Cisco Email Security Appliance GZIP Content Filter Bypass Vulnerability

A vulnerability in the GZIP decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass configured content filters on the device. The vulnerability is due to improper validation of GZIP-formatted files. An attacke...

CVE-2019-1844

The Cisco Email Security Appliance (ESA) contains CVE-2019-1844, a filter bypass flaw caused by improper detection of certain content. An unauthenticated, remote attacker could bypass recipient filtering by sending specific file types without Content-Disposition information, enabling messages tha...

CVE-2018-15460

CVE-2018-15460 affects Cisco AsyncOS Software for Cisco Email Security Appliances (ESA). The flaw is in the email message filtering feature, caused by improper filtering of messages that reference whitelisted URLs. An unauthenticated, remote attacker can send a malicious email containing a large ...

Elasticsearch ESA-2017-18

An error was found in the X-Pack Security privilege enforcement. If a user has either delete or index permissions on an index in a cluster, they may be able to issue both delete and index requests against that index. C Tenable Network Security, Inc. include"compat.inc"; if description...

Elasticsearch ESA-2018-11

A sensitive data disclosure flaw was found in the Elasticsearch repository-azure formerly elasticsearch-cloud-azure plugin. When the repository-azure plugin is set to log at TRACE level Azure credentials can be inadvertently logged. C Tenable Network Security, Inc. include"compat.inc"; if...

CVE-2018-0419

The CVE-2018-0419 issue involves Cisco Email Security Appliance (ESA). Affected component: attachment detection/filtration mechanisms. Root cause (as described): improper detection of content within executable (EXE) files, enabling a bypass of the ESA’s filtering. Exploitation scenario: unauthent...

Open redirect

The fix in Kibana for ESA-2017-23 was incomplete. With X-Pack security enabled, Kibana versions before 6.1.3 and 5.6.7 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website...

Elastic Stack 6.1.3 and 5.6.7 security update

Kibana incomplete fix for ESA-2017-23 ESA-2018-03 The fix in Kibana for ESA-2017-23 was incomplete. With X-Pack security enabled, Kibana versions before 6.1.3 and 5.6.7 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitra...

siakad.esaunggul.ac.id XSS vulnerability

Open Bug Bounty ID: OBB-531200 Description| Value ---|--- Affected Website:| siakad.esaunggul.ac.id Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2017-12353

The CVE-2017-12353 issue affects Cisco AsyncOS Software on Cisco Email Security Appliances (ESA). The MIME scanner component fails to properly handle malformed MIME headers in email attachments, enabling an unauthenticated, remote attacker to bypass configured user filters by sending a crafted MI...

Cisco Email Security Appliance Header Bypass Vulnerability

A vulnerability in the Simple Mail Transfer Protocol SMTP header filtering functionality of Cisco AsyncOS Software for Cisco Email Security Appliances ESA could allow an unauthenticated, remote attacker to bypass configured user filters on the device. The vulnerability is due to improper handling...

CVE-2017-12309

The CVE-2017-12309 issue affects Cisco Email Security Appliance (ESA) and Content Security Management Appliance (SMA). The root cause is improper input sanitization that enablesHTTP response splitting by an unauthenticated remote attacker, allowing potential cross-site scripting, cross-user defac...

Cisco Email Security Appliance Malformed EML Attachment Bypass Vulnerability

A vulnerability in the malware detection functionality within Advanced Malware Protection AMP of Cisco AsyncOS Software for Cisco Email Security Appliances ESAs could allow an unauthenticated, remote attacker to cause an email attachment containing malware to be delivered to the end user. The...

Cisco Email Security Appliance SNMP Polling Information Disclosure Vulnerability

A vulnerability in SNMP polling for the Cisco Email Security Appliance ESA could allow an authenticated, remote attacker to discover confidential information about the appliances that should be available only to an administrative user. SPDX-FileCopyrightText: 2017 Greenbone AG Some text...

CVE-2017-6671

CVE-2017-6671 affects Cisco AsyncOS for Cisco Email Security Appliance (ESA). The vulnerability resides in the email message scanning feature, where improper validation of emails with attachments and a modified MIME header can allow an unauthenticated, remote attacker to bypass configured filters...

CVE-2017-3827

A vulnerability in the Multipurpose Internet Mail Extensions MIME scanner of Cisco AsyncOS Software for Cisco Email Security Appliances ESA and Web Security Appliances WSA could allow an unauthenticated, remote attacker to bypass configured user filters on the device. Affected Products: This...

Cisco AsyncOS Software for Cisco ESA Filtering Bypass Vulnerability

A vulnerability in the Multipurpose Internet Mail Extensions MIME scanner of Cisco AsyncOS Software for Cisco Email Security Appliances ESA could allow an unauthenticated, remote attacker to bypass configured user filters on the device. SPDX-FileCopyrightText: 2017 Greenbone AG Some text...

CVE-2016-9202

Cisco ESA/ASA web UI is affected by a persistent cross-site scripting (XSS) vulnerability (CVE-2016-9202) in the web-based management interface, exploitable by an unauthenticated remote attacker. The flaw could allow script execution in a user’s browser on ESA Switches and related appliances, wit...

Cisco AsyncOS for Email Security Appliances MIME Header Processing Filter Bypass (cisco-sa-20161116-esa1 / cisco-sa-20161116-esa2)

According to its self-reported version, the Cisco AsyncOS running on the remote Cisco Email Security ESA appliance is affected by an email filter bypass vulnerability in the email filtering functionality due to improper error handling when processing malformed Multipurpose Internet Mail Extension...

Kibana 5.0.2 released with a fix for improper authentication

With X-Pack installed, operations in the Advanced Settings panel of the Management tab and operations from the short URL service were performed as the "Kibana Server" user regardless of the user that is currently authenticated. As a result, a user that was defined as read-only could make changes ...