CVE-2023-20057

A vulnerability in the URL filtering mechanism of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. This vulnerability is due to improper processing of URLs. An attacker could...

PT-2025-9693 · Cisco · Cisco Asyncos +1

Name of the Vulnerable Software and Affected Versions: Cisco Content Security Management Appliance SMA affected versions not specified Description: A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Content Security Management Appliance SMA could allow an...

The vulnerability of the Cisco AsyncOS operating system in the Cisco Email Security Appliance (ESA) security system allows a perpetrator to trigger a service failure.

The vulnerability of the Cisco AsyncOS operating system in the Cisco Email Security Appliance ESA security system is related to errors in the certificate validation process. Exploiting this vulnerability could allow a malicious actor to cause service interruptions by establishing a large number o...

The vulnerability in the web interface for managing the Cisco AsyncOS operating system of the Cisco Email Security Appliance (ESA) security email system, the Cisco Secure Email and Web Manager content protection device, and the Cisco Secure Web Appliance (formerly Cisco Web Security Appliance (WSA)) web gateway allows a perpetrator to expose protected information.

The vulnerability in the web interface for controlling the Cisco AsyncOS operating system of the Cisco Email Security Appliance ESA, the Cisco Secure Email and Web Manager, and the Cisco Secure Web Appliance formerly Cisco Web Security Appliance WSA relates to authentication errors. Exploiting th...

Cisco Secure Email Gateway Malware Detection Evasion Vulnerability

Cisco Secure Email Gateways, formerly known as Cisco Ironport Email Security Appliances, that are configured to detect malicious email attachments, can easily be circumvented. A remote attacker can leverage error tolerance and different MIME decoding capabilities of email clients, compared with t...

Cisco Secure Email Gateway Malware Detection Evasion

This report is being published within a coordinated disclosure procedure. The researcher has been in contact with the vendor but not received a satisfactory response within a given time frame. As the attack complexity is low and exploits have already been published by a third party there must be ...

Input validation

A vulnerability in Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper handling of certain TLS connections that are processed by an...

CVE-2022-20960

Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) is affected by CVE-2022-20960. The issue arises from improper handling of TLS connections, enabling an unauthenticated remote attacker to trigger a DoS by opening a large number of concurrent TLS connections. This can cause the ESA t...

Cisco Email Security Appliance Denial of Service Vulnerability

A vulnerability in Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper handling of certain TLS connections that are processed by an...

多款Cisco产品信任管理问题漏洞

The Cisco Email Security Appliance ESA and Cisco AsyncOS are both products of Cisco, Inc.The Cisco Email Security Appliance is an email security appliance.The Cisco AsyncOS is an operating system for Cisco devices. Cisco AsyncOS is an operating system for Cisco devices. A trust management issue...

The vulnerability in the implementation of the scanning mechanism for Cisco AsyncOS operating systems in Cisco Secure Web Appliances (formerly known as “Cisco Web Security Appliances”) allows a perpetrator to circumvent security restrictions.

The vulnerability of the scanning mechanism implemented in Cisco AsyncOS operating systems for Cisco Secure Web Appliances formerly known as “Cisco Web Security Appliances” is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to bypass securi...

The vulnerability in the web interface for managing the Cisco AsyncOS operating system for Cisco Secure Web Appliances allows a attacker to elevate their privileges to the root level.

The vulnerability in the web interface for controlling the Cisco AsyncOS operating system for Cisco Secure Web Appliances is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to elevate their privileges to the root level remotely...

Cisco AsyncOS 操作系统命令注入漏洞

Cisco AsyncOS is an operating system for Cisco devices from Cisco USA. Cisco AsyncOS suffers from an operating system command injection vulnerability that stems from insufficient validation of user-supplied web interface input. A remote attacker could use this vulnerability to perform command...

PT-2022-4313 · Cisco · Cisco Asyncos +1

Name of the Vulnerable Software and Affected Versions: Cisco Secure Web Appliance versions prior to 14.5.0-537 Cisco Secure Web Appliance versions 12.5 and 14.0 updates pending Description: A vulnerability in the web management interface of Cisco AsyncOS for Cisco Secure Web Appliance could allow...

The vulnerability of the Web-Based Reputation Score (WBRS) mechanism in the Cisco AsyncOS operating system of Cisco Web Security Appliance internet gateways allows a perpetrator to access blocked content.

The vulnerability of the Web-Based Reputation Score WBRS mechanism in the Cisco AsyncOS operating system and Cisco Web Security Appliance firewalls is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to gain access to blocked content...

CVE-2022-20784

A vulnerability in the Web-Based Reputation Score WBRS engine of Cisco AsyncOS Software for Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to bypass established web request policies and access blocked content on an affected device. This vulnerability is due to...

CVE-2022-20784

A vulnerability in the Web-Based Reputation Score WBRS engine of Cisco AsyncOS Software for Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to bypass established web request policies and access blocked content on an affected device. This vulnerability is due to...

CVE-2022-20784

A vulnerability in the Web-Based Reputation Score WBRS engine of Cisco AsyncOS Software for Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to bypass established web request policies and access blocked content on an affected device. This vulnerability is due to...

Cross site request forgery (csrf)

A vulnerability in the Web-Based Reputation Score WBRS engine of Cisco AsyncOS Software for Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to bypass established web request policies and access blocked content on an affected device. This vulnerability is due to...

CVE-2022-20781 Cisco Web Security Appliance Stored Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface of an affected device. The vulnerability exists...