CVE-2020-3117

CVE-2020-3117 affects Cisco AsyncOS API Framework in Cisco Web Security Appliance (WSA) and Cisco Content Security Management Appliance (SMA). The vulnerability allows an unauthenticated, remote attacker to inject arbitrary HTTP headers into HTTP responses due to insufficient validation of user i...

Cisco ESA, Cisco WSA, and Cisco SMA GUI Denial of Service Vulnerability

A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Email Security Appliance ESA, Cisco Web Security Appliance WSA, and Cisco Content Security Management Appliance SMA could allow an unauthenticated remote attacker to cause high CPU usage on an affected device,...

Cisco Web Security Appliance Decryption Policy Bypass Vulnerability (cisco-sa-20190206-wsa-bypass)

According to its self-reported version, Cisco Web Security Appliance WSA is affected by a decryption policy bypass vulnerability. An unauthenticated, remote attacker can bypass a configured drop policy and allow unauthorized traffic onto the network. Please see the included Cisco BIDs and Cisco...

Fedora 30 : webkit2gtk3 (2020-f11a905fc2)

Fix issues while trying to play a video on NextCloud. - Make sure the GL video sink uses a valid WebKit shared GL context. - Fix vertical alignment of text containing arabic diacritics. - Fix build with icu 65.1. - Fix page loading errors with websites using HSTS. - Fix web process crash when...

Cisco Web Security Appliance HTTP Header Injection Vulnerability

According to its self-reported version, Cisco Web Security Appliance WSA is affected by a HTTP Header Injection vulnerability. Please see the included Cisco BIDs and the Cisco Security Advisory for more information. TRUSTED...

CVE-2012-1316

Cisco IronPort Web Security Appliance does not check for certificate revocation which could lead to MITM attacks...

CVE-2012-1326

Cisco IronPort Web Security Appliance up to and including 7.5 does not validate the basic constraints of the certificate authority which could lead to MITM attacks...

CVE-2012-1326

CVE-2012-1326 affects Cisco IronPort Web Security Appliance (WSA) up to and including version 7.5, where the software does not properly validate the basic constraints of the certificate authority in SSL/TLS. This misconfiguration could allow an unauthenticated, remote attacker to perform man‑in‑t...

Security update for webkit2gtk3 (important)

openSUSE Security Update: Security update for webkit2gtk3 Announcement ID: openSUSE-SU-2019:2587-1 Rating: important References: 1155321 1156318 Cross-References: CVE-2019-8551 CVE-2019-8558 CVE-2019-8559 CVE-2019-8563 CVE-2019-8625 CVE-2019-8674 CVE-2019-8681 CVE-2019-8684 CVE-2019-8686...

SUSE SLED15 / SLES15 Security Update : webkit2gtk3 (SUSE-SU-2019:3044-1)

This update for webkit2gtk3 to version 2.26.2 fixes the following issues : Webkit2gtk3 was updated to version 2.26.2 WSA-2019-0005 and WSA-2019-0006, bsc1155321 bsc1156318 Security issues addressed : CVE-2019-8625: Fixed a logic issue where by processing maliciously crafted web content may lead t...

Debian DSA-4515-1 : webkit2gtk - security update

Several vulnerabilities have been discovered in the webkit2gtk web engine : - CVE-2019-8644 G. Geshev discovered memory corruption issues that can lead to arbitrary code execution. - CVE-2019-8649 Sergei Glazunov discovered an issue that may lead to universal cross site scripting. - CVE-2019-8658...

Cisco Web Security Appliance HTTPS Certificate Denial of Service Vulnerability

According to its self-reported version, Cisco Web Security Appliance WSA is affected by a denial of service vulnerability in the HTTPS decryption feature of WSA due to insufficient validation. An unauthenticated, remote attacker can exploit this, by installing a malformed certificate in a web...

CVE-2019-1884 Cisco Web Security Appliance Web Proxy Denial of Service Vulnerability

A vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient input validation mechanisms for...

CVE-2019-1886

The CVE-2019-1886 entry describes a DoS in Cisco Web Security Appliance (WSA) due to insufficient validation of SSL server certificates in the HTTPS decryption feature. Attackers can remotely exploit by presenting a malformed certificate to a web server, sent through WSA, to trigger an unexpected...

CVE-2019-1886 Cisco Web Security Appliance HTTPS Certificate Denial of Service Vulnerability

A vulnerability in the HTTPS decryption feature of Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to insufficient validation of Secure Sockets Layer SSL server certificates. An attacker could...

CVE-2019-1816

The CVE-2019-1816 issue affects Cisco Web Security Appliance (WSA). Affected component: log subscription subsystem; root cause is insufficient validation of user-supplied input on web and CLI interfaces. Exploitation scenario: an authenticated, local attacker can inject scripts/commands within th...

CVE-2019-1672

CVE-2019-1672 describes a vulnerability in the Cisco Web Security Appliance (WSA) where the Decryption Policy Default Action handling allows an unauthenticated, remote attacker to bypass a configured drop policy and permit SSL traffic that should have been denied. The root cause is the incorrect ...

CVE-2019-1672 Cisco Web Security Appliance Decryption Policy Bypass Vulnerability

A vulnerability in the Decryption Policy Default Action functionality of the Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to bypass a configured drop policy and allow traffic onto the network that should have been denied. The vulnerability is due to the incorre...

Pylocky Unlocked: Cisco Talos releases PyLocky ransomware decryptor

This tool was developed by Mike Bautista. PyLocky is a family of ransomware written in Python that attempts to masquerade as a Locky variant. This ransomware will encrypt all files on a victim machine before demanding that the user pay a ransom to gain access to their decrypted files. To combat...

Design/Logic Flaw

A vulnerability in the account management subsystem of Cisco Web Security Appliance WSA could allow an authenticated, local attacker to elevate privileges to root. The attacker must authenticate with valid administrator credentials. The vulnerability is due to improper implementation of access...