Cisco
Cisco Secure Access Control System: vulnerabilidades y CVE
Cisco Secure Access Control System tiene 35 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 2 son críticas y 1 figuran en el catálogo de explotación activa de CISA.
CVE35
Últimos 12 meses0
Críticas2
Explotadas activamente1
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
🔴 Explotadas activamente (CISA KEV)
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2018-0147 | Crítica (9.8) | 18% | ⚠ Explotación activa | 8 mar 2018 | A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device.… |
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2018-0253 | Crítica (9.8) | 6.8% | — | 2 may 2018 | A vulnerability in the ACS Report component of Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected system. Commands executed by the… |
| CVE-2018-0147 | Crítica (9.8) | 18% | ⚠ Explotación activa | 8 mar 2018 | A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device.… |
| CVE-2017-12354 | Media (5.3) | 2.2% | — | 30 nov 2017 | A vulnerability in the web-based interface of Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to view sensitive information on an affected system. The vulnerability exists… |
| CVE-2017-6769 | Media (5.4) | 0.89% | — | 7 ago 2017 | A vulnerability in the web-based management interface of the Cisco Secure Access Control System (ACS) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of… |
| CVE-2017-3841 | Alta (7.5) | 2.4% | — | 22 feb 2017 | A vulnerability in the web interface of the Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to disclose sensitive information. More Information: CSCvc04854. Known Affected… |
| CVE-2017-3840 | Media (6.1) | 1.5% | — | 22 feb 2017 | A vulnerability in the web interface of the Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to redirect a user to a malicious web page, aka an Open Redirect Vulnerability. More… |
| CVE-2017-3839 | Media (4.3) | 1.6% | — | 22 feb 2017 | An XML External Entity vulnerability in the web-based user interface of the Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to have read access to part of the information stored… |
| CVE-2017-3838 | Media (6.1) | 1.5% | — | 22 feb 2017 | A vulnerability in Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to conduct a DOM-based cross-site scripting (XSS) attack against the user of the web interface of the affected… |
| CVE-2015-4219 | Media (4) | 2.1% | — | 24 jun 2015 | Cisco Secure Access Control System before 5.4(0.46.2) and 5.5 before 5.5(0.46) and Cisco Identity Services Engine 1.0(4.573) do not properly implement access control for support bundles, which allows remote… |
| CVE-2015-0728 | Media (4.3) | 1.5% | — | 15 may 2015 | Cross-site scripting (XSS) vulnerability in Cisco Access Control Server (ACS) 5.5(0.1) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuu11002. |
| CVE-2014-2130 | Media (6.5) | 4.0% | — | 6 mar 2015 | Cisco Secure Access Control Server (ACS) provides an unintentional administration web interface based on Apache Tomcat, which allows remote authenticated users to modify application files and configuration files, and… |
| CVE-2015-0580 | Media (6.5) | 0.92% | — | 12 feb 2015 | Multiple SQL injection vulnerabilities in the ACS View reporting interface pages in Cisco Secure Access Control System (ACS) before 5.5 patch 7 allow remote authenticated administrators to execute arbitrary SQL commands… |
| CVE-2014-8029 | Media (5.8) | 1.2% | — | 9 ene 2015 | Open redirect vulnerability in the web interface in Cisco Secure Access Control System (ACS) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter,… |
| CVE-2014-8028 | Media (4.3) | 1.2% | — | 9 ene 2015 | Multiple cross-site scripting (XSS) vulnerabilities in the web framework in Cisco Secure Access Control System (ACS) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID… |
| CVE-2014-8027 | Media (6.5) | 1.6% | — | 9 ene 2015 | The RBAC component in Cisco Secure Access Control System (ACS) allows remote authenticated users to obtain Network Device Administrator privileges for Create, Delete, Read, and Update operations via crafted HTTP… |
| CVE-2014-0678 | Media (5.5) | 1.4% | — | 25 ene 2014 | The portal interface in Cisco Secure Access Control System (ACS) does not properly manage sessions, which allows remote authenticated users to hijack sessions and gain privileges via unspecified vectors, aka Bug ID… |
| CVE-2014-0668 | Media (4.3) | 1.5% | — | 20 ene 2014 | Cross-site scripting (XSS) vulnerability in the portal in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCue65949. |
| CVE-2014-0667 | Media (6.3) | 1.4% | — | 16 ene 2014 | The RMI interface in Cisco Secure Access Control System (ACS) does not properly enforce authorization requirements, which allows remote authenticated users to read arbitrary files via a request to this interface, aka… |
| CVE-2014-0650 | Alta (10) | 3.4% | — | 16 ene 2014 | The web interface in Cisco Secure Access Control System (ACS) 5.x before 5.4 Patch 3 allows remote attackers to execute arbitrary operating-system commands via a request to this interface, aka Bug ID CSCue65962. |
| CVE-2014-0649 | Alta (9) | 2.6% | — | 16 ene 2014 | The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authorization requirements, which allows remote authenticated users to obtain superadmin access via a request to… |
| CVE-2014-0648 | Alta (10) | 5.9% | — | 16 ene 2014 | The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authentication and authorization requirements, which allows remote attackers to obtain administrative access via a… |
| CVE-2014-0663 | Media (4.3) | 1.5% | — | 10 ene 2014 | Cross-site scripting (XSS) vulnerability in the web framework in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID… |
| CVE-2013-6974 | Media (4.3) | 1.4% | — | 10 ene 2014 | Cross-site scripting (XSS) vulnerability in the web interface in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID… |
| CVE-2013-6695 | Media (4) | 0.95% | — | 2 dic 2013 | The RBAC implementation in Cisco Secure Access Control System (ACS) does not properly verify privileges for support-bundle downloads, which allows remote authenticated users to obtain sensitive information via a… |
| CVE-2013-5536 | Media (5) | 1.5% | — | 24 oct 2013 | Cisco Secure Access Control System (ACS) does not properly implement an incoming-packet firewall rule, which allows remote attackers to cause a denial of service (process crash) via a flood of crafted packets, aka Bug… |
| CVE-2013-5470 | Media (5) | 1.9% | — | 4 sept 2013 | Cisco Secure Access Control System (ACS) does not properly handle requests to read from the TACACS+ socket, which allows remote attackers to cause a denial of service (process crash) via malformed TCP packets, aka Bug… |
| CVE-2013-3428 | Media (4) | 0.95% | — | 15 jul 2013 | The web interface in Cisco Secure Access Control System (ACS) does not properly suppress error-condition details, which allows remote authenticated users to obtain sensitive information via an unspecified request that… |
| CVE-2013-3424 | Media (6.8) | 1.2% | — | 12 jul 2013 | Cross-site request forgery (CSRF) vulnerability in Administration and View pages in Cisco Secure Access Control System (ACS) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCud75177. |
| CVE-2013-3423 | Media (4.3) | 0.93% | — | 12 jul 2013 | Cross-site scripting (XSS) vulnerability in the web interface in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an unspecified field, aka Bug ID CSCud75174. |
| CVE-2013-3422 | Media (4.3) | 0.93% | — | 12 jul 2013 | Cross-site scripting (XSS) vulnerability in Administration pages in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.