CVE-2016-1315

CVE-2016-1315 affects Cisco AMP/ESA: the proxy engine can be bypassed via a malformed email containing an encoded file, allowing remote, unauthenticated attackers to bypass content restrictions. Affected: Cisco Advanced Malware Protection and Email Security Appliance (ESA) with versions and bug I...

integral.esac.esa.int XSS vulnerability

Vulnerable URL: http://integral.esac.esa.int/cgi-scripts/cc/sgssearchccs.cgi?reference=%3CSCRIPT%3Ealert%28String.fromCharCode%2888,%2083,%2083,%2080,%2079,%2083,%2069,%2068%29%29%3C/SCRIPT%3E=v3.0screw=XSS Details: Description| Value ---|--- Patched:| Yes, at 25.01.2016 Latest check for patch:|...

Design/Logic Flaw

Cisco AsyncOS before 8.5.7-043, 9.x before 9.1.1-023, and 9.5.x and 9.6.x before 9.6.0-046 on Email Security Appliance ESA devices mishandles malformed fields during body-contains, attachment-contains, every-attachment-contains, attachment-binary-contains, dictionary-match, and...

CVE-2015-6291

Cisco AsyncOS before 8.5.7-043, 9.x before 9.1.1-023, and 9.5.x and 9.6.x before 9.6.0-046 on Email Security Appliance ESA devices mishandles malformed fields during body-contains, attachment-contains, every-attachment-contains, attachment-binary-contains, dictionary-match, and...

CVE-2015-6291

CVE-2015-6291 affects Cisco AsyncOS on Email Security Appliance (ESA) devices. Root cause: improper input validation when filtering attachments (body-contains, attachment-contains, every-attachment-contains, attachment-binary-contains, dictionary-match, and attachment-dictionary-match), which can...

CVE-2015-6321

Cisco AsyncOS contains a denial-of-service vulnerability (CVE-2015-6321) in the network stack triggered by a flood of TCP packets, leading to memory exhaustion and disruption of new TCP connections. Affected products include Cisco Email Security Appliance (ESA) on various 8.5.x–9.6.x branches, Ci...

CVE-2015-6309

Cisco Email Security Appliance (ESA) versions 8.5.6-106 and 9.6.0-042 are affected by CVE-2015-6309. The vulnerability allows an authenticated, remote attacker to cause a denial of service by sending crafted HTTP requests, resulting in file-descriptor exhaustion and a device reload. The issue is ...

CVE-2015-6285

CVE-2015-6285 describes a format-string vulnerability in Cisco Email Security Appliance (ESA) 7.6.0 and 8.0.0 that can be exploited remotely by sending crafted HTTP requests to trigger a DoS (memory overwrite or service outage). The issue stems from improper handling/validation of format specifie...

ESA-2015-130: EMC Documentum WebTop and WebTop Clients Cross-Site Request Forgery Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-130: EMC Documentum WebTop and WebTop Clients Cross-Site Request Forgery Vulnerability EMC Identifier: ESA-2015-130 CVE Identifier: CVE-2015-4530 Severity Rating: CVSS v2 Base Score: 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Affected products: • EMC...

CVE-2015-4288

The LDAP implementation on the Cisco Web Security Appliance WSA 8.5.0-000, Email Security Appliance ESA 8.5.7-042, and Content Security Management Appliance SMA 8.3.6-048 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain...

CVE-2015-4288

CVE-2015-4288 affects Cisco Web Security Appliance (WSA) 8.5.0-000, Email Security Appliance (ESA) 8.5.7-042, and Content Security Management Appliance (SMA) 8.3.6-048. The LDAP server in these devices does not verify X.509 certificates from SSL servers, enabling a man-in-the-middle attacker to s...

CVE-2015-0732

Summary: CVE-2015-0732 is a cross-site scripting (XSS) vulnerability affecting Cisco AsyncOS on Web Security Appliance (WSA) 9.0.0-193; Email Security Appliance (ESA) 8.5.6-113, 9.1.0-032, 9.1.1-000, 9.6.0-000; and Content Security Management Appliance (SMA) 9.1.0-033. The issue arises from insuf...

ESA-2015-122: EMC Documentum CenterStage Cross-site Scripting Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-122: EMC Documentum CenterStage Cross-site Scripting Vulnerability EMC Identifier: ESA-2015-122 CVE Identifier: CVE-2015-4528 Severity Rating: CVSS v2 Base Score: 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P Affected products: • EMC Documentum CenterStage...

CVE-2015-4278

Cisco Email Security Appliance (ESA) vulnerable to CVE-2015-4278: 8.5.6-106 and 9.5.0-201 allow remote attackers to cause a DoS (per-domain email reception outage) by placing malformed DMARC policy data in DNS TXT records for a domain (Bug ID CSCuv14806). The root cause is malformed DMARC policy ...

Extra information for CVE-2014-2513 - EMC Documentum Content Server: arbitrary code execution

Product: EMC Documentum Content Server Vendor: EMC Version: ANY CVE: N/A Risk: High Status: public/not fixed On November 2013 I discovered vulnerability in EMC Documentum Content Server which allow authenticated user to execute arbitrary commands using dmbptransition docbase method for detailed...

CVE-2015-4236

Cisco AsyncOS for Email Security Appliances (ESA) with clustering enabled is affected on ESA software versions 8.5.6-073, 8.5.6-074, and 9.0.0-461. The issue stems from improper handling of high-rate packet floods, allowing remote attackers to trigger a denial-of-service condition that makes clus...

Extra information for CVE-2014-4626 - EMC Documentum Content Server: authenticated user is able to elevate privileges, hijack Content Server filesystem, execute arbitrary commands by creating malicious dm_job objects

Product: EMC Documentum Content Server Vendor: EMC Version: ANY CVE: N/A Risk: High Status: public/not fixed On April 2014 I discovered vulnerability in EMC Documentum Content Server which allow authenticated user to elevate privileges, hijack Content Server filesystem or execute arbitrary comman...

Cisco Virtual WSA / ESA / SMA default keys

Default ssh keys are installed...

Cisco Virtual WSA, ESA, and SMA Default SSH Host Keys Vulnerability

A vulnerability in the remote support functionality of Cisco WSAv, Cisco ESAv, and Cisco SMAv Software could allow an unauthenticated, remote attacker to decrypt and impersonate secure communication between any virtual content security appliances. The vulnerability is due to the presence of...

CVE-2015-4184

Cisco Email Security Appliance (ESA) AsyncOS contains an anti-spam scanner vulnerability caused by improper handling of a crafted DNS SPF TXT record, allowing unauthenticated remote bypass of anti-spam restrictions. Affected ESA versions include 3.3.1-09, 7.5.1-gpl-022, and 8.5.6-074. Exploitatio...