CVSS: 8.6EPSS: 0%CPEs: 17EXPL: 0CVE-2018-15388 – Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software WebVPN Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2018-15388
03 May 2019 — A vulnerability in the WebVPN login process of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause increased CPU utilization on an affected device. The vulnerability is due to excessive processing load for existing WebVPN login operations. An attacker could exploit this vulnerability by sending multiple WebVPN login requests to the device. A successful exploit could allow the attacker to increase CPU load... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-sd-cpu-dos • CWE-400: Uncontrolled Resource Consumption •
CVSS: 8.1EPSS: 0%CPEs: 5EXPL: 1CVE-2018-15465 – Cisco Adaptive Security Appliance Software Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2018-15465
24 Dec 2018 — A vulnerability in the authorization subsystem of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, but unprivileged (levels 0 and 1), remote attacker to perform privileged actions by using the web management interface. The vulnerability is due to improper validation of user privileges when using the web management interface. An attacker could exploit this vulnerability by sending specific HTTP requests via HTTPS to an affected device as an unprivileged user. An exploit could al... • http://www.securityfocus.com/bid/106256 • CWE-285: Improper Authorization CWE-863: Incorrect Authorization •
CVSS: 8.6EPSS: 1%CPEs: 9EXPL: 0CVE-2018-15454 – Cisco Adaptive Security Appliance Software and Cisco Firepower Threat Defense Software Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2018-15454
01 Nov 2018 — A vulnerability in the Session Initiation Protocol (SIP) inspection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload or trigger high CPU, resulting in a denial of service (DoS) condition. The vulnerability is due to improper handling of SIP traffic. An attacker could exploit this vulnerability by sending SIP requests designed to specifically trigger this issue at ... • http://www.securityfocus.com/bid/105768 • CWE-20: Improper Input Validation •
CVSS: 7.1EPSS: 0%CPEs: 5EXPL: 0CVE-2018-15397 – Cisco Adaptive Security Appliance IPsec VPN Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2018-15397
05 Oct 2018 — A vulnerability in the implementation of Traffic Flow Confidentiality (TFC) over IPsec functionality in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to restart unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to an error that may occur if the affected software renegotiates the encryption key for an IPsec tunnel when certain TFC traffic is i... • http://www.securitytracker.com/id/1041786 • CWE-320: Key Management Errors •
CVSS: 7.8EPSS: 0%CPEs: 15EXPL: 0CVE-2018-15383 – Cisco Adaptive Security Appliance Direct Memory Access Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2018-15383
05 Oct 2018 — A vulnerability in the cryptographic hardware accelerator driver of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a temporary denial of service (DoS) condition. The vulnerability exists because the affected devices have a limited amount of Direct Memory Access (DMA) memory and the affected software improperly handles resources in low-memory conditions. An a... • http://www.securitytracker.com/id/1041787 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.5EPSS: 97%CPEs: 14EXPL: 11CVE-2018-0296 – Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2018-0296
07 Jun 2018 — A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. It is also possible on certain software releases that the ASA will not reload, but an attacker could view sensitive system information without authentication by using directory traversal techniques. The vulnerability is due to lack of proper input validation of the HTTP URL. An... • https://packetstorm.news/files/id/181032 • CWE-20: Improper Input Validation CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.6EPSS: 0%CPEs: 52EXPL: 0CVE-2018-0240
https://notcve.org/view.php?id=CVE-2018-0240
19 Apr 2018 — Multiple vulnerabilities in the Application Layer Protocol Inspection feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerabilities are due to logical errors during traffic inspection. An attacker could exploit these vulnerabilities by sending a high volume of malicious traffic across an affected devic... • http://www.securityfocus.com/bid/103934 • CWE-399: Resource Management Errors •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2018-0251
https://notcve.org/view.php?id=CVE-2018-0251
19 Apr 2018 — A vulnerability in the Web Server Authentication Required screen of the Clientless Secure Sockets Layer (SSL) VPN portal of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of that portal on an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface of an affected device. An attacker could exploit this vulnerability by persuading a user ... • http://www.securityfocus.com/bid/103926 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.6EPSS: 0%CPEs: 11EXPL: 0CVE-2018-0228
https://notcve.org/view.php?id=CVE-2018-0228
19 Apr 2018 — A vulnerability in the ingress flow creation functionality of Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause the CPU to increase upwards of 100% utilization, causing a denial of service (DoS) condition on an affected system. The vulnerability is due to incorrect handling of an internal software lock that could prevent other system processes from getting CPU cycles, causing a high CPU condition. An attacker could exploit this vulnerability by sending a steady... • http://www.securityfocus.com/bid/104220 • CWE-20: Improper Input Validation CWE-667: Improper Locking •
CVSS: 8.6EPSS: 0%CPEs: 4EXPL: 0CVE-2018-0231
https://notcve.org/view.php?id=CVE-2018-0231
19 Apr 2018 — A vulnerability in the Transport Layer Security (TLS) library of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a reload of the affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a malicious TLS message to an interface enabled for Secure Layer Socket (S... • http://www.securitytracker.com/id/1040725 • CWE-20: Improper Input Validation CWE-787: Out-of-bounds Write •