470 matches found
CVE-2022-20871: Improper Neutralization of Special Elements used in an OS Command
A vulnerability in the web management interface of Cisco AsyncOS for Cisco Secure Web Appliance, formerly Cisco Web Security Appliance WSA, could allow an authenticated, remote attacker to perform a command injection and elevate privileges to root. This vulnerability is due to insufficient...
CVE-2024-20504
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface...
CVE-2024-20504
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface...
PT-2024-8177 · Cisco · Cisco Asyncos
Name of the Vulnerable Software and Affected Versions: Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance affected versions not specified Description: A vulnerability in the web-based management interface could allow an authenticated,...
CVE-2023-49570
A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software trusts a certificate issued by an entity that isn't authorized to issue certificates. This occurs when the "Basic Constraints" extension in the certificate indicates that it is meant ...
CVE-2023-6057
A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of certificates issued using the DSA signature algorithm. The product does not properly check the certificate chain, allowing an attacker to establish MITM SSL...
PT-2024-7929
Name of the Vulnerable Software and Affected Versions qBittorrent versions prior to 5.0.1 Description The issue is related to improper SSL/TLS certificate validation in qBittorrent, allowing an attacker to perform a "man-in-the-middle" attack. This could enable a remote attacker to compromise...
PT-2025-2807 · Flexon · Flexon
Name of the Vulnerable Software and Affected Versions: FLEXON versions = 9.3.4 Description: The issue is related to the insertion of sensitive information into log files, potentially leading to improper disclosure of certain information through https access. This could allow a remote attacker to...
Johnson Controls exacqVision Web Service < 24.06 Multiple Vulnerabilities
The version of the Johnson Controls exacqVision Web Service running on the remote host is prior to 24.03. It is, therefore, affected by multiple vulnerabilities. - Under certain circumstances the exacqVision Web Services does not provide sufficient protection from untrusted domains. CVE-2024-3286...
CVE-2024-32864
Summary: CVE-2024-32864 affects Johnson Controls exacqVision Web Service prior to version 24.06, where HTTPS is not enforced under certain conditions, enabling potential exposure of sensitive information via cleartext transmission (CWE-319). The vulnerability affects exacqVision Web Service versi...
OWA not accessible on Secure Web iOS when Extended Protection is Enabled
After enabling Extended Protection on Exchange Server 2019 CU14, accessing OWA via Secure Web iOS is no longer possible. Users accessing Outlook Web Access OWA through Secure Web on iOS are continuously getting http 401 login prompt. The issue is not seen when using other browsers like Chrome or...
CVE-2024-20435
A vulnerability in the CLI of Cisco AsyncOS for Secure Web Appliance could allow an authenticated, local attacker to execute arbitrary commands and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied input for the CLI. An attacker could exploit this...
CVE-2024-20435
A vulnerability in the CLI of Cisco AsyncOS for Secure Web Appliance could allow an authenticated, local attacker to execute arbitrary commands and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied input for the CLI. An attacker could exploit this...
CVE-2024-20435
CVE-2024-20435 affects Cisco Secure Web Appliance (AsyncOS) CLI. The root cause is insufficient input validation in the CLI, allowing an authenticated, local attacker to execute arbitrary commands and elevate to root. The attack requires at least guest credentials and is local, with impact on con...
CVE-2024-20435
A vulnerability in the CLI of Cisco AsyncOS for Secure Web Appliance could allow an authenticated, local attacker to execute arbitrary commands and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied input for the CLI. An attacker could exploit this...
Cisco Secure Web Appliance Privilege Escalation Vulnerability
A vulnerability in the CLI of Cisco AsyncOS for Secure Web Appliance could allow an authenticated, local attacker to execute arbitrary commands and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied input for the CLI. An attacker could exploit this...
CVE-2024-20435: Execution with Unnecessary Privileges
A vulnerability in the CLI of Cisco AsyncOS for Secure Web Appliance could allow an authenticated, local attacker to execute arbitrary commands and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied input for the CLI. An attacker could exploit this...
PT-2024-5455 · Cisco · Cisco Secure Web Appliance +1
Name of the Vulnerable Software and Affected Versions: Cisco Secure Web Appliance versions affected versions not specified Description: The issue is related to insufficient validation of user-supplied input for the Command Line Interface CLI of Cisco AsyncOS for Secure Web Appliance. This could...
Trellix Secure Web Gateway Information Disclosure Vulnerability
Trellix Secure Web Gateway Trellix SWG is a security gateway from FireEye USA Trellix. An information disclosure vulnerability exists in Trellix Secure Web Gateway SWG version 12.x prior to 12.2.10 and version 11.x prior to 11.2.24, which stems from a browser bypassing the same-origin policy unde...