SA
Product
Secure Access Control System
On CISA KEVExploited in the wild
35
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 1Medium 5Low 0
Watch
Add Secure Access Control System to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-0147 In wildKEV | 9.8 | Mar 8 | Cisco Secure Access Control System Java Deserialization Vulnerability Affected: 5.2(0.3) |
| CVE-2018-0253 | 9.8 | May 2 | A vulnerability in the ACS Report component of Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to execute arbitrary commands on an… Affected: before 5.8; 5.8; 5.8; 5.8; 5.8; 5.8; +2 more |
| CVE-2017-3841 | 7.5 | Feb 22 | A vulnerability in the web interface of the Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to disclose sensitive information Affected: 5.8(2.5) |
| CVE-2017-3840 | 6.1 | Feb 22 | A vulnerability in the web interface of the Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to redirect a user to a malicious web page,… Affected: 5.8(2.5) |
| CVE-2017-3838 | 6.1 | Feb 22 | A vulnerability in Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to conduct a DOM-based cross-site scripting (XSS) attack against the… Affected: 5.8(2.5) |
| CVE-2017-6769 | 5.4 | Aug 7 | A vulnerability in the web-based management interface of the Cisco Secure Access Control System (ACS) could allow an authenticated, remote attacker to conduct a stored cross-site… Affected: 5.8(0.8); 5.8(1.5) |
| CVE-2017-12354 | 5.3 | Nov 30 | A vulnerability in the web-based interface of Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to view sensitive information on an affected… Affected: 5.8(0.32) |
| CVE-2017-3839 | 4.3 | Feb 22 | An XML External Entity vulnerability in the web-based user interface of the Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to have read… Affected: 5.8(2.5) |
| CVE-2015-4219 | – | Jun 24 | Cisco Secure Access Control System before 5.4(0.46.2) and 5.5 before 5.5(0.46) and Cisco Identity Services Engine 1.0(4.573) do not properly implement access control for support… Affected: through 5.4.0.46.1; 5.3.0.40.5 |
| CVE-2015-0728 | – | May 15 | Cross-site scripting (XSS) vulnerability in Cisco Access Control Server (ACS) 5.5(0.1) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID… Affected: 5.5(0.1) |
| CVE-2014-2130 | – | Mar 6 | Cisco Secure Access Control Server (ACS) provides an unintentional administration web interface based on Apache Tomcat, which allows remote authenticated users to modify… Affected: All versions, or not specified |
| CVE-2015-0580 | – | Feb 12 | Multiple SQL injection vulnerabilities in the ACS View reporting interface pages in Cisco Secure Access Control System (ACS) before 5.5 patch 7 allow remote authenticated… Affected: through 5.5.0.46 |
| CVE-2014-8029 | – | Jan 9 | Open redirect vulnerability in the web interface in Cisco Secure Access Control System (ACS) allows remote attackers to redirect users to arbitrary web sites and conduct phishing… Affected: All versions, or not specified |
| CVE-2014-8028 | – | Jan 9 | Multiple cross-site scripting (XSS) vulnerabilities in the web framework in Cisco Secure Access Control System (ACS) allow remote attackers to inject arbitrary web script or HTML… Affected: All versions, or not specified |
| CVE-2014-8027 | – | Jan 9 | The RBAC component in Cisco Secure Access Control System (ACS) allows remote authenticated users to obtain Network Device Administrator privileges for Create, Delete, Read, and… Affected: All versions, or not specified |
| CVE-2014-0678 | – | Jan 25 | The portal interface in Cisco Secure Access Control System (ACS) does not properly manage sessions, which allows remote authenticated users to hijack sessions and gain privileges… Affected: All versions, or not specified |
| CVE-2014-0668 | – | Jan 20 | Cross-site scripting (XSS) vulnerability in the portal in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an… Affected: All versions, or not specified |
| CVE-2014-0667 | – | Jan 16 | The RMI interface in Cisco Secure Access Control System (ACS) does not properly enforce authorization requirements, which allows remote authenticated users to read arbitrary files… Affected: All versions, or not specified |
| CVE-2014-0650 | – | Jan 16 | The web interface in Cisco Secure Access Control System (ACS) 5.x before 5.4 Patch 3 allows remote attackers to execute arbitrary operating-system commands via a request to this… Affected: through 5.4.0.46.2; 5.1; 5.1.0.44; 5.1.0.44.1; 5.1.0.44.2; 5.1.0.44.3; +16 more |
| CVE-2014-0649 | – | Jan 16 | The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authorization requirements, which allows remote authenticated users to… Affected: through 5.4.0.46.6; 5.1; 5.1.0.44; 5.1.0.44.1; 5.1.0.44.2; 5.1.0.44.3; +20 more |
| CVE-2014-0648 | – | Jan 16 | The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authentication and authorization requirements, which allows remote attackers… Affected: through 5.4.0.46.6; 5.1; 5.1.0.44; 5.1.0.44.1; 5.1.0.44.2; 5.1.0.44.3; +20 more |
| CVE-2014-0663 | – | Jan 10 | Cross-site scripting (XSS) vulnerability in the web framework in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an… Affected: All versions, or not specified |
| CVE-2013-6974 | – | Jan 10 | Cross-site scripting (XSS) vulnerability in the web interface in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an… Affected: All versions, or not specified |
| CVE-2013-6695 | – | Dec 2 | The RBAC implementation in Cisco Secure Access Control System (ACS) does not properly verify privileges for support-bundle downloads, which allows remote authenticated users to… Affected: All versions, or not specified |
| CVE-2013-5536 | – | Oct 24 | Cisco Secure Access Control System (ACS) does not properly implement an incoming-packet firewall rule, which allows remote attackers to cause a denial of service (process crash)… Affected: All versions, or not specified |
| CVE-2013-5470 | – | Sep 4 | Cisco Secure Access Control System (ACS) does not properly handle requests to read from the TACACS+ socket, which allows remote attackers to cause a denial of service (process… Affected: All versions, or not specified |
| CVE-2013-3428 | – | Jul 15 | The web interface in Cisco Secure Access Control System (ACS) does not properly suppress error-condition details, which allows remote authenticated users to obtain sensitive… Affected: All versions, or not specified |
| CVE-2013-3424 | – | Jul 12 | Cross-site request forgery (CSRF) vulnerability in Administration and View pages in Cisco Secure Access Control System (ACS) allows remote attackers to hijack the authentication… Affected: All versions, or not specified |
| CVE-2013-3423 | – | Jul 12 | Cross-site scripting (XSS) vulnerability in the web interface in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an… Affected: All versions, or not specified |
| CVE-2013-3422 | – | Jul 12 | Cross-site scripting (XSS) vulnerability in Administration pages in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an… Affected: All versions, or not specified |
| CVE-2013-3421 | – | Jul 12 | Cross-site scripting (XSS) vulnerability in the Help index page in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an… Affected: All versions, or not specified |
| CVE-2013-1200 | – | May 16 | Session fixation vulnerability in Cisco Secure Access Control System (ACS) allows remote attackers to hijack web sessions via unspecified vectors, aka Bug ID CSCud95787 Affected: All versions, or not specified |
| CVE-2013-1196 | – | Apr 29 | The command-line interface in Cisco Secure Access Control System (ACS), Identity Services Engine Software, Context Directory Agent, Application Networking Manager (ANM), Prime… Affected: All versions, or not specified |
| CVE-2013-1125 | – | Feb 19 | The command-line interface in Cisco Identity Services Engine Software, Secure Access Control System (ACS), Application Networking Manager (ANM), Prime LAN Management Solution… Affected: All versions, or not specified |
| CVE-2011-0951 | – | Apr 1 | The web-based management interface in Cisco Secure Access Control System (ACS) 5.1 before 5.1.0.44.6 and 5.2 before 5.2.0.26.3 allows remote attackers to change arbitrary user… Affected: 5.1; 5.1.0.44; 5.1.0.44.1; 5.1.0.44.2; 5.1.0.44.3; 5.1.0.44.4; +5 more |
Showing 35