CVE-2018-0428

CVE-2018-0428 is a Cisco Web Security Appliance (WSA) elevation-of-privilege vulnerability in the account management subsystem. An authenticated local attacker with valid admin credentials can bypass access controls to elevate to root, escape the CLI subshell, and run system-level commands. The r...

CVE-2018-0428

A vulnerability in the account management subsystem of Cisco Web Security Appliance WSA could allow an authenticated, local attacker to elevate privileges to root. The attacker must authenticate with valid administrator credentials. The vulnerability is due to improper implementation of access...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due to...

CVE-2018-0366

CVE-2018-0366 affects Cisco Web Security Appliance (WSA) and concerns a reflected cross-site scripting (XSS) vulnerability in the web-based management interface caused by insufficient input validation. An unauthenticated, remote attacker could lure a user to click a crafted link, resulting in arb...

CVE-2018-0353

A vulnerability in traffic-monitoring functions in Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to circumvent Layer 4 Traffic Monitor L4TM functionality and bypass security protections. The vulnerability is due to a change in the underlying operating system...

CVE-2018-0353

CVE-2018-0353 affects Cisco Web Security Appliance (WSA) AsyncOS, where a vulnerability in the L4 Traffic Monitor (L4TM) can be exploited by unauthenticated remote attackers to bypass L4TM protections. The issue stems from a change in the underlying OS used to monitor traffic, and is applicable t...

WebKitGTK+ Memory Corruption / Code Execution Vulnerability

Exploit for windows platform in category dos / poc ------------------------------------------------------------------------ WebKitGTK+ Security Advisory WSA-2018-0004 ------------------------------------------------------------------------ Date reported : May 07, 2018 Advisory ID : WSA-2018-0004...

Cisco Web Security Appliance FTP Authentication Bypass Vulnerability

According to its self-reported version, the remote Cisco Web Security Appliance WSA device is affected by a FTP authentication bypass vulnerability, due to inccorect validation of credentials. A remote attacker could potentially log into the FTP server without a valid password. TRUSTED...

CVE-2018-0087

A vulnerability in the FTP server of the Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to log in to the FTP server of the device without a valid password. The attacker does need to have a valid username. The vulnerability is due to incorrect FTP user credential...

CVE-2018-0087

CVE-2018-0087 affects Cisco Web Security Appliance (WSA) via an FTP authentication bypass. Affects AsyncOS for WSA on virtual/hardware appliances running AsyncOS 10.5.1; vulnerability arises from incorrect FTP credential validation. If FTP is enabled on the management interface, an unauthenticate...

CVE-2018-0087

A vulnerability in the FTP server of the Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to log in to the FTP server of the device without a valid password. The attacker does need to have a valid username. The vulnerability is due to incorrect FTP user credential...

Cisco Web Security Appliance FTP Authentication Bypass Vulnerability

A vulnerability in the FTP server of the Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to log in to the FTP server of the device without a valid password. The attacker does need to have a valid username. The vulnerability is due to incorrect FTP user credential...

CVE-2018-0093

A vulnerability in the web-based management interface of Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due to...

CVE-2018-0093

CVE-2018-0093 affects Cisco Web Security Appliance (WSA) and is a reflected XSS in the web-based management interface caused by insufficient input validation. An unauthenticated, remote attacker could lure a user to click a crafted link, enabling execution of script code in the interface context ...

CVE-2018-0093

A vulnerability in the web-based management interface of Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due to...

CVE-2017-12303

A vulnerability in the Advanced Malware Protection AMP file filtering feature of Cisco AsyncOS Software for Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to bypass a configured AMP file filtering rule. The file types affected are zipped or archived file types. T...

CVE-2017-12303

Cisco AsyncOS (WSA) AMP file filtering vulnerability (CVE-2017-12303): a mismatch in file hash values allows an unauthenticated remote attacker to bypass the AMP file filter by sending a crafted email attachment. Affects Cisco Web Security Appliance with AsyncOS; exploitation is through ZIP/archi...

Cisco Web Security Appliance Multiple Vulnerabilities

According to its self-reported version, the remote Cisco Web Security Appliance WSA device is affected by one or more vulnerabilities : - An unspecified flaw exists in the web-based interface due to improper validation of user-supplied input. An authenticated, remote attacker who has valid...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the web-based management interface of an affected device. Affected Products: virtual and...

Command injection

A vulnerability in the CLI parser of the Cisco Web Security Appliance WSA could allow an authenticated, local attacker to perform command injection and elevate privileges to root. The attacker must authenticate with valid operator-level or administrator-level credentials. Affected Products: virtu...