CVE-2015-4288

The LDAP implementation on the Cisco Web Security Appliance WSA 8.5.0-000, Email Security Appliance ESA 8.5.7-042, and Content Security Management Appliance SMA 8.3.6-048 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain...

CVE-2015-0732

Summary: CVE-2015-0732 is a cross-site scripting (XSS) vulnerability affecting Cisco AsyncOS on Web Security Appliance (WSA) 9.0.0-193; Email Security Appliance (ESA) 8.5.6-113, 9.1.0-032, 9.1.1-000, 9.6.0-000; and Content Security Management Appliance (SMA) 9.1.0-033. The issue arises from insuf...

PT-2015-4847

Name of the Vulnerable Software and Affected Versions Cisco AsyncOS on the Web Security Appliance WSA version 9.0.0-193 Cisco Email Security Appliance ESA versions 8.5.6-113, 9.1.0-032, 9.1.1-000, and 9.6.0-000 Cisco Content Security Management Appliance SMA version 9.1.0-033 Description A...

Cisco Virtual WSA / ESA / SMA default keys

Default ssh keys are installed...

Cisco Virtual WSA, ESA, and SMA Default SSH Host Keys Vulnerability

A vulnerability in the remote support functionality of Cisco WSAv, Cisco ESAv, and Cisco SMAv Software could allow an unauthenticated, remote attacker to decrypt and impersonate secure communication between any virtual content security appliances. The vulnerability is due to the presence of...

CVE-2015-4198

Cross-site scripting XSS vulnerability in the web framework on Cisco Web Security Appliance WSA devices with software 8.5.0-497 allows remote attackers to inject arbitrary web script or HTML via an unspecified HTTP header, aka Bug ID CSCuu24409...

CVE-2015-4198

Cisco Web Security Appliance (WSA) WEB FRAMEWORK HTTP HEADER INJECTION: An unauthenticated remote attacker could craft an HTTP header to inject arbitrary HTML/script into the browser via the WSA web interface. Root cause: insufficient validation of header value used in responses. Affected product...

PT-2015-6454

Name of the Vulnerable Software and Affected Versions Cisco Web Security Appliance WSA versions 8.5.0-497 Description A cross-site scripting XSS issue exists in the web framework, allowing remote attackers to inject arbitrary web script or HTML via an unspecified HTTP header. Recommendations For...

CVE-2015-0738

Cisco Web Security Appliance (WSA) Web Tracking Report page (version 8.5.0-497) contains a cross-site scripting (XSS) vulnerability due to improper validation of user-supplied input on a field. An unauthenticated, remote attacker could inject arbitrary script in the vulnerable page, potentially a...

PT-2015-4853

Name of the Vulnerable Software and Affected Versions Cisco Web Security Appliance WSA versions 8.5.0-497 Description A cross-site scripting XSS issue exists in the Web Tracking Report page, allowing remote attackers to inject arbitrary web script or HTML via an unspecified field. Recommendations...

CVE-2015-0693

Cisco Web Security Appliance WSA devices with software 8.5.0-ise-147 do not properly restrict use of the pickle Python module during certain tunnel-status checks, which allows local users to execute arbitrary Python code and gain privileges via a crafted pickle file, aka Bug ID CSCut39259...

CVE-2015-0693

Cisco Web Security Appliance WSA devices with software 8.5.0-ise-147 do not properly restrict use of the pickle Python module during certain tunnel-status checks, which allows local users to execute arbitrary Python code and gain privileges via a crafted pickle file, aka Bug ID CSCut39259...

CVE-2015-0698

CVE-2015-0698 affects Cisco Web Security Appliance (WSA) admin web pages with software 8.5.0-497, via multiple XSS in filter search forms. Root cause: insufficient input validation in the filter/search form handling. Impact: remote attackers can inject arbitrary scripts via a crafted URL without ...

CVE-2015-0693

CVE-2015-0693 affects Cisco Web Security Appliance (WSA) devices running 8.5.0-ise-147, where improper handling of the pickle module during tunnel-status checks allows an authenticated, local attacker to execute arbitrary Python code and elevate privileges via a crafted pickle file (Bug CSCut3925...

PT-2015-4815

Name of the Vulnerable Software and Affected Versions Cisco Web Security Appliance WSA version 8.5.0-ise-147 Description The issue is related to the improper restriction of the pickle Python module during tunnel-status checks, allowing local users to execute arbitrary Python code and gain...

PT-2015-4820

Name of the Vulnerable Software and Affected Versions Cisco Web Security Appliance WSA versions 8.5.0-497 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in filter search forms on admin web pages. These vulnerabilities allow remote attackers to inject arbitrary we...

CVE-2015-0693: Improper Input Validation

Cisco Web Security Appliance WSA devices with software 8.5.0-ise-147 do not properly restrict use of the pickle Python module during certain tunnel-status checks, which allows local users to execute arbitrary Python code and gain privileges via a crafted pickle file, aka Bug ID CSCut39259...

CVE-2015-0692

Cisco Web Security Appliance (WSA) devices running software 8.5.0-ise-147 are affected by CVE-2015-0692 due to improper restriction of the pickle module during certain tunnel-status checks. The vulnerability allows an authenticated, local attacker to execute arbitrary Python code and gain privile...

CVE-2015-0692: Undefined Security Weakness

Cisco Web Security Appliance WSA devices with software 8.5.0-ise-147 do not properly restrict use of the pickle Python module during certain tunnel-status checks, which allows local users to execute arbitrary Python code and gain privileges via crafted serialized objects, aka Bug ID CSCut39230...

PT-2015-4814

Name of the Vulnerable Software and Affected Versions Cisco Web Security Appliance WSA version 8.5.0-ise-147 Description The issue is related to the improper restriction of the pickle Python module during tunnel-status checks, allowing local users to execute arbitrary Python code and gain...