9.3

CVE-2012-4655

The WebLaunch feature in Cisco Secure Desktop before 3.6.6020 does not properly validate binaries that are received by the downloader process, which allows remote attackers to execute arbitrary code via vectors involving (1) ActiveX or (2) Java components, aka Bug IDs CSCtz76128 and CSCtz78204.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Secure Desktop Version 3.1
Cisco ≫ Secure Desktop Version 3.1.1
Cisco ≫ Secure Desktop Version 3.1.1.27
Cisco ≫ Secure Desktop Version 3.1.1.33
Cisco ≫ Secure Desktop Version 3.1.1.45
Cisco ≫ Secure Desktop Version 3.2
Cisco ≫ Secure Desktop Version 3.2.1
Cisco ≫ Secure Desktop Version 3.3
Cisco ≫ Secure Desktop Version 3.4
Cisco ≫ Secure Desktop Version 3.4.1
Cisco ≫ Secure Desktop Version 3.4.2
Cisco ≫ Secure Desktop Version 3.4.2048
Cisco ≫ Secure Desktop Version 3.5
Cisco ≫ Secure Desktop Version 3.5.841
Cisco ≫ Secure Desktop Version 3.5.1077
Cisco ≫ Secure Desktop Version 3.5.2001
Cisco ≫ Secure Desktop Version 3.5.2008
Cisco ≫ Secure Desktop Version 3.6
Cisco ≫ Secure Desktop Version 3.6.181
Cisco ≫ Secure Desktop Version 3.6.185
Cisco ≫ Secure Desktop Version 3.6.1001
Cisco ≫ Secure Desktop Version 3.6.2002
Cisco ≫ Secure Desktop Version 3.6.3002
Cisco ≫ Secure Desktop Version 3.6.4021
Cisco ≫ Secure Desktop Version 3.6.5005
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.64% 0.905
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-ac
Vendor Advisory
http://secunia.com/advisories/50669
http://www.securityfocus.com/bid/55606
https://exchange.xforce.ibmcloud.com/vulnerabilities/78677