CVE-2023-20075

The CVE-2023-20075 issue affects Cisco Secure Email Gateway (ESA) / Cisco Email Security Appliance CLI. It stems from improper input validation in the CLI, enabling an authenticated, local attacker to inject operating system commands into a legitimate CLI command and escape the restricted prompt ...

CVE-2023-20009

CVE-2023-20009 affects Cisco’s Web UI and administrative CLI on the Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA). The issue stems from processing of a specially crafted SNMP configuration file, which, if uploaded by an authenticated user with at least operator pri...

CVE-2023-20009

A vulnerability in the Web UI and administrative CLI of the Cisco Secure Email Gateway ESA and Cisco Secure Email and Web Manager SMA could allow an authenticated remote attacker and or authenticated local attacker to escalate their privilege level and gain root access. The attacker has to have a...

Cisco Releases Security Advisories for Multiple Products

Cisco has released security advisories for vulnerabilities affecting multiple Cisco products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. For updates addressing lower severity vulnerabilities, see the Cisco Security Advisories page. CISA...

SUSE CVE-2018-12373

dDecrypted S/MIME parts hidden with CSS or the plaintext HTML tag can leak plaintext when included in a HTML reply/forward. This vulnerability affects Thunderbird 52.9...

PT-2023-6472 · Cisco · Cisco Secure Email/Web Manager +1

Name of the Vulnerable Software and Affected Versions: Cisco Secure Email Gateway ESA and Cisco Secure Email and Web Manager SMA affected versions not specified Description: A vulnerability in the Web UI and administrative CLI of the affected systems could allow an authenticated remote or local...

Cisco Secure Email Gateway Malware Detection Evasion

This report is being published within a coordinated disclosure procedure. The researcher has been in contact with the vendor but not received a satisfactory response within a given time frame. As the attack complexity is low and exploits have already been published by a third party there must be ...

Cisco Secure Email and Web Manager Information Disclosure (cisco-sa-cnt-sec-infodiscl-BVKKnUG)

According to its self-reported version, Cisco Secure Email and Web Manager is affected by an information disclosure vulnerability that could allow an authenticated, remote attacker to retrieve sensitive information from an affected device, including user credentials. This vulnerability is due to...

CVE-2022-20942

A vulnerability in the web-based management interface of Cisco Email Security Appliance ESA, Cisco Secure Email and Web Manager, and Cisco Secure Web Appliance, formerly known as Cisco Web Security Appliance WSA, could allow an authenticated, remote attacker to retrieve sensitive information from...

CVE-2022-20867

A vulnerability in web-based management interface of the of Cisco Email Security Appliance and Cisco Secure Email and Web Manager could allow an authenticated, remote attacker to conduct SQL injection attacks as root on an affected system. The attacker must have the credentials of a high-privileg...

CVE-2022-20772

A vulnerability in Cisco Email Security Appliance ESA and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. This vulnerability is due to the failure of the application or its environment to properly sanitize input...

CVE-2022-20772

CVE-2022-20772 affects Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager. The issue is an HTTP Response Header Injection/HTTP response splitting caused by insufficient input sanitization, allowing an unauthenticated, remote attacker to inject headers and influence the re...

CVE-2022-20868

CVE-2022-20868 affects Cisco Email Security Appliance (ESA), Cisco Secure Email and Web Manager, and Cisco Secure Web Appliance. The root cause is a hardcoded value used to encrypt a token for certain API calls, enabling an authenticated, remote attacker with valid credentials to impersonate anot...

CVE-2022-20867

Cisco ESA and Cisco Secure Email and Web Manager expose a web-based management interface vulnerable to SQL injection via improper validation of user-submitted parameters. An attacker with high-privilege credentials can exploit it over the network to read/modify data in the underlying database. Th...

Cisco Secure Email and Web Manager Multiple Vulnerabilities (cisco-sa-esasmawsa-vulns-YRuSW5mD)

According to its self-reported version, Cisco Secure Email and Web Manager is affected by multiple vulnerabilities. - an SQL injection vulnerability that could allow an authenticated, remote attacker to conduct SQL injection attacks as root on an affected system. To exploit this vulnerability, an...

多款Cisco产品注入漏洞

The Cisco Email Security Appliance ESA and Cisco Secure Email are both products of Cisco, U.S.A. The Cisco Email Security Appliance is an email security appliance.Cisco Secure Email is a Cisco Secure Email formerly Email Security provides optimal protection for your email from network threats. An...

PT-2022-5525 · Cisco · Cisco Secure Email/Web Manager +2

Name of the Vulnerable Software and Affected Versions: Cisco Email Security Appliance ESA affected versions not specified Cisco Secure Email and Web Manager affected versions not specified Cisco Secure Web Appliance affected versions not specified Description: The issue is related to errors in...

多款Cisco产品SQL注入漏洞

The Cisco Email Security Appliance ESA and Cisco Secure Email are both products of Cisco, U.S.A. The Cisco Email Security Appliance is an email security appliance.Cisco Secure Email is a Cisco Secure Email formerly Email Security provides optimal protection for your email from network threats. A...

New SDR feature released for Cisco Secure Email

Cisco Talos today announced the release of a new mechanism that allows Cisco Secure Email customers the option to submit Sender Domain Reputation SDR disputes through TalosIntelligence.com. Customers now have the option of receiving self-service support through TalosIntelligence.com or may contin...

The vulnerability of the implementation of the Lightweight Directory Access Protocol (LDAP) in the Cisco Secure Email and Web Manager content protection device, as well as the Cisco Email Security Appliance (ESA) email security system, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Lightweight Directory Access Protocol LDAP implementation of the Cisco Secure Email and Web Manager security device, as well as the Cisco Email Security Appliance ESA email security system, is related to the lack of proper input sanitization during requests to the externa...