CVE-2023-20120 Cisco Secure Email Gateway, Cisco Secure Email and Web Manager, and Cisco Secure Web Appliance Cross-Site Scripting Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager; Cisco Secure Email Gateway, formerly Cisco Email Security Appliance ESA; and Cisco Secure Web Appliance, formerly Cisco Web Security Appliance WSA, could allow a remote...

The vulnerability in the web interface of the Cisco Operating System, Cisco AsyncOS, affects the Cisco Email Security Appliance (ESA) and the Cisco Secure Web Appliance (previously Cisco Web Security Appliance). This vulnerability allows attackers to carry out attacks using XSS scripts across different websites.

The vulnerability in the web interface of the Cisco Operating System, Cisco Email Security Appliance, and Cisco Secure Web Appliance previously Cisco Web Security Appliance exists due to the lack of security measures for the web page structure. Exploiting this vulnerability allows a malicious act...

The vulnerability in the web interface of the Cisco AsyncOS operating system allows attackers to execute attacks using cross-site scripting (XSS) techniques against devices that run Cisco Secure Email and Web Manager, Cisco Secure Email Gateway (formerly Cisco Email Security Appliance), and Cisco Secure Web Appliance (formerly Cisco Web Security Appliance).

The vulnerability in the Cisco AsyncOS operating system’s web interface exists due to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely. This vulnerability also affects the Cisco Secure Email and Web Manager,...

The vulnerability in the web interface of the Cisco AsyncOS operating system of the Cisco Secure Email and Web Manager devices allows attackers to carry out attacks using cross-site scripting (XSS).

The vulnerability in the web interface of the Cisco AsyncOS operating system of the Cisco Secure Email and Web Manager devices exists due to the lack of measures taken to protect the structure of the web pages. Exploiting this vulnerability allows a malicious actor, who operates remotely and has...

CVE-2023-20119

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, formerly known as Content Security Management Appliance SMA could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the...

CVE-2022-20952

A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance, formerly known as Cisco Web Security Appliance WSA, could allow an unauthenticated, remote attacker to bypass a configured rule, thereby allowing traffic onto a network that should have been blocked...

The vulnerability in the implementation of the URL filtering mechanism for Cisco AsyncOS operating systems in Cisco Email Security Appliance (ESA) systems allows attackers to circumvent security restrictions.

The vulnerability of the URL filtering mechanism implemented in Cisco AsyncOS operating systems for Cisco Email Security Appliance ESA systems relates to security configuration errors. Exploiting this vulnerability can allow a malicious actor to circumvent security restrictions remotely...

CVE-2023-20057

A vulnerability in the URL filtering mechanism of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. This vulnerability is due to improper processing of URLs. An attacker could...

CVE-2023-20057

A vulnerability in the URL filtering mechanism of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. This vulnerability is due to improper processing of URLs. An attacker could...

PT-2025-9693 · Cisco · Cisco Asyncos +1

Name of the Vulnerable Software and Affected Versions: Cisco Content Security Management Appliance SMA affected versions not specified Description: A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Content Security Management Appliance SMA could allow an...

The vulnerability of the Cisco AsyncOS operating system in the Cisco Email Security Appliance (ESA) security system allows a perpetrator to trigger a service failure.

The vulnerability of the Cisco AsyncOS operating system in the Cisco Email Security Appliance ESA security system is related to errors in the certificate validation process. Exploiting this vulnerability could allow a malicious actor to cause service interruptions by establishing a large number o...

The vulnerability in the web interface for managing the Cisco AsyncOS operating system of the Cisco Email Security Appliance (ESA) security email system, the Cisco Secure Email and Web Manager content protection device, and the Cisco Secure Web Appliance (formerly Cisco Web Security Appliance (WSA)) web gateway allows a perpetrator to expose protected information.

The vulnerability in the web interface for controlling the Cisco AsyncOS operating system of the Cisco Email Security Appliance ESA, the Cisco Secure Email and Web Manager, and the Cisco Secure Web Appliance formerly Cisco Web Security Appliance WSA relates to authentication errors. Exploiting th...

Input validation

A vulnerability in Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper handling of certain TLS connections that are processed by an...

The vulnerability in the implementation of the scanning mechanism for Cisco AsyncOS operating systems in Cisco Secure Web Appliances (formerly known as “Cisco Web Security Appliances”) allows a perpetrator to circumvent security restrictions.

The vulnerability of the scanning mechanism implemented in Cisco AsyncOS operating systems for Cisco Secure Web Appliances formerly known as “Cisco Web Security Appliances” is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to bypass securi...

The vulnerability in the web interface for managing the Cisco AsyncOS operating system for Cisco Secure Web Appliances allows a attacker to elevate their privileges to the root level.

The vulnerability in the web interface for controlling the Cisco AsyncOS operating system for Cisco Secure Web Appliances is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to elevate their privileges to the root level remotely...

PT-2022-4313 · Cisco · Cisco Asyncos +1

Name of the Vulnerable Software and Affected Versions: Cisco Secure Web Appliance versions prior to 14.5.0-537 Cisco Secure Web Appliance versions 12.5 and 14.0 updates pending Description: A vulnerability in the web management interface of Cisco AsyncOS for Cisco Secure Web Appliance could allow...

Cisco AsyncOS 操作系统命令注入漏洞

Cisco AsyncOS is an operating system for Cisco devices from Cisco USA. Cisco AsyncOS suffers from an operating system command injection vulnerability that stems from insufficient validation of user-supplied web interface input. A remote attacker could use this vulnerability to perform command...

The vulnerability of the Web-Based Reputation Score (WBRS) mechanism in the Cisco AsyncOS operating system of Cisco Web Security Appliance internet gateways allows a perpetrator to access blocked content.

The vulnerability of the Web-Based Reputation Score WBRS mechanism in the Cisco AsyncOS operating system and Cisco Web Security Appliance firewalls is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to gain access to blocked content...

CVE-2022-20784

A vulnerability in the Web-Based Reputation Score WBRS engine of Cisco AsyncOS Software for Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to bypass established web request policies and access blocked content on an affected device. This vulnerability is due to...

CVE-2022-20784

A vulnerability in the Web-Based Reputation Score WBRS engine of Cisco AsyncOS Software for Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to bypass established web request policies and access blocked content on an affected device. This vulnerability is due to...