CVE-2025-20393

CVE-2025-20393 affects Cisco AsyncOS Software on Cisco Secure Email Gateway (SEG) and Cisco Secure Email and Web Manager (SEWM) appliances. The vulnerability stems from improper input validation in the Spam Quarantine feature, allowing unauthenticated remote attackers to execute arbitrary command...

CVE-2022-20653

Cisco ESA/DNS Verification DoS (CVE-2022-20653) affects Cisco AsyncOS for Email Security Appliance. Root cause: insufficient DNS name-resolution error handling in the DANE email verification component, enabling unauthenticated remote DoS via specially formatted emails. Impact: device can become u...

CVE-2022-20781

The CVE-2022-20781 issue affects Cisco AsyncOS Software for Cisco Web Security Appliance (WSA). The web-based management interface fails to properly validate user-supplied input, allowing an authenticated, remote attacker to inject malicious data into a specific field and trigger a stored cross-s...

CVE-2021-34741

Cisco Email Security Appliance (ESA) with Cisco AsyncOS contains a DoS vulnerability due to insufficient validation of incoming emails in the email scanning algorithm. An unauthenticated attacker could exhaust CPU resources by sending a crafted email, causing DoS. Public advisories from Cisco doc...

CVE-2018-15460

CVE-2018-15460 affects Cisco AsyncOS Software for Cisco Email Security Appliances (ESA). The flaw is in the email message filtering feature, caused by improper filtering of messages that reference whitelisted URLs. An unauthenticated, remote attacker can send a malicious email containing a large ...

CVE-2021-1425

The CVE-2021-1425 issue affects Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA)/Email Security Appliance (ESA). It enables an authenticated, remote attacker to view confidential information by inspecting raw HTTP requests exchanged with the web-based management interf...

CVE-2022-20942

CVE-2022-20942 concerns information disclosure in Cisco Email Security Appliance (ESA), Cisco Secure Email and Web Manager, and Cisco Secure Web Appliance (formerly WSA). The issue stems from weak enforcement of back-end authorization checks, allowing an authenticated, remote attacker to obtain s...

CVE-2019-1983

CVE-2019-1983 affects Cisco AsyncOS for ESA and SMA. The vulnerability stems from insufficient input validation of email attachments in the email message filtering feature, allowing an unauthenticated, remote attacker to cause repeated crashes of internal processes, resulting in a DoS and unavail...

CVE-2020-3368

The CVE affects Cisco AsyncOS on the Cisco Email Security Appliance (ESA), where an input-validation weakness allows an unauthenticated, remote attacker to bypass URL reputation filters by crafting a URL. The root cause is insufficient URL input validation. Impact is bypass of URL filtering, enab...

CVE-2020-26082

CVE-2020-26082 derives from Cisco AsyncOS (ESA) ’s zip decompression engine, where improper handling of password-protected zip files allows an unauthenticated, remote attacker to bypass configured content filters. The issue affects Cisco Email Security Appliance (ESA) running affected AsyncOS ver...

CVE-2024-20258

Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gateway has a web-based management interface vulnerability that enables cross-site scripting (XSS) due to insufficient input validation. An unauthenticated, remote attacker could lure a user to click a crafted link, al...

CVE-2024-20383

Cisco Secure Email and Web Manager (Cisco AsyncOS) web-based management interface is affected by a stored XSS vulnerability due to insufficient input validation. An authenticated, remote attacker can lure a user to click a crafted link, potentially executing arbitrary script code in the interface...

CVE-2020-3367

The CVE-2020-3367 issue affects Cisco AsyncOS for the Cisco Secure Web Appliance (WSA). It targets the log subscription subsystem where insufficient validation of user-supplied input enables an authenticated, local attacker to inject commands via the web interface or CLI and elevate to root. Impa...

CVE-2021-1566

CVE-2021-1566 affects Cisco Email Security Appliance (ESA) and Cisco Web Security Appliance (WSA) due to improper TLS certificate validation in the AMP for Endpoints integration (AsyncOS). A remote, unauthenticated attacker could perform a man-in-the-middle to intercept traffic between the device...

CVE-2021-1534

CVE-2021-1534 : A vulnerability in Cisco AsyncOS for Cisco Email Security Appliance (ESA) allows an unauthenticated, remote attacker to bypass URL reputation filters by exploiting improper URL processing. Affected product: Cisco ESA/AsyncOS. Impact: bypass of URL filtering, enabling malicious URL...