The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

Computer vulnerabilities of Cisco Adaptive Security Appliance

computer threat note CVE-2018-0296

Cisco ASA: denial of service via HTTP URL

Synthesis of the vulnerability

An attacker can generate a fatal error via HTTP URL of Cisco ASA, in order to trigger a denial of service or to read information.
Severity: 3/4.
Creation date: 07/06/2018.
Revision date: 25/06/2018.
Identifiers: CERTFR-2018-AVI-270, cisco-sa-20180606-asaftd, CSCvi16029, CVE-2018-0296, VIGILANCE-VUL-26340.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can generate a fatal error via HTTP URL of Cisco ASA, in order to trigger a denial of service or to read information.
Full Vigil@nce bulletin... (Free trial)

weakness CVE-2018-0233

Cisco ASA Firepower: denial of service via SSL Packet Reassembly

Synthesis of the vulnerability

An attacker can generate a fatal error via SSL Packet Reassembly of Cisco ASA Firepower, in order to trigger a denial of service.
Severity: 3/4.
Creation date: 20/04/2018.
Identifiers: CERTFR-2018-AVI-194, cisco-sa-20180418-fpsnort, CSCve23031, CVE-2018-0233, VIGILANCE-VUL-25935.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can generate a fatal error via SSL Packet Reassembly of Cisco ASA Firepower, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

vulnerability bulletin CVE-2018-0229

Cisco ASA, Cisco AnyConnect: privilege escalation via SAML Authentication Session Fixation

Synthesis of the vulnerability

An attacker can bypass restrictions via SAML Authentication Session Fixation of Cisco ASA and Cisco AnyConnect, in order to escalate his privileges.
Severity: 3/4.
Creation date: 19/04/2018.
Identifiers: CERTFR-2018-AVI-194, cisco-sa-20180418-asaanyconnect, CSCvg65072, CSCvh87448, CVE-2018-0229, VIGILANCE-VUL-25923.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can bypass restrictions via SAML Authentication Session Fixation of Cisco ASA and Cisco AnyConnect, in order to escalate his privileges.
Full Vigil@nce bulletin... (Free trial)

computer weakness alert CVE-2018-0240

Cisco ASA: denial of service via Application Layer Protocol Inspection

Synthesis of the vulnerability

An attacker can generate a fatal error via Application Layer Protocol Inspection of Cisco ASA, in order to trigger a denial of service.
Severity: 3/4.
Creation date: 19/04/2018.
Identifiers: CERTFR-2018-AVI-194, cisco-sa-20180418-asa_inspect, CSCve61540, CSCvh23085, CSCvh95456, CVE-2018-0240, VIGILANCE-VUL-25922.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can generate a fatal error via Application Layer Protocol Inspection of Cisco ASA, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

computer weakness bulletin CVE-2018-0231

Cisco ASA: denial of service via TLS

Synthesis of the vulnerability

An attacker can generate a fatal error via TLS of Cisco ASA, in order to trigger a denial of service.
Severity: 3/4.
Creation date: 19/04/2018.
Identifiers: CERTFR-2018-AVI-194, cisco-sa-20180418-asa3, CSCve18902, CSCve34335, CSCve38446, CVE-2018-0231, VIGILANCE-VUL-25921.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can generate a fatal error via TLS of Cisco ASA, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability bulletin CVE-2018-0228

Cisco ASA: denial of service via Flow Creation

Synthesis of the vulnerability

An attacker can generate a fatal error via Flow Creation of Cisco ASA, in order to trigger a denial of service.
Severity: 3/4.
Creation date: 19/04/2018.
Identifiers: CERTFR-2018-AVI-194, cisco-sa-20180418-asa2, CSCvf63718, CVE-2018-0228, VIGILANCE-VUL-25920.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can generate a fatal error via Flow Creation of Cisco ASA, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

vulnerability alert CVE-2018-0227

Cisco ASA: privilege escalation via VPN SSL Certificate Verification

Synthesis of the vulnerability

An attacker can bypass restrictions via VPN SSL Certificate Verification of Cisco ASA, in order to escalate his privileges.
Severity: 3/4.
Creation date: 19/04/2018.
Identifiers: CERTFR-2018-AVI-194, cisco-sa-20180418-asa1, CSCvg40155, CVE-2018-0227, VIGILANCE-VUL-25919.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can bypass restrictions via VPN SSL Certificate Verification of Cisco ASA, in order to escalate his privileges.
Full Vigil@nce bulletin... (Free trial)

cybersecurity weakness CVE-2018-0251

Cisco ASA: Cross Site Scripting via Clientless SSL VPN

Synthesis of the vulnerability

An attacker can trigger a Cross Site Scripting via Clientless SSL VPN of Cisco ASA, in order to run JavaScript code in the context of the web site.
Severity: 2/4.
Creation date: 19/04/2018.
Identifiers: CERTFR-2018-AVI-194, cisco-sa-20180418-asawvpn2, CSCvh20742, CVE-2018-0251, VIGILANCE-VUL-25915.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

The Cisco ASA product offers a web service.

However, it does not filter received data via Clientless SSL VPN before inserting them in generated HTML documents.

An attacker can therefore trigger a Cross Site Scripting via Clientless SSL VPN of Cisco ASA, in order to run JavaScript code in the context of the web site.
Full Vigil@nce bulletin... (Free trial)

cybersecurity announce CVE-2018-0242

Cisco ASA: Cross Site Scripting via WebVPN

Synthesis of the vulnerability

An attacker can trigger a Cross Site Scripting via WebVPN of Cisco ASA, in order to run JavaScript code in the context of the web site.
Severity: 2/4.
Creation date: 19/04/2018.
Identifiers: CERTFR-2018-AVI-194, cisco-sa-20180418-asawvpn, CSCvg33985, CVE-2018-0242, VIGILANCE-VUL-25914.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

The Cisco ASA product offers a web service.

However, it does not filter received data via WebVPN before inserting them in generated HTML documents.

An attacker can therefore trigger a Cross Site Scripting via WebVPN of Cisco ASA, in order to run JavaScript code in the context of the web site.
Full Vigil@nce bulletin... (Free trial)

computer weakness bulletin CVE-2018-0101

Cisco ASA: use after free via webvpn

Synthesis of the vulnerability

An attacker can force a double memory free in the TLS server of the webvpn feature of Cisco ASA, in order to trigger a denial of service, or to run machine code with root privileges.
Severity: 4/4.
Creation date: 30/01/2018.
Revisions dates: 31/01/2018, 08/02/2018, 08/02/2018.
Identifiers: CERTFR-2018-ALE-002, CERTFR-2018-AVI-063, cisco-sa-20180129-asa1, CVE-2018-0101, VIGILANCE-VUL-25173.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can force a double memory free in the TLS server of the webvpn feature of Cisco ASA, in order to trigger a denial of service, or to run machine code with root privileges.
Full Vigil@nce bulletin... (Free trial)
Our database contains other pages. You can request a free trial to read them.

Display information about Cisco Adaptive Security Appliance: