3 results (0.003 seconds)

CVSS: 9.3EPSS: 0%CPEs: 37EXPL: 0

CVE-2015-0691

https://notcve.org/view.php?id=CVE-2015-0691

A certain Cisco JAR file, as distributed in Cache Cleaner in Cisco Secure Desktop (CSD), allows remote attackers to execute arbitrary commands via a crafted web site, aka Bug ID CSCup83001. Cierto fichero Cisco JAR, distribuido en Cache Cleaner en Cisco Secure Desktop (CSD), permite a atacantes remotos ejecutar comandos arbitrarios a través de un sitio web manipulado, también conocido como Bug ID CSCup83001. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150415-csd http://www.securitytracker.com/id/1032140 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 9.3EPSS: 2%CPEs: 25EXPL: 0

CVE-2012-4655

https://notcve.org/view.php?id=CVE-2012-4655

The WebLaunch feature in Cisco Secure Desktop before 3.6.6020 does not properly validate binaries that are received by the downloader process, which allows remote attackers to execute arbitrary code via vectors involving (1) ActiveX or (2) Java components, aka Bug IDs CSCtz76128 and CSCtz78204. La funcionalidad WebLaunch en Cisco Secure Desktop antes de v3.6.6020 no valida adecuadamente los binarios recibidos por el proceso de descarga, lo que permite a cualquier atacante ejecutar código de su elección a través de vectores relacionados con (1) ActiveX o (2) componentes Java. El problema esta identificado con los Bug IDs CSCtz76128 y CSCtz78204. • http://secunia.com/advisories/50669 http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-ac http://www.securityfocus.com/bid/55606 https://exchange.xforce.ibmcloud.com/vulnerabilities/78677 • CWE-20: Improper Input Validation •

CVSS: 4.3EPSS: 0%CPEs: 18EXPL: 0

CVE-2012-2495

https://notcve.org/view.php?id=CVE-2012-2495

The HostScan downloader implementation in Cisco AnyConnect Secure Mobility Client 3.x before 3.0 MR8 and Cisco Secure Desktop before 3.6.6020 does not compare the timestamp of offered software to the timestamp of installed software, which allows remote attackers to force a version downgrade by using (1) ActiveX or (2) Java components to offer signed code that corresponds to an older software release, aka Bug ID CSCtx74235. La implementación de HostScan en Cisco AnyConnect Secure Mobility Client v3.x antes de v3.0 MR8 y Cisco Secure Desktop antes de v3.6.6020 no compara la marca de tiempo del software ofrecido con la marca de tiempo del software instalado, lo que permite forzar una rebaja de la versión a atacantes remotos mediante el uso de componentes (1) ActiveX o (2) Java para ofrecer código firmado que corresponde a una versión anterior del software. Se trata de un prblema también conocido como Bug ID CSCtx74235. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-ac • CWE-20: Improper Input Validation •