CVE-2014-0678

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The portal interface in Cisco Secure Access Control System (ACS) does not properly manage sessions, which allows remote authenticated users to hijack sessions and gain privileges via unspecified vectors, aka Bug ID CSCue65951.

Metrics

CVSS 2.0 5.5/10AV:N/AC:L/Au:S/C:P/I:P/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/102558
http://secunia.com/advisories/56540
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0678Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=32567Vendor Advisory
http://www.securityfocus.com/bid/65144Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1029688Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/90732
http://osvdb.org/102558
http://secunia.com/advisories/56540
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0678Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=32567Vendor Advisory
http://www.securityfocus.com/bid/65144Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1029688Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/90732

Timeline

Published: Jan 25, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-06799.0Cisco Prime Infrastructure 1.2 and 1.3 before 1.3.0.20-2, 1.4 before 1.4.0.45-2, and 2.0 before 2.0.0.0.294-2 allows remote authenticated us CVE-2014-06804.3Cross-site scripting (XSS) vulnerability in the HTTP control interface in the NAC Web Agent component in Cisco Identity Services Engine (ISE CVE-2014-06814.3Cross-site scripting (XSS) vulnerability in Cisco Identity Services Engine (ISE) 1.2 patch 2 and earlier allows remote attackers to inject a CVE-2014-06824.9Cisco WebEx Meetings Server allows remote authenticated users to bypass authorization checks and (1) join arbitrary meetings, or (2) termina CVE-2014-068310.0The web management interface on the Cisco RV110W firewall with firmware 1.2.0.9 and earlier, RV215W router with firmware 1.1.0.5 and earlier CVE-2014-06844.6Cisco NX-OS 6.2(2) on Nexus 7000 switches allows local users to cause a denial of service via crafted sed input, aka Bug ID CSCui56136.CVE-2014-06855.0Cisco Nexus 1000V InterCloud 5.2(1)IC1(1.2) and earlier for VMware allows remote attackers to bypass ACL deny statements via crafted (1) IGM CVE-2014-06866.0Cisco Unified Communications Manager (aka Unified CM) 9.1 (2.10000.28) and earlier allows local users to gain privileges by leveraging incor CVE-2014-06917.3Cisco WebEx Meetings Server before 1.1 uses meeting IDs with insufficient entropy, which makes it easier for remote attackers to bypass auth CVE-2014-06945.0Intelligent Automation for Cloud (IAC) in Cisco Cloud Portal 9.4.1 and earlier includes a cryptographic key in binary files, which makes it CVE-2014-07017.8Cisco Wireless LAN Controller (WLC) devices 7.0 before 7.0.250.0, 7.2, 7.3, and 7.4 before 7.4.110.0 do not properly deallocate memory, whic CVE-2014-070310.0Cisco Wireless LAN Controller (WLC) devices 7.4 before 7.4.110.0 distribute Aironet IOS software with a race condition in the status of the