esa.int XSS vulnerability

Vulnerable URL: http://www.esa.int/OurActivities/ObservingtheEarth/TheLivingPlanetProgramme/EarthExplorers/Swarm/ESAsmagneticfieldmissionSwarm" Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 16495 VIP website...

Cisco Email Security Appliance .zip File Scanning Security Bypass Vulnerability

A vulnerability in the anti-spam filter of the Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass anti-spam filtering functionality on an affected system. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a reference...

CVE-2016-1438

CVE-2016-1438 affects Cisco AsyncOS on Email Security Appliance (ESA) 9.7.0-125. It exploits improper handling of content in .zip files to bypass the anti-spam filtering, enabling remote attackers to bypass filtering via a crafted ZIP payload. Exploitation details in public sources align with a b...

CVE-2016-1438: Improper Input Validation

Cisco AsyncOS 9.7.0-125 on Email Security Appliance ESA devices allows remote attackers to bypass intended spam filtering via crafted executable content in a ZIP archive, aka Bug ID CSCuy39210...

EMC ViPR SRM - Cross-Site Request Forgery

EMC ViPR SRM - Cross-Site Request Forgery !-- EMC M&R Watch4net lacks Cross-Site Request Forgery protection Abstract It was discovered that EMC M&R Watch4net does not protect against Cross-Site Request Forgery CSRF attacks. A successful CSRF attack can compromise end user data and may allow an...

EMC ViPR SRM - Cross-Site Request Forgery

!-- EMC M&R Watch4net lacks Cross-Site Request Forgery protection Abstract It was discovered that EMC M&R Watch4net does not protect against Cross-Site Request Forgery CSRF attacks. A successful CSRF attack can compromise end user data and may allow an attacker to perform an account hijack. If th...

CVE-2016-1315

CVE-2016-1315 affects Cisco AMP/ESA: the proxy engine can be bypassed via a malformed email containing an encoded file, allowing remote, unauthenticated attackers to bypass content restrictions. Affected: Cisco Advanced Malware Protection and Email Security Appliance (ESA) with versions and bug I...

integral.esac.esa.int XSS vulnerability

Vulnerable URL: http://integral.esac.esa.int/cgi-scripts/cc/sgssearchccs.cgi?reference=%3CSCRIPT%3Ealert%28String.fromCharCode%2888,%2083,%2083,%2080,%2079,%2083,%2069,%2068%29%29%3C/SCRIPT%3E=v3.0screw=XSS Details: Description| Value ---|--- Patched:| Yes, at 25.01.2016 Latest check for patch:|...

Design/Logic Flaw

Cisco AsyncOS before 8.5.7-043, 9.x before 9.1.1-023, and 9.5.x and 9.6.x before 9.6.0-046 on Email Security Appliance ESA devices mishandles malformed fields during body-contains, attachment-contains, every-attachment-contains, attachment-binary-contains, dictionary-match, and...

CVE-2015-6291

Cisco AsyncOS before 8.5.7-043, 9.x before 9.1.1-023, and 9.5.x and 9.6.x before 9.6.0-046 on Email Security Appliance ESA devices mishandles malformed fields during body-contains, attachment-contains, every-attachment-contains, attachment-binary-contains, dictionary-match, and...

CVE-2015-6321

Cisco AsyncOS contains a denial-of-service vulnerability (CVE-2015-6321) in the network stack triggered by a flood of TCP packets, leading to memory exhaustion and disruption of new TCP connections. Affected products include Cisco Email Security Appliance (ESA) on various 8.5.x–9.6.x branches, Ci...

CVE-2015-6291

CVE-2015-6291 affects Cisco AsyncOS on Email Security Appliance (ESA) devices. Root cause: improper input validation when filtering attachments (body-contains, attachment-contains, every-attachment-contains, attachment-binary-contains, dictionary-match, and attachment-dictionary-match), which can...

CVE-2015-6291: Improper Input Validation

Cisco AsyncOS before 8.5.7-043, 9.x before 9.1.1-023, and 9.5.x and 9.6.x before 9.6.0-046 on Email Security Appliance ESA devices mishandles malformed fields during body-contains, attachment-contains, every-attachment-contains, attachment-binary-contains, dictionary-match, and...

PT-2015-7155

Name of the Vulnerable Software and Affected Versions Cisco Email Security Appliance ESA versions prior to 8.5.7-043 Cisco Email Security Appliance ESA versions 9.x prior to 9.1.1-023 Cisco Email Security Appliance ESA versions 9.5.x and 9.6.x prior to 9.6.0-046 Description The issue arises from...

PT-2015-7177

Name of the Vulnerable Software and Affected Versions Cisco Email Security Appliance ESA versions 8.5.7-042 and earlier, 9.x versions prior to 9.1.0-032, 9.1.x versions prior to 9.1.1-023, and 9.5.x and 9.6.x versions prior to 9.6.0-042 Cisco Content Security Management Appliance SMA versions pri...

CVE-2015-6309

Cisco Email Security Appliance (ESA) versions 8.5.6-106 and 9.6.0-042 are affected by CVE-2015-6309. The vulnerability allows an authenticated, remote attacker to cause a denial of service by sending crafted HTTP requests, resulting in file-descriptor exhaustion and a device reload. The issue is ...

CVE-2015-6309: Undefined Security Weakness

Cisco Email Security Appliance ESA 8.5.6-106 and 9.6.0-042 allows remote authenticated users to cause a denial of service file-descriptor consumption and device reload via crafted HTTP requests, aka Bug ID CSCuw32211...

CVE-2015-6285

CVE-2015-6285 describes a format-string vulnerability in Cisco Email Security Appliance (ESA) 7.6.0 and 8.0.0 that can be exploited remotely by sending crafted HTTP requests to trigger a DoS (memory overwrite or service outage). The issue stems from improper handling/validation of format specifie...

PT-2015-7150

Name of the Vulnerable Software and Affected Versions Cisco Email Security Appliance ESA versions 7.6.0 through 8.0.0 Description The issue allows remote attackers to cause a denial of service, potentially resulting in memory overwrite or service outage, by including format string specifiers in a...

CVE-2015-6285: Use of Externally-Controlled Format String

Format string vulnerability in Cisco Email Security Appliance ESA 7.6.0 and 8.0.0 allows remote attackers to cause a denial of service memory overwrite or service outage via format string specifiers in an HTTP request, aka Bug ID CSCug21497...