Cisco AsyncOS Web Framework Input Validation Vulnerability

Cisco AsyncOS on Email Security Appliance ESA and so on are products of Cisco USA.Cisco ESA is a set of email security appliances.Cisco Content SMA is a set of content security management appliances.Cisco AsyncOS is a set of operating systems used in these products. Cisco Web Security Appliance i...

Design/Logic Flaw

The web framework in Cisco AsyncOS on Email Security Appliance ESA, Content Security Management Appliance SMA, and Web Security Appliance WSA devices allows remote attackers to trigger redirects via a crafted HTTP header, aka Bug IDs CSCur44412, CSCur44415, CSCur89630, CSCur89636, CSCur89633, and...

CVE-2015-0624

The web framework in Cisco AsyncOS on Email Security Appliance ESA, Content Security Management Appliance SMA, and Web Security Appliance WSA devices allows remote attackers to trigger redirects via a crafted HTTP header, aka Bug IDs CSCur44412, CSCur44415, CSCur89630, CSCur89636, CSCur89633, and...

CVE-2015-0624: Improper Input Validation

The web framework in Cisco AsyncOS on Email Security Appliance ESA, Content Security Management Appliance SMA, and Web Security Appliance WSA devices allows remote attackers to trigger redirects via a crafted HTTP header, aka Bug IDs CSCur44412, CSCur44415, CSCur89630, CSCur89636, CSCur89633, and...

Cisco AsyncOS Software Remote Security Bypass Vulnerability (CNVD-2015-00993)

Cisco AsyncOS is Cisco's customized operating system for the performance and security of all mail applications. A remote security bypass vulnerability exists in Cisco AsyncOS Software that could allow an attacker to bypass certain security restrictions and perform unauthorized operations...

CVE-2015-0605

The uuencode inspection engine in Cisco AsyncOS on Cisco Email Security Appliance ESA devices 8.5 and earlier allows remote attackers to bypass intended content restrictions via a crafted e-mail attachment with uuencode encoding, aka Bug ID CSCzv54343...

Code injection

The uuencode inspection engine in Cisco AsyncOS on Cisco Email Security Appliance ESA devices 8.5 and earlier allows remote attackers to bypass intended content restrictions via a crafted e-mail attachment with uuencode encoding, aka Bug ID CSCzv54343...

Multiple Cross-Site Scripting Vulnerabilities in Cisco AsyncOS

Cisco AsyncOS is Cisco's customized operating system for the performance and security of all mail applications. Multiple cross-site scripting vulnerabilities exist in Cisco AsyncOS, allowing remote attackers to inject arbitrary web script or HTML via unspecified parameters...

CVE-2015-0577

Multiple cross-site scripting XSS vulnerabilities in the IronPort Spam Quarantine ISQ page in Cisco AsyncOS, as used on the Cisco Email Security Appliance ESA and Content Security Management Appliance SMA, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, a...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the IronPort Spam Quarantine ISQ page in Cisco AsyncOS, as used on the Cisco Email Security Appliance ESA and Content Security Management Appliance SMA, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, a...

CVE-2015-0577

Multiple cross-site scripting XSS vulnerabilities in the IronPort Spam Quarantine ISQ page in Cisco AsyncOS, as used on the Cisco Email Security Appliance ESA and Content Security Management Appliance SMA, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, a...

CVE-2015-0577

Cisco AsyncOS ISQ (IronPort Spam Quarantine) XSS: multiple vulnerabilities in the ISQ web page on ESA/SMA due to insufficient input validation, enabling remote attackers to inject arbitrary script/HTML via unspecified parameters. Root cause: input validation gaps in the web page. Impact: cross-si...

CVE-2015-0577: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the IronPort Spam Quarantine ISQ page in Cisco AsyncOS, as used on the Cisco Email Security Appliance ESA and Content Security Management Appliance SMA, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, a...

Authentication flaw

The ZIP inspection engine in Cisco AsyncOS 8.5 and earlier on the Cisco Email Security Appliance ESA does not properly analyze ZIP archives, which allows remote attackers to bypass malware filtering via a crafted archive, aka Bug ID CSCup07934...

Cross site scripting

Cross-site scripting XSS vulnerability in the web management interface in Cisco AsyncOS on the Email Security Appliance ESA 8.0, Web Security Appliance WSA 8.0 .5 Hot Patch 1 and earlier, and Content Security Management Appliance SMA 8.3 and earlier allows remote attackers to inject arbitrary web...

CVE-2014-3289

Cross-site scripting XSS vulnerability in the web management interface in Cisco AsyncOS on the Email Security Appliance ESA 8.0, Web Security Appliance WSA 8.0 .5 Hot Patch 1 and earlier, and Content Security Management Appliance SMA 8.3 and earlier allows remote attackers to inject arbitrary web...

CVE-2014-3289

CVE-2014-3289 is a reflected XSS vulnerability in Cisco AsyncOS used by ESA, WSA, and SMA. The issue stems from insufficient input validation of the date_range parameter on the web management interface (notably monitor/reports/overview). A remote attacker can inject arbitrary script by tricking a...

Cisco AsyncOS contains a reflected cross-site scripting (XSS) vulnerability

Overview Cisco AsyncOS contains a reflected cross-site scripting XSS vulnerability. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' - CVE-2014-3289 Cisco AsyncOS, the underlying OS for the Cisco Email Security Appliance, Web Security Applianc...

CVE-2014-3289: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the web management interface in Cisco AsyncOS on the Email Security Appliance ESA 8.0, Web Security Appliance WSA 8.0 .5 Hot Patch 1 and earlier, and Content Security Management Appliance SMA 8.3 and earlier allows remote attackers to inject arbitrary web...

Cisco AsyncOS Cross-Site Scripting Vulnerability

A vulnerability in the web management interface of Cisco AsyncOS could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface on the affected system. The vulnerability is due to insufficient input validation of a parameter. An...