Cisco Secure Access Control Server (ACS) 4.x before 4.2.1.15.11, when a RADIUS server configuration is enabled, does not properly parse user… Affected: through 4.2.1.15.10; 4.2.1.15.0; 4.2.1.15.1; 4.2.1.15.2; 4.2.1.15.3; 4.2.1.15.4; +4 more
CVE-2012-5424	–	2%	Nov 7	Cisco Secure Access Control System (ACS) 5.x before 5.2 Patch 11 and 5.3 before 5.3 Patch 7, when a certain configuration involving TACACS+ and LDAP is used, does not properly… Affected: 5.0; 5.1; 5.2; 5.3
CVE-2011-3317	–	1%	May 2	Multiple cross-site scripting (XSS) vulnerabilities in the Solution Engine in Cisco Secure Access Control Server (ACS) 5.2 allow remote attackers to inject arbitrary web script or… Affected: 5.2
CVE-2011-3293	–	1%	May 2	Multiple cross-site request forgery (CSRF) vulnerabilities in the Solution Engine in Cisco Secure Access Control Server (ACS) 5.2 allow remote attackers to hijack the… Affected: 5.2
CVE-2008-2441	–	3%	Sep 4	Cisco Secure ACS 3.x before 3.3(4) Build 12 patch 7, 4.0.x, 4.1.x before 4.1(4) Build 13 Patch 11, and 4.2.x before 4.2(0) Build 124 Patch 4 does not properly handle an EAP… Affected: All versions, or not specified
CVE-2007-0105	–	11%	Jan 9	Stack-based buffer overflow in the CSAdmin service in Cisco Secure Access Control Server (ACS) for Windows before 4.1 and ACS Solution Engine before 4.1 allows remote attackers to… Affected: through 4.0.1
CVE-2006-4098	–	13%	Dec 31	Stack-based buffer overflow in the CSRadius service in Cisco Secure Access Control Server (ACS) for Windows before 4.1 and ACS Solution Engine before 4.1 allows remote attackers… Affected: 3.0; 3.1; 3.2; 3.2(1); 3.2(1.20); 3.2(2); +9 more
CVE-2006-4097	–	4%	Dec 31	Multiple unspecified vulnerabilities in the CSRadius service in Cisco Secure Access Control Server (ACS) for Windows before 4.1 and ACS Solution Engine before 4.1 allow remote… Affected: through 4.0; 4.1
CVE-2006-3226	–	2%	Jun 26	Cisco Secure Access Control Server (ACS) 4.x for Windows uses the client's IP address and the server's port number to grant access to an HTTP server port for an administration… Affected: 4.0; 4.0.1
CVE-2006-3101	–	24%	Jun 21	Cross-site scripting (XSS) vulnerability in LogonProxy.cgi in Cisco Secure ACS for UNIX 2.3 allows remote attackers to inject arbitrary web script or HTML via the (1) error, (2)… Affected: 2.3
CVE-2006-0561	–	0%	May 10	Cisco Secure Access Control Server (ACS) 3.x for Windows stores ACS administrator passwords and the master key in the registry with insecure permissions, which allows local users… Affected: 3.0; 3.0.1; 3.0.3; 3.1; 3.1.1; 3.2; +2 more
CVE-2005-4499	–	3%	Dec 22	The Downloadable RADIUS ACLs feature in Cisco PIX and VPN 3000 concentrators, when creating an ACL on the Cisco Secure Access Control Server (CS ACS), generates a random internal… Affected: 2.0; 2.1; 2.3; 2.3; 2.3.5.1; 2.3.6.1; +25 more
CVE-2005-0356	–	83%	May 31	Multiple TCP implementations with Protection Against Wrapped Sequence Numbers (PAWS) with the timestamps option enabled allow remote attackers to cause a denial of service… Affected: 2.0; 2.1; 2.3; 2.3; 2.3.5.1; 2.3.6.1; +25 more
CVE-2004-1099	–	10%	Jan 10	Cisco Secure Access Control Server for Windows (ACS Windows) and Cisco Secure Access Control Server Solution Engine (ACS Solution Engine) 3.3.1, when the EAP-TLS protocol is… Affected: 3.3(1); 3.3.1
CVE-2004-1458	–	2%	Dec 31	The CSAdmin web administration interface for Cisco Secure Access Control Server (ACS) 3.2(2) build 15 allows remote attackers to cause a denial of service (hang) via a flood of… Affected: 3.0; 3.1; 3.2; 3.2; 3.2(1); 3.2(2); +3 more
CVE-2004-1461	–	2%	Dec 31	Cisco Secure Access Control Server (ACS) 3.2(3) and earlier spawns a separate unauthenticated TCP connection on a random port when a user authenticates to the ACS GUI, which… Affected: 3.0; 3.1; 3.2; 3.2; 3.2(1); 3.2(2); +3 more
CVE-2004-1460	–	2%	Dec 31	Cisco Secure Access Control Server (ACS) 3.2(3) and earlier, when configured with an anonymous bind in Novell Directory Services (NDS) and authenticating NDS users with NDS,… Affected: 3.0; 3.1; 3.2; 3.2; 3.2(1); 3.2(2); +3 more
CVE-2003-0210	–	6%	May 12	Buffer overflow in the administration service (CSAdmin) for Cisco Secure ACS before 3.1.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code… Affected: 2.1; 2.3; 2.4; 2.5; 2.6; 2.6.2; +6 more
CVE-2002-0938	–	3%	Oct 4	Cross-site scripting vulnerability in CiscoSecure ACS 3.0 allows remote attackers to execute arbitrary script or HTML as other web users via the action argument in a link to… Affected: 3.0; 3.0.1
CVE-2002-1095	–	1%	Oct 4	Cisco VPN 3000 Concentrator before 2.5.2(F), with encryption enabled, allows remote attackers to cause a denial of service (reload) via a Windows-based PPTP client with the "No… Affected: 2.6.3
CVE-2002-0241	–	2%	May 29	NDSAuth.DLL in Cisco Secure Authentication Control Server (ACS) 3.0.1 does not check the Expired or Disabled state of users in the Novell Directory Services (NDS), which could… Affected: 3.0.1
CVE-2002-0160	–	2%	Apr 22	The administration function in Cisco Secure Access Control Server (ACS) for Windows, 2.6.x and earlier and 3.x through 3.01 (build 40), allows remote attackers to read HTML, Java… Affected: 2.6; 2.6.2; 2.6.3; 2.6.4; 3.0; 3.0.1
CVE-2002-0159	–	5%	Apr 22	Format string vulnerability in the administration function in Cisco Secure Access Control Server (ACS) for Windows, 2.6.x and earlier and 3.x through 3.01 (build 40), allows… Affected: 2.6; 2.6.2; 2.6.3; 2.6.4; 3.0; 3.0.1
CVE-2000-1055	–	4%	Dec 11	Buffer overflow in CiscoSecure ACS Server 2.4(2) and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a large TACACS+… Affected: 2.1; 2.3(3); 2.4(2)
CVE-2000-1056	–	2%	Dec 11	CiscoSecure ACS Server 2.4(2) and earlier allows remote attackers to bypass LDAP authentication on the server if the LDAP server allows null passwords Affected: 2.1; 2.3(3); 2.4(2)
CVE-2000-1054	–	8%	Dec 11	Buffer overflow in CSAdmin module in CiscoSecure ACS Server 2.4(2) and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a… Affected: 2.1; 2.3(3); 2.4(2)