CVE-2015-6288: Undefined Security Weakness

Cisco Content Security Management Appliance SMA 7.8.0-000 does not properly validate credentials, which allows remote attackers to cause a denial of service rapid log-file rollover and application fault via crafted HTTP requests, aka Bug ID CSCuw09620...

Wolf CMS - Arbitrary File Upload Execution

Wolf CMS - Arbitrary File Upload Execution Exploit Title : Wolf CMS 0.8.2 Arbitrary File Upload To Command Execution Reported Date : 05-May-2015 Fixed Date : 10-August-2015 Exploit Author : Narendra Bhati CVE ID : CVE-2015-6567 , CVE-2015-6568 Contact: Facebook :...

Authentication flaw

Cisco Content Security Management Appliance SMA 8.3.6-039, 9.1.0-31, and 9.1.0-103 improperly restricts the privileges available after LDAP authentication, which allows remote authenticated users to read or write to an arbitrary user's Spam Quarantine folder by visiting a spam-notification URL, a...

CVE-2015-4322

Cisco Content Security Management Appliance SMA 8.3.6-039, 9.1.0-31, and 9.1.0-103 improperly restricts the privileges available after LDAP authentication, which allows remote authenticated users to read or write to an arbitrary user's Spam Quarantine folder by visiting a spam-notification URL, a...

PT-2015-6518

Name of the Vulnerable Software and Affected Versions Cisco Content Security Management Appliance SMA versions 8.3.6-039, 9.1.0-31, 9.1.0-103 Description The issue improperly restricts privileges after LDAP authentication, allowing remote authenticated users to access an arbitrary user's Spam...

CVE-2015-4322: Undefined Security Weakness

Cisco Content Security Management Appliance SMA 8.3.6-039, 9.1.0-31, and 9.1.0-103 improperly restricts the privileges available after LDAP authentication, which allows remote authenticated users to read or write to an arbitrary user's Spam Quarantine folder by visiting a spam-notification URL, a...

Cross site scripting

Cross-site scripting XSS vulnerability in Cisco AsyncOS on the Web Security Appliance WSA 9.0.0-193; Email Security Appliance ESA 8.5.6-113, 9.1.0-032, 9.1.1-000, and 9.6.0-000; and Content Security Management Appliance SMA 9.1.0-033 allows remote attackers to inject arbitrary web script or HTML...

CVE-2015-0732

Cross-site scripting XSS vulnerability in Cisco AsyncOS on the Web Security Appliance WSA 9.0.0-193; Email Security Appliance ESA 8.5.6-113, 9.1.0-032, 9.1.1-000, and 9.6.0-000; and Content Security Management Appliance SMA 9.1.0-033 allows remote attackers to inject arbitrary web script or HTML...

Design/Logic Flaw

The LDAP implementation on the Cisco Web Security Appliance WSA 8.5.0-000, Email Security Appliance ESA 8.5.7-042, and Content Security Management Appliance SMA 8.3.6-048 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain...

CVE-2015-0732

Cross-site scripting XSS vulnerability in Cisco AsyncOS on the Web Security Appliance WSA 9.0.0-193; Email Security Appliance ESA 8.5.6-113, 9.1.0-032, 9.1.1-000, and 9.6.0-000; and Content Security Management Appliance SMA 9.1.0-033 allows remote attackers to inject arbitrary web script or HTML...

CVE-2015-4288

The LDAP implementation on the Cisco Web Security Appliance WSA 8.5.0-000, Email Security Appliance ESA 8.5.7-042, and Content Security Management Appliance SMA 8.3.6-048 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain...

CVE-2015-4288

CVE-2015-4288 affects Cisco Web Security Appliance (WSA) 8.5.0-000, Email Security Appliance (ESA) 8.5.7-042, and Content Security Management Appliance (SMA) 8.3.6-048. The LDAP server in these devices does not verify X.509 certificates from SSL servers, enabling a man-in-the-middle attacker to s...

PT-2015-6501

Name of the Vulnerable Software and Affected Versions Cisco Web Security Appliance WSA version 8.5.0-000 Cisco Email Security Appliance ESA version 8.5.7-042 Cisco Content Security Management Appliance SMA version 8.3.6-048 Description The issue concerns the LDAP implementation, which fails to...

CVE-2015-0732: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Cisco AsyncOS on the Web Security Appliance WSA 9.0.0-193; Email Security Appliance ESA 8.5.6-113, 9.1.0-032, 9.1.1-000, and 9.6.0-000; and Content Security Management Appliance SMA 9.1.0-033 allows remote attackers to inject arbitrary web script or HTML...

CVE-2015-4288: Undefined Security Weakness

The LDAP implementation on the Cisco Web Security Appliance WSA 8.5.0-000, Email Security Appliance ESA 8.5.7-042, and Content Security Management Appliance SMA 8.3.6-048 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain...

Cisco Virtual WSA/ESA/SMA remote-support feature default SSH host key vulnerability

The Cisco Web Security Virtual Appliance WSAv, Email Security Virtual Appliance ESAv, and Security Management Virtual Appliance SMAv are products of the Cisco Corporation. Cisco WSAv is a software version of the Web Security Appliance WSA, ESAv is a software version of the Email Security Applianc...

Cisco Virtual WSA/ESA/SMA Default Authorization SSH Key Vulnerability

The Cisco Web Security Virtual Appliance WSAv, Email Security Virtual Appliance ESAv, and Security Management Virtual Appliance SMAv are products of the Cisco Corporation. Cisco WSAv is a software version of the Web Security Appliance WSA, ESAv is a software version of the Email Security Applianc...

A large number of Cisco security devices was traced to the presence of a default SSH key-vulnerability warning-the black bar safety net

! Cisco revealed that a large number of Cisco security devices was traced to the presence of a default SSH key, an attacker can use this vulnerability to control the device. The scope of the impact Cisco's security experts found that a lot of Cisco security devices in the presence of a default SS...

CVE-2015-4217

The remote-support feature on Cisco Web Security Virtual Appliance WSAv, Email Security Virtual Appliance ESAv, and Security Management Virtual Appliance SMAv devices before 2015-06-25 uses the same default SSH host keys across different customers' installations, which makes it easier for remote...

CVE-2015-4216

The CVE concerns Cisco WSAv/ESAv/SMAv devices where the remote-support feature uses the same default SSH root authorized key across different customer installations, enabling an attacker with knowledge of a private key from another installation to bypass authentication. Affected products are Cisc...