Avirt Mail 4.0/4.2 'Mail From:' and 'Rcpt to:' DoS Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1825/info Due to insufficient bounds checking in the code that handles the fields 'MAIL FROM:' and 'RCPT TO:', it is possible to remotely crash Avirt Mail. Entering over 272 characters into the 'RCPT TO:' field will crash...

CVE-2014-3289

CVE-2014-3289 is a reflected XSS vulnerability in Cisco AsyncOS used by ESA, WSA, and SMA. The issue stems from insufficient input validation of the date_range parameter on the web management interface (notably monitor/reports/overview). A remote attacker can inject arbitrary script by tricking a...

CVE-2014-2137

CRLF injection vulnerability in the web framework in Cisco Web Security Appliance WSA 7.7 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks via a crafted URL, aka Bug ID CSCuj61002...

Crlf injection

CRLF injection vulnerability in the web framework in Cisco Web Security Appliance WSA 7.7 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks via a crafted URL, aka Bug ID CSCuj61002...

CVE-2014-2137

Cisco Web Security Appliance (WSA) 7.x and 8.x are affected by a CRLF injection vulnerability in the web framework. The root cause is insufficient validation of input used as HTTP header values, allowing remote attackers to inject arbitrary headers and perform redirection attacks via crafted URLs...

Cisco WSA HTTP Header Injection Vulnerability

A vulnerability in the web framework of Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to inject a crafted HTTP header that could cause a web page redirection to a possible malicious website. The vulnerability is due to insufficient validation of user input befor...

CVE-2013-5537

The CVE-2013-5537 issue affects Cisco Web Security Appliance (WSA), Email Security Appliance (ESA), and Content Security Management Appliance (SMA). The web framework does not properly manage HTTP/HTTPS session state, allowing an unauthenticated remote attacker to cause a denial of service (manag...

CVE-2013-5537

The web framework on Cisco Web Security Appliance WSA, Email Security Appliance ESA, and Content Security Management Appliance SMA devices does not properly manage the state of HTTP and HTTPS sessions, which allows remote attackers to cause a denial of service management GUI outage via multiple T...

Cisco Ironport Bruteforce Login Utility

This module scans for Cisco Ironport SMA, WSA and ESA web login portals, finds AsyncOS versions, and performs login brute force to identify valid credentials. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

Cisco Web Security Appliance Version

The remote host is running Cisco Web Security Appliance WSA, a web gateway security appliance. It is possible to get the WSA version number via SSH or HTTP. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid69081; scriptversion"1.11";...

CVE-2013-3395

CVE-2013-3395 describes a CSRF flaw in the web framework of Cisco IronPort products (Web Security Appliance, Email Security Appliance, Content Security Management Appliance). The vulnerability allows remote attackers to hijack the authentication of arbitrary users by inducing them to perform unwa...

Cisco IronPort Web Security Appliance basicConstraints Parameter Processing Man-in-the-Middle Vulnerability

Cisco IronPort Web Security Appliance WSA software contains a vulnerability that could allow an unauthenticated, remote attacker to conduct man-in-the-middle attacks against a targeted system. The vulnerability is in the insecure SSL implementation of the affected operating system due to improper...

CVE-2010-4690

The Mobile User Security MUS service on Cisco Adaptive Security Appliances ASA 5500 series devices with software before 8.32 does not properly authenticate HTTP requests from a Web Security appliance WSA, which might allow remote attackers to obtain sensitive information via a HEAD request, aka B...