CVSS: 9.8EPSS: 0%CPEs: 37EXPL: 0CVE-2015-0691
https://notcve.org/view.php?id=CVE-2015-0691
17 Apr 2015 — A certain Cisco JAR file, as distributed in Cache Cleaner in Cisco Secure Desktop (CSD), allows remote attackers to execute arbitrary commands via a crafted web site, aka Bug ID CSCup83001. Cierto fichero Cisco JAR, distribuido en Cache Cleaner en Cisco Secure Desktop (CSD), permite a atacantes remotos ejecutar comandos arbitrarios a través de un sitio web manipulado, también conocido como Bug ID CSCup83001. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150415-csd • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 2%CPEs: 25EXPL: 0CVE-2012-4655
https://notcve.org/view.php?id=CVE-2012-4655
24 Sep 2012 — The WebLaunch feature in Cisco Secure Desktop before 3.6.6020 does not properly validate binaries that are received by the downloader process, which allows remote attackers to execute arbitrary code via vectors involving (1) ActiveX or (2) Java components, aka Bug IDs CSCtz76128 and CSCtz78204. La funcionalidad WebLaunch en Cisco Secure Desktop antes de v3.6.6020 no valida adecuadamente los binarios recibidos por el proceso de descarga, lo que permite a cualquier atacante ejecutar código de su elección a tr... • http://secunia.com/advisories/50669 • CWE-20: Improper Input Validation •
CVSS: 9.1EPSS: 0%CPEs: 18EXPL: 0CVE-2012-2495
https://notcve.org/view.php?id=CVE-2012-2495
20 Jun 2012 — The HostScan downloader implementation in Cisco AnyConnect Secure Mobility Client 3.x before 3.0 MR8 and Cisco Secure Desktop before 3.6.6020 does not compare the timestamp of offered software to the timestamp of installed software, which allows remote attackers to force a version downgrade by using (1) ActiveX or (2) Java components to offer signed code that corresponds to an older software release, aka Bug ID CSCtx74235. La implementación de HostScan en Cisco AnyConnect Secure Mobility Client v3.x antes d... • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-ac • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 1%CPEs: 12EXPL: 0CVE-2010-0589 – Cisco Secure Desktop CSDWebInstaller ActiveX Control Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-0589
14 Apr 2010 — The Web Install ActiveX control (CSDWebInstaller) in Cisco Secure Desktop (CSD) before 3.5.841 does not properly verify the signatures of downloaded programs, which allows remote attackers to force the download and execution of arbitrary files via a crafted web page, aka Bug ID CSCta25876. El control ActiveX Web Install ActiveX en Cisco Secure Desktop (CSD) anterior a v3.5.841, no verifica adecuadamente las firmas de los programas descargados, lo que permite a atacantes remotos forzar las descargas y ejecuc... • http://securitytracker.com/id?1023881 • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 35%CPEs: 5EXPL: 3CVE-2010-0440 – Cisco Secure Desktop 3.x - 'translation' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2010-0440
03 Feb 2010 — Cross-site scripting (XSS) vulnerability in +CSCOT+/translation in Cisco Secure Desktop 3.4.2048, and other versions before 3.5; as used in Cisco ASA appliance before 8.2(1), 8.1(2.7), and 8.0(5); allows remote attackers to inject arbitrary web script or HTML via a crafted POST parameter, which is not properly handled by an eval statement in binary/mainv.js that writes to start.html. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en +CSCOT+/translation en Cisco Secure Desktop v3.4.2048, y... • https://www.exploit-db.com/exploits/33567 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2006-5808
https://notcve.org/view.php?id=CVE-2006-5808
08 Nov 2006 — The installation of Cisco Secure Desktop (CSD) before 3.1.1.45 uses insecure default permissions (all users full control) for the CSD directory and its parent directory, which allow local users to gain privileges by replacing CSD executables, aka "Local Privilege Escalation". La instalación del Cisco Secure Desktop (CSD) en versiones anteriores a la 3.1.1.45 utiliza permisos inseguros por defecto (todos los usuarios control total) para el directorio CSD y su directorio padre, que permite a usuarios locales ... • http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=442 •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2006-5806
https://notcve.org/view.php?id=CVE-2006-5806
08 Nov 2006 — SSL VPN Client in Cisco Secure Desktop before 3.1.1.45, when configured to spawn a web browser after a successful connection, stores sensitive browser session information in a directory outside of the CSD vault and does not restrict the user from saving files outside of the vault, which is not cleared after the VPN connection terminates and allows local users to read unencrypted data. El SSL VPN Client del Cisco Secure Desktop en versiones anteriores a la 3.1.1.45, cuando se está creando la configuración de... • http://secunia.com/advisories/22747 •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2006-5807
https://notcve.org/view.php?id=CVE-2006-5807
08 Nov 2006 — Cisco Secure Desktop (CSD) before 3.1.1.45 allows local users to escape out of the secure desktop environment by using certain applications that switch to the default desktop, aka "System Policy Evasion". Cisco Secure Desktop (CSD) en versiones anteriores a la 3.1.1.45 permite a usuarios locales salirse del escritorio seguro mediante el uso de ciertas aplicaciones que permiten el intercambio entre dicho escritorio y el escritorio por defecto, también conocido como "System Policy Evasion". • http://secunia.com/advisories/22747 •