cve,link,title,description,vendor,products,score,severity,epss,cisa,cisa_published,article,ransomware,exploited,exploited_date,poc,trended,trended_no_1,trended_no_1_date,published,trended_score
CVE-2021-40124,https://securityvulnerability.io/vulnerability/CVE-2021-40124,Cisco AnyConnect Secure Mobility Client for Windows with Network Access Manager Module Privilege Escalation Vulnerability,"A vulnerability in the Network Access Manager (NAM) module of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to escalate privileges on an affected device. This vulnerability is due to incorrect privilege assignment to scripts executed before user logon. An attacker could exploit this vulnerability by configuring a script to be executed before logon. A successful exploit could allow the attacker to execute arbitrary code with SYSTEM privileges.",Cisco,Cisco Anyconnect Secure Mobility Client,6.7,MEDIUM,0.0004199999966658652,false,,false,false,true,2024-08-04T03:16:55.000Z,,false,false,,2021-11-04T16:15:00.000Z,0
CVE-2021-34788,https://securityvulnerability.io/vulnerability/CVE-2021-34788,Cisco AnyConnect Secure Mobility Client for Linux and Mac OS with VPN Posture (HostScan) Module Shared Library Hijacking Vulnerability,"A vulnerability in the shared library loading mechanism of Cisco AnyConnect Secure Mobility Client for Linux and Mac OS could allow an authenticated, local attacker to perform a shared library hijacking attack on an affected device if the VPN Posture (HostScan) Module is installed on the AnyConnect client. This vulnerability is due to a race condition in the signature verification process for shared library files that are loaded on an affected device. An attacker could exploit this vulnerability by sending a series of crafted interprocess communication (IPC) messages to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected device with root privileges. To exploit this vulnerability, the attacker must have a valid account on the system.",Cisco,Cisco Anyconnect Secure Mobility Client,7,HIGH,0.0004199999966658652,false,,false,false,true,2024-08-04T02:15:24.000Z,,false,false,,2021-10-06T00:00:00.000Z,0
CVE-2021-1568,https://securityvulnerability.io/vulnerability/CVE-2021-1568,Cisco AnyConnect Secure Mobility Client for Windows Denial of Service Vulnerability,"A vulnerability in Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected system. This vulnerability is due to uncontrolled memory allocation. An attacker could exploit this vulnerability by copying a crafted file to a specific folder on the system. A successful exploit could allow the attacker to crash the VPN Agent service when the affected application is launched, causing it to be unavailable to all users of the system. To exploit this vulnerability, the attacker must have valid credentials on a multiuser Windows system.",Cisco,Cisco Anyconnect Secure Mobility Client,5.5,MEDIUM,0.0004199999966658652,false,,false,false,true,2024-08-03T17:16:02.000Z,,false,false,,2021-06-16T00:00:00.000Z,0
CVE-2021-1567,https://securityvulnerability.io/vulnerability/CVE-2021-1567,Cisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking Vulnerability,"A vulnerability in the DLL loading mechanism of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the VPN Posture (HostScan) Module is installed on the AnyConnect client. This vulnerability is due to a race condition in the signature verification process for DLL files that are loaded on an affected device. An attacker could exploit this vulnerability by sending a series of crafted interprocess communication (IPC) messages to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected device with SYSTEM privileges. To exploit this vulnerability, the attacker must have valid credentials on the Windows system.",Cisco,Cisco Anyconnect Secure Mobility Client,7,HIGH,0.0004199999966658652,false,,false,false,true,2024-08-03T17:16:01.000Z,,false,false,,2021-06-16T00:00:00.000Z,0
CVE-2021-1519,https://securityvulnerability.io/vulnerability/CVE-2021-1519,Cisco AnyConnect Secure Mobility Client Profile Modification Vulnerability,"A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client Software could allow an authenticated, local attacker to overwrite VPN profiles on an affected device. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process. A successful exploit could allow the attacker to modify VPN profile files. To exploit this vulnerability, the attacker must have valid credentials on the affected system.",Cisco,Cisco Anyconnect Secure Mobility Client,4.7,MEDIUM,0.0004199999966658652,false,,false,false,true,2024-08-03T17:15:59.000Z,,false,false,,2021-05-06T13:15:00.000Z,0
CVE-2021-1429,https://securityvulnerability.io/vulnerability/CVE-2021-1429,Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking Vulnerabilities,"Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to hijack DLL or executable files that are used by the application. A successful exploit could allow the attacker to execute arbitrary code on an affected device with SYSTEM privileges. To exploit these vulnerabilities, the attacker must have valid credentials on the Windows system. For more information about these vulnerabilities, see the Details section of this advisory.",Cisco,Cisco Anyconnect Secure Mobility Client,7,HIGH,0.0004199999966658652,false,,false,false,true,2024-08-03T17:15:55.000Z,,false,false,,2021-05-06T13:15:00.000Z,0
CVE-2021-1496,https://securityvulnerability.io/vulnerability/CVE-2021-1496,Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking Vulnerabilities,"Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to hijack DLL or executable files that are used by the application. A successful exploit could allow the attacker to execute arbitrary code on an affected device with SYSTEM privileges. To exploit these vulnerabilities, the attacker must have valid credentials on the Windows system. For more information about these vulnerabilities, see the Details section of this advisory.",Cisco,Cisco Anyconnect Secure Mobility Client,7,HIGH,0.0004199999966658652,false,,false,false,true,2024-08-03T17:15:58.000Z,,false,false,,2021-05-06T13:15:00.000Z,0
CVE-2021-1426,https://securityvulnerability.io/vulnerability/CVE-2021-1426,Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking Vulnerabilities,"Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to hijack DLL or executable files that are used by the application. A successful exploit could allow the attacker to execute arbitrary code on an affected device with SYSTEM privileges. To exploit these vulnerabilities, the attacker must have valid credentials on the Windows system. For more information about these vulnerabilities, see the Details section of this advisory.",Cisco,Cisco Anyconnect Secure Mobility Client,7,HIGH,0.0004199999966658652,false,,false,false,true,2024-08-03T17:15:55.000Z,,false,false,,2021-05-06T13:15:00.000Z,0
CVE-2021-1427,https://securityvulnerability.io/vulnerability/CVE-2021-1427,Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking Vulnerabilities,"Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to hijack DLL or executable files that are used by the application. A successful exploit could allow the attacker to execute arbitrary code on an affected device with SYSTEM privileges. To exploit these vulnerabilities, the attacker must have valid credentials on the Windows system. For more information about these vulnerabilities, see the Details section of this advisory.",Cisco,Cisco Anyconnect Secure Mobility Client,7,HIGH,0.0004199999966658652,false,,false,false,true,2024-08-03T17:15:55.000Z,,false,false,,2021-05-06T13:15:00.000Z,0
CVE-2021-1430,https://securityvulnerability.io/vulnerability/CVE-2021-1430,Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking Vulnerabilities,"Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to hijack DLL or executable files that are used by the application. A successful exploit could allow the attacker to execute arbitrary code on an affected device with SYSTEM privileges. To exploit these vulnerabilities, the attacker must have valid credentials on the Windows system. For more information about these vulnerabilities, see the Details section of this advisory.",Cisco,Cisco Anyconnect Secure Mobility Client,7,HIGH,0.0004199999966658652,false,,false,false,true,2024-08-03T17:15:55.000Z,,false,false,,2021-05-06T13:15:00.000Z,0
CVE-2021-1428,https://securityvulnerability.io/vulnerability/CVE-2021-1428,Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking Vulnerabilities,"Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to hijack DLL or executable files that are used by the application. A successful exploit could allow the attacker to execute arbitrary code on an affected device with SYSTEM privileges. To exploit these vulnerabilities, the attacker must have valid credentials on the Windows system. For more information about these vulnerabilities, see the Details section of this advisory.",Cisco,Cisco Anyconnect Secure Mobility Client,7,HIGH,0.0004199999966658652,false,,false,false,true,2024-08-03T17:15:55.000Z,,false,false,,2021-05-06T13:15:00.000Z,0
CVE-2021-1450,https://securityvulnerability.io/vulnerability/CVE-2021-1450,Cisco AnyConnect Secure Mobility Client  Denial of Service Vulnerability,"A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected device. To exploit this vulnerability, the attacker would need to have valid credentials on the device. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending one or more crafted IPC messages to the AnyConnect process on an affected device. A successful exploit could allow the attacker to stop the AnyConnect process, causing a DoS condition on the device. Note: The process under attack will automatically restart so no action is needed by the user or admin.",Cisco,Cisco Anyconnect Secure Mobility Client,5.5,MEDIUM,0.0004199999966658652,false,,false,false,true,2024-08-03T17:15:56.000Z,,false,false,,2021-02-24T00:00:00.000Z,0
CVE-2021-1366,https://securityvulnerability.io/vulnerability/CVE-2021-1366,Cisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking Vulnerability,"A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the VPN Posture (HostScan) Module is installed on the AnyConnect client. This vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker needs valid credentials on the Windows system.",Cisco,Cisco Anyconnect Secure Mobility Client,7.8,HIGH,0.0004199999966658652,false,,false,false,true,2023-09-08T09:20:20.000Z,true,false,false,,2021-02-17T00:00:00.000Z,0
CVE-2021-1237,https://securityvulnerability.io/vulnerability/CVE-2021-1237,Cisco AnyConnect Secure Mobility Client for Windows DLL Injection Vulnerability,"A vulnerability in the Network Access Manager and Web Security Agent components of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL injection attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by inserting a configuration file in a specific path in the system which, in turn, causes a malicious DLL file to be loaded when the application starts. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges.",Cisco,Cisco Anyconnect Secure Mobility Client,7.8,HIGH,0.0004199999966658652,false,,false,false,true,2024-08-03T17:15:46.000Z,,false,false,,2021-01-13T00:00:00.000Z,0
CVE-2021-1258,https://securityvulnerability.io/vulnerability/CVE-2021-1258,Cisco AnyConnect Secure Mobility Client Arbitrary File Read Vulnerability,"A vulnerability in the upgrade component of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker with low privileges to read arbitrary files on the underlying operating system (OS) of an affected device. The vulnerability is due to insufficient file permission restrictions. An attacker could exploit this vulnerability by sending a crafted command from the local CLI to the application. A successful exploit could allow the attacker to read arbitrary files on the underlying OS of the affected device. The attacker would need to have valid user credentials to exploit this vulnerability.",Cisco,Cisco Anyconnect Secure Mobility Client,5.5,MEDIUM,0.0004199999966658652,false,,false,false,true,2024-08-03T17:15:47.000Z,,false,false,,2021-01-13T00:00:00.000Z,0
CVE-2020-27123,https://securityvulnerability.io/vulnerability/CVE-2020-27123,Cisco AnyConnect Secure Mobility Client for Windows Arbitrary File Read Vulnerability,"A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to read arbitrary files on the underlying operating system of an affected device. The vulnerability is due to an exposed IPC function. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process on an affected device. A successful exploit could allow the attacker to read arbitrary files on the underlying operating system of the affected device.",Cisco,Cisco Anyconnect Secure Mobility Client,5.5,MEDIUM,0.0004199999966658652,false,,false,false,true,2024-08-04T17:20:06.000Z,,false,false,,2020-11-06T19:15:00.000Z,0
CVE-2020-3556,https://securityvulnerability.io/vulnerability/CVE-2020-3556,Cisco AnyConnect Secure Mobility Client Arbitrary Code Execution Vulnerability,"A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client Software could allow an authenticated, local attacker to cause a targeted AnyConnect user to execute a malicious script. The vulnerability is due to a lack of authentication to the IPC listener. An attacker could exploit this vulnerability by sending crafted IPC messages to the AnyConnect client IPC listener. A successful exploit could allow an attacker to cause the targeted AnyConnect user to execute a script. This script would execute with the privileges of the targeted AnyConnect user. In order to successfully exploit this vulnerability, there must be an ongoing AnyConnect session by the targeted user at the time of the attack. To exploit this vulnerability, the attacker would also need valid user credentials on the system upon which the AnyConnect client is being run. Cisco has not released software updates that address this vulnerability.",Cisco,Cisco Anyconnect Secure Mobility Client,7.3,HIGH,0.0004199999966658652,false,,false,false,true,2024-08-04T08:16:46.000Z,,false,false,,2020-11-06T19:15:00.000Z,0
CVE-2019-16007,https://securityvulnerability.io/vulnerability/CVE-2019-16007,Cisco AnyConnect Secure Mobility Client for Android Service Hijack Vulnerability,"A vulnerability in the inter-service communication of Cisco AnyConnect Secure Mobility Client for Android could allow an unauthenticated, local attacker to perform a service hijack attack on an affected device or cause a denial of service (DoS) condition. The vulnerability is due to the use of implicit service invocations. An attacker could exploit this vulnerability by persuading a user to install a malicious application. A successful exploit could allow the attacker to access confidential user information or cause a DoS condition on the AnyConnect application.",Cisco,Cisco Anyconnect Secure Mobility Client,5.9,MEDIUM,0.0006300000241026282,false,,false,false,true,2024-08-05T02:15:47.000Z,,false,false,,2020-09-23T01:15:00.000Z,0
CVE-2020-3434,https://securityvulnerability.io/vulnerability/CVE-2020-3434,Cisco AnyConnect Secure Mobility Client for Windows Denial of Service Vulnerability,"A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected device. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process on an affected device. A successful exploit could allow the attacker to stop the AnyConnect process, causing a DoS condition on the device. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system.",Cisco,Cisco Anyconnect Secure Mobility Client,5.5,MEDIUM,0.0004199999966658652,false,,false,false,true,2024-08-04T08:16:40.000Z,,false,false,,2020-08-17T18:15:00.000Z,0
CVE-2020-3435,https://securityvulnerability.io/vulnerability/CVE-2020-3435,Cisco AnyConnect Secure Mobility Client for Windows Profile Modification Vulnerability,"A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to overwrite VPN profiles on an affected device. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process on an affected device. A successful exploit could allow the attacker to modify VPN profile files. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system.",Cisco,Cisco Anyconnect Secure Mobility Client,5.5,MEDIUM,0.0004199999966658652,false,,false,false,true,2024-08-04T08:16:40.000Z,,false,false,,2020-08-17T18:15:00.000Z,0
CVE-2020-3433,https://securityvulnerability.io/vulnerability/CVE-2020-3433,Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability,"A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system.",Cisco,Cisco Anyconnect Secure Mobility Client,7.8,HIGH,0.0007800000021234155,true,2022-10-24T00:00:00.000Z,false,true,true,2020-09-25T20:53:48.000Z,true,false,false,,2020-08-17T18:15:00.000Z,0
CVE-2020-3153,https://securityvulnerability.io/vulnerability/CVE-2020-3153,Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability,"A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. An exploit could allow the attacker to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. To exploit this vulnerability, the attacker needs valid credentials on the Windows system.",Cisco,Cisco Anyconnect Secure Mobility Client,6.5,MEDIUM,0.000859999970998615,true,2022-10-24T00:00:00.000Z,false,true,true,2020-05-19T18:59:26.000Z,true,false,false,,2020-02-19T00:00:00.000Z,0
CVE-2019-1853,https://securityvulnerability.io/vulnerability/CVE-2019-1853,Cisco AnyConnect Secure Mobility Client for Linux Out-of-Bounds Memory Read Vulnerability,"A vulnerability in the HostScan component of Cisco AnyConnect Secure Mobility Client for Linux could allow an unauthenticated, remote attacker to read sensitive information on an affected system. The vulnerability exists because the affected software performs improper bounds checks. An attacker could exploit this vulnerability by crafting HTTP traffic for the affected component to download and process. A successful exploit could allow the attacker to read sensitive information on the affected system.",Cisco,Cisco Anyconnect Secure Mobility Client,4.8,MEDIUM,0.0024300001095980406,false,,false,false,true,2024-08-04T19:16:14.000Z,,false,false,,2019-05-16T02:29:00.000Z,0
CVE-2018-0373,https://securityvulnerability.io/vulnerability/CVE-2018-0373,,"A vulnerability in vpnva-6.sys for 32-bit Windows and vpnva64-6.sys for 64-bit Windows of Cisco AnyConnect Secure Mobility Client for Windows Desktop could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected system. The vulnerability is due to improper validation of user-supplied data. An attacker could exploit this vulnerability by sending a malicious request to the application. A successful exploit could allow the attacker to cause a DoS condition on the affected system. Cisco Bug IDs: CSCvj47654.",Cisco,Cisco Anyconnect Secure Mobility Client Unknown,5.5,MEDIUM,0.0004199999966658652,false,,false,false,false,,,false,false,,2018-06-21T11:00:00.000Z,0
CVE-2018-0334,https://securityvulnerability.io/vulnerability/CVE-2018-0334,,"A vulnerability in the certificate management subsystem of Cisco AnyConnect Network Access Manager and of Cisco AnyConnect Secure Mobility Client for iOS, Mac OS X, Android, Windows, and Linux could allow an unauthenticated, remote attacker to bypass the TLS certificate check when downloading certain configuration files. The vulnerability is due to improper use of Simple Certificate Enrollment Protocol and improper server certificate validation. An attacker could exploit this vulnerability by preparing malicious profile and localization files for Cisco AnyConnect to use. A successful exploit could allow the attacker to remotely change the configuration profile, a certificate, or the localization data used by AnyConnect Secure Mobility Client. Cisco Bug IDs: CSCvh23141.",Cisco,Cisco Anyconnect Secure Mobility Client Unknown,4.8,MEDIUM,0.0011699999449774623,false,,false,false,false,,,false,false,,2018-06-07T21:00:00.000Z,0