Cisco Web Security Appliance FTP Authentication Bypass Vulnerability

A vulnerability in the FTP server of the Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to log in to the FTP server of the device without a valid password. The attacker does need to have a valid username. The vulnerability is due to incorrect FTP user credential...

CVE-2018-0093

A vulnerability in the web-based management interface of Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due to...

CVE-2018-0093

CVE-2018-0093 affects Cisco Web Security Appliance (WSA) and is a reflected XSS in the web-based management interface caused by insufficient input validation. An unauthenticated, remote attacker could lure a user to click a crafted link, enabling execution of script code in the interface context ...

CVE-2018-0093

A vulnerability in the web-based management interface of Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due to...

CVE-2017-12303

A vulnerability in the Advanced Malware Protection AMP file filtering feature of Cisco AsyncOS Software for Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to bypass a configured AMP file filtering rule. The file types affected are zipped or archived file types. T...

CVE-2017-12303

Cisco AsyncOS (WSA) AMP file filtering vulnerability (CVE-2017-12303): a mismatch in file hash values allows an unauthenticated remote attacker to bypass the AMP file filter by sending a crafted email attachment. Affects Cisco Web Security Appliance with AsyncOS; exploitation is through ZIP/archi...

Cisco Web Security Appliance Multiple Vulnerabilities

According to its self-reported version, the remote Cisco Web Security Appliance WSA device is affected by one or more vulnerabilities : - An unspecified flaw exists in the web-based interface due to improper validation of user-supplied input. An authenticated, remote attacker who has valid...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the web-based management interface of an affected device. Affected Products: virtual and...

CVE-2017-6748

A vulnerability in the CLI parser of the Cisco Web Security Appliance WSA could allow an authenticated, local attacker to perform command injection and elevate privileges to root. The attacker must authenticate with valid operator-level or administrator-level credentials. Affected Products: virtu...

Command injection

A vulnerability in the CLI parser of the Cisco Web Security Appliance WSA could allow an authenticated, local attacker to perform command injection and elevate privileges to root. The attacker must authenticate with valid operator-level or administrator-level credentials. Affected Products: virtu...

CVE-2017-6746

The CVE-2017-6746 entry describes a command-injection and root-privilege escalation vulnerability in the web interface of Cisco Web Security Appliance (WSA) running Cisco AsyncOS. Impact requires an authenticated administrator, and the flaw allows remote command execution with root privileges via...

CVE-2017-6751

Cisco Web Security Appliance (WSA) is affected (virtual and hardware). The issue is a web proxy bypass where traffic forwarded from the web proxy interface to the administrative management interface is not denied, enabling an unauthenticated remote attacker to reach the admin interface (Access Co...

CVE-2017-6749

CVE-2017-6749 describes a stored cross-site scripting (XSS) vulnerability in the Cisco Web Security Appliance (WSA) web-based management interface. An authenticated, remote attacker can exploit this by convincing a user to follow a crafted link, triggering script execution in the user’s browser s...

CVE-2017-6748

A vulnerability in the CLI parser of the Cisco Web Security Appliance WSA could allow an authenticated, local attacker to perform command injection and elevate privileges to root. The attacker must authenticate with valid operator-level or administrator-level credentials. Affected Products: virtu...

CVE-2017-6748

Cisco Web Security Appliance (WSA) CLI parser vulnerability CVE-2017-6748 enables an authenticated, local attacker with operator/administrator credentials to inject commands and elevate to root. Affected: virtual and hardware WSA platforms. Root cause: insufficient validation in the CLI parser al...

CVE-2017-6750

Cisco Web Security Appliance AsyncOS is affected by CVE-2017-6750 due to a default/static password on a user account. This permits an unauthenticated remote attacker to log in to the web GUI with elevated access, or an unauthenticated/remote attacker to authenticate areas of the GUI, as described...

Cisco Web Security Appliance Administrative Interface Access Control Bypass Vulnerability

A vulnerability in the web proxy functionality of the Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to forward traffic from the web proxy interface of an affected device to the administrative management interface of an affected device. The vulnerability exists...

Cisco Web Security Appliance Authenticated Command Injection and Privilege Escalation Vulnerability

A vulnerability in the CLI parser of the Cisco Web Security Appliance WSA could allow an authenticated, local attacker to perform command injection and elevate privileges to root. The attacker must authenticate with valid operator-level or administrator-level credentials. The vulnerability is due...

wsa-eshop.org XSS vulnerability

Open Bug Bounty ID: OBB-219141 Description| Value ---|--- Affected Website:| wsa-eshop.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2017-3827

A vulnerability in the Multipurpose Internet Mail Extensions MIME scanner of Cisco AsyncOS Software for Cisco Email Security Appliances ESA and Web Security Appliances WSA could allow an unauthenticated, remote attacker to bypass configured user filters on the device. Affected Products: This...