CVSS: 9.3EPSS: 0%CPEs: 37EXPL: 0CVE-2015-0691
https://notcve.org/view.php?id=CVE-2015-0691
A certain Cisco JAR file, as distributed in Cache Cleaner in Cisco Secure Desktop (CSD), allows remote attackers to execute arbitrary commands via a crafted web site, aka Bug ID CSCup83001. Cierto fichero Cisco JAR, distribuido en Cache Cleaner en Cisco Secure Desktop (CSD), permite a atacantes remotos ejecutar comandos arbitrarios a través de un sitio web manipulado, también conocido como Bug ID CSCup83001. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150415-csd http://www.securitytracker.com/id/1032140 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 2%CPEs: 25EXPL: 0CVE-2012-4655
https://notcve.org/view.php?id=CVE-2012-4655
The WebLaunch feature in Cisco Secure Desktop before 3.6.6020 does not properly validate binaries that are received by the downloader process, which allows remote attackers to execute arbitrary code via vectors involving (1) ActiveX or (2) Java components, aka Bug IDs CSCtz76128 and CSCtz78204. La funcionalidad WebLaunch en Cisco Secure Desktop antes de v3.6.6020 no valida adecuadamente los binarios recibidos por el proceso de descarga, lo que permite a cualquier atacante ejecutar código de su elección a través de vectores relacionados con (1) ActiveX o (2) componentes Java. El problema esta identificado con los Bug IDs CSCtz76128 y CSCtz78204. • http://secunia.com/advisories/50669 http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-ac http://www.securityfocus.com/bid/55606 https://exchange.xforce.ibmcloud.com/vulnerabilities/78677 • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 18EXPL: 0CVE-2012-2495
https://notcve.org/view.php?id=CVE-2012-2495
The HostScan downloader implementation in Cisco AnyConnect Secure Mobility Client 3.x before 3.0 MR8 and Cisco Secure Desktop before 3.6.6020 does not compare the timestamp of offered software to the timestamp of installed software, which allows remote attackers to force a version downgrade by using (1) ActiveX or (2) Java components to offer signed code that corresponds to an older software release, aka Bug ID CSCtx74235. La implementación de HostScan en Cisco AnyConnect Secure Mobility Client v3.x antes de v3.0 MR8 y Cisco Secure Desktop antes de v3.6.6020 no compara la marca de tiempo del software ofrecido con la marca de tiempo del software instalado, lo que permite forzar una rebaja de la versión a atacantes remotos mediante el uso de componentes (1) ActiveX o (2) Java para ofrecer código firmado que corresponde a una versión anterior del software. Se trata de un prblema también conocido como Bug ID CSCtx74235. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-ac • CWE-20: Improper Input Validation •
CVSS: 9.3EPSS: 4%CPEs: 1EXPL: 0CVE-2011-0925 – Cisco Secure Desktop CSDWebInstaller ActiveX Control Cleaner.cab Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2011-0925
The CSDWebInstallerCtrl ActiveX control in CSDWebInstaller.ocx in Cisco Secure Desktop (CSD) allows remote attackers to download an unintended Cisco program onto a client machine, and execute this program, by identifying a Cisco program with a Cisco digital signature and then renaming this program to inst.exe, a different vulnerability than CVE-2010-0589 and CVE-2011-0926. El control CSDWebInstallerCtrl ActiveX en CSDWebInstaller.ocx en Cisco Secure Desktop (CSD) permite a atacantes remotos descargar un programa Cisco no deseado en un equipo cliente, y ejecutar este programa, mediante la identificación de un programa Cisco con una firma digital Cisco y después renombrando este programa a inst.exe, una vulnerabilidad diferente que CVE-2010-0589 y CVE-2011-0926. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Cisco Secure Desktop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within CSDWebInstaller.ocx. The CSDWebInstallerCtrl ActiveX control allows downloading and executing any Cisco-signed executable files. • http://securityreason.com/securityalert/8108 http://www.securityfocus.com/archive/1/516648/100/0/threaded http://www.securityfocus.com/bid/46538 http://www.securitytracker.com/id?1025118 http://www.vupen.com/english/advisories/2011/0513 http://zerodayinitiative.com/advisories/ZDI-11-092 https://exchange.xforce.ibmcloud.com/vulnerabilities/65754 • CWE-20: Improper Input Validation •
CVSS: 9.3EPSS: 85%CPEs: 1EXPL: 0CVE-2011-0926 – Cisco Secure Desktop CSDWebInstaller Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2011-0926
A certain ActiveX control in CSDWebInstaller.ocx in Cisco Secure Desktop (CSD) does not properly verify the signature of an unspecified downloaded program, which allows remote attackers to execute arbitrary code by spoofing the CSD installation process, a different vulnerability than CVE-2010-0589. Un determinado control ActiveX en CSDWebInstaller.ocx en Cisco Secure Desktop (CDS) no verifica correctamente la firma de un programa descargado no especificado, permitiendo a atacantes remotos ejecutar código arbitrario por suplantación de identidad del proceso de instalación de CDS, una vulnerabilidad diferente de CVE-2010-0589. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Cisco Secure Desktop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within CSDWebInstaller.ocx ActiveX control. The vulnerable Cisco-signed ActiveX control verifies the signing authority names in the certificate chain but fails to properly verify the digital signature of an executable file that is downloaded and executed by the Cisco Secure Desktop installation process. • http://securityreason.com/securityalert/8105 http://www.securityfocus.com/archive/1/516647/100/0/threaded http://www.securityfocus.com/bid/46536 http://www.securitytracker.com/id?1025118 http://www.vupen.com/english/advisories/2011/0513 http://www.zerodayinitiative.com/advisories/ZDI-11-091 https://exchange.xforce.ibmcloud.com/vulnerabilities/65755 • CWE-20: Improper Input Validation •