Cisco Secure Desktop vulnerabilities

13 CVEs affecting Cisco Secure Desktop, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2015-0691, published 2015-04-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2011-0926, published 2011-02-25. High severity, CVSS 9.3. EPSS: 6.8% chance of exploitation in the next 30 days. A certain ActiveX control in CSDWebInstaller.ocx in Cisco Secure Desktop (CSD) does not properly verify the signature of an unspecified downloaded program, which allows remote attackers to execute…
CVE-2010-0589, published 2010-04-15. High severity, CVSS 9.3. EPSS: 4.8% chance of exploitation in the next 30 days. The Web Install ActiveX control (CSDWebInstaller) in Cisco Secure Desktop (CSD) before 3.5.841 does not properly verify the signatures of downloaded programs, which allows remote attackers to force…
CVE-2010-0440, published 2010-02-03. Medium severity, CVSS 4.3. EPSS: 4.7% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in +CSCOT+/translation in Cisco Secure Desktop 3.4.2048, and other versions before 3.5; as used in Cisco ASA appliance before 8.2(1), 8.1(2.7), and 8.0(5);…
CVE-2012-4655, published 2012-09-24. High severity, CVSS 9.3. EPSS: 4.6% chance of exploitation in the next 30 days. The WebLaunch feature in Cisco Secure Desktop before 3.6.6020 does not properly validate binaries that are received by the downloader process, which allows remote attackers to execute arbitrary code…
CVE-2011-0925, published 2011-02-28. High severity, CVSS 9.3. EPSS: 3.3% chance of exploitation in the next 30 days. The CSDWebInstallerCtrl ActiveX control in CSDWebInstaller.ocx in Cisco Secure Desktop (CSD) allows remote attackers to download an unintended Cisco program onto a client machine, and execute this…
CVE-2015-0691, published 2015-04-17. High severity, CVSS 9.3. EPSS: 3.1% chance of exploitation in the next 30 days. A certain Cisco JAR file, as distributed in Cache Cleaner in Cisco Secure Desktop (CSD), allows remote attackers to execute arbitrary commands via a crafted web site, aka Bug ID CSCup83001.
CVE-2012-2495, published 2012-06-20. Medium severity, CVSS 4.3. EPSS: 1.4% chance of exploitation in the next 30 days. The HostScan downloader implementation in Cisco AnyConnect Secure Mobility Client 3.x before 3.0 MR8 and Cisco Secure Desktop before 3.6.6020 does not compare the timestamp of offered software to the…
CVE-2006-5808, published 2006-11-08. Medium severity, CVSS 4.6. EPSS: 0.4% chance of exploitation in the next 30 days. The installation of Cisco Secure Desktop (CSD) before 3.1.1.45 uses insecure default permissions (all users full control) for the CSD directory and its parent directory, which allow local users to…
CVE-2009-5008, published 2010-10-14. Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days. Cisco Secure Desktop (CSD), when used in conjunction with an AnyConnect SSL VPN server, does not properly perform verification, which allows local users to bypass intended policy restrictions via a…
CVE-2006-5806, published 2006-11-08. Low severity, CVSS 2.1. EPSS: 0.3% chance of exploitation in the next 30 days. SSL VPN Client in Cisco Secure Desktop before 3.1.1.45, when configured to spawn a web browser after a successful connection, stores sensitive browser session information in a directory outside of…

Latest

CVE-2006-5807, published 2006-11-08. Medium severity, CVSS 4.6. EPSS: 0.3% chance of exploitation in the next 30 days. Cisco Secure Desktop (CSD) before 3.1.1.45 allows local users to escape out of the secure desktop environment by using certain applications that switch to the default desktop, aka "System Policy…