CVE-2014-2119

The CVE-2014-2119 issue affects Cisco AsyncOS for Email Security Appliance (ESA) and Content Security Management Appliance (SMA). The End User Safelist/Blocklist (SLBL) service permits an authenticated remote user to execute arbitrary code with root privileges by uploading a modified SLBL databas...

CVE-2013-3395

CVE-2013-3395 describes a CSRF flaw in the web framework of Cisco IronPort products (Web Security Appliance, Email Security Appliance, Content Security Management Appliance). The vulnerability allows remote attackers to hijack the authentication of arbitrary users by inducing them to perform unwa...

CVE-2021-1516

CVE-2021-1516 affects Cisco AsyncOS Software on the Cisco Content Security Management Appliance (SMA), Email Security Appliance (ESA), and Web Security Appliance (WSA). Root cause: confidential information is included in HTTP requests exchanged between the user and the device, allowing an authent...

CVE-2014-2195

CVE-2014-2195 affects Cisco AsyncOS on Email Security Appliance (ESA) and Content Security Management Appliance (SMA). When Active Directory is enabled, the software does not properly handle group names, enabling a remote attacker to gain role privileges by exploiting group-name similarity (Bug I...

CVE-2015-0624

Cisco AsyncOS web framework on ESA, SMA, and WSA is vulnerable to an HTTP header injection flaw due to insufficient validation of header values (notably Host/X-Forwarded-Host). A remote attacker can trigger redirects to arbitrary URLs by sending crafted HTTP headers, potentially aided by publicly...

CVE-2013-3396

CVE-2013-3396 is a reflected XSS vulnerability in Cisco Content Security Management Appliance (SMA) web framework. OpenVAS notes Cisco IronPort SMA XSS/CSRF issues, with CVE-2013-3396 listed and the OpenVAS payload pointing to a lack of output escaping in the default error 500 page, causing refle...

CVE-2013-5537

The CVE-2013-5537 issue affects Cisco Web Security Appliance (WSA), Email Security Appliance (ESA), and Content Security Management Appliance (SMA). The web framework does not properly manage HTTP/HTTPS session state, allowing an unauthenticated remote attacker to cause a denial of service (manag...

CVE-2018-15393

The CVE-2018-15393 issue affects Cisco Content Security Management Appliance (SMA) via the web-based management interface. The root cause is insufficient validation of user-supplied input, enabling an unauthenticated, remote attacker to lure a user into clicking a malicious link and execute arbit...

CVE-2014-3289

CVE-2014-3289 is a reflected XSS vulnerability in Cisco AsyncOS used by ESA, WSA, and SMA. The issue stems from insufficient input validation of the date_range parameter on the web management interface (notably monitor/reports/overview). A remote attacker can inject arbitrary script by tricking a...