CVSS: 5.8EPSS: 0%CPEs: 4EXPL: 0CVE-2018-0283
https://notcve.org/view.php?id=CVE-2018-0283
02 May 2018 — A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to restart an instance of the Snort detection engine on an affected device, resulting in a brief denial of service (DoS) condition. The vulnerability is due to the incorrect handling of Transport Layer Security (TLS) TCP connection setup for the affected software. An attacker could exploit this vulnerability by sending crafted TLS traffic to an affected device. A successful exploit coul... • http://www.securityfocus.com/bid/104121 • CWE-310: Cryptographic Issues CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 5.8EPSS: 0%CPEs: 5EXPL: 0CVE-2018-0281
https://notcve.org/view.php?id=CVE-2018-0281
02 May 2018 — A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to restart an instance of the Snort detection engine on an affected device, resulting in a brief denial of service (DoS) condition. The vulnerability is due to the incorrect handling of a Transport Layer Security (TLS) extension during TLS connection setup for the affected software. An attacker could exploit this vulnerability by sending a crafted TLS connection setup request to an affe... • http://www.securityfocus.com/bid/104096 • CWE-310: Cryptographic Issues CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-0278
https://notcve.org/view.php?id=CVE-2018-0278
02 May 2018 — A vulnerability in the management console of Cisco Firepower System Software could allow an unauthenticated, remote attacker to access sensitive data about the system. The vulnerability is due to improper cross-origin domain protections for the WebSocket protocol. An attacker could exploit this vulnerability by convincing a user to visit a malicious website designed to send requests to the affected application while the user is logged into the application with an active session cookie. A successful exploit ... • http://www.securityfocus.com/bid/104122 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-863: Incorrect Authorization •
CVSS: 8.6EPSS: 0%CPEs: 5EXPL: 0CVE-2018-0233
https://notcve.org/view.php?id=CVE-2018-0233
19 Apr 2018 — A vulnerability in the Secure Sockets Layer (SSL) packet reassembly functionality of the detection engine in Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause the detection engine to consume excessive system memory on an affected device, which could cause a denial of service (DoS) condition. The vulnerability is due to the affected software improperly handling changes to SSL connection states. An attacker could exploit this vulnerability by sending crafted SSL connecti... • http://www.securityfocus.com/bid/103930 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.8EPSS: 0%CPEs: 4EXPL: 0CVE-2017-12300
https://notcve.org/view.php?id=CVE-2017-12300
16 Nov 2017 — A vulnerability in the SNORT detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a file policy that is configured to block the Server Message Block Version 2 (SMB2) protocol. The vulnerability is due to the incorrect detection of an SMB2 file when the detection is based on the length of the file. An attacker could exploit this vulnerability by sending a crafted SMB2 transfer request through the targeted device. A successful exploit could allow the at... • http://www.securityfocus.com/bid/101862 • CWE-20: Improper Input Validation •
CVSS: 8.6EPSS: 0%CPEs: 9EXPL: 0CVE-2017-12245
https://notcve.org/view.php?id=CVE-2017-12245
05 Oct 2017 — A vulnerability in SSL traffic decryption for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause depletion of system memory, aka a Firepower Detection Engine SSL Decryption Memory Consumption Denial of Service vulnerability. If this memory leak persists over time, a denial of service (DoS) condition could develop because traffic can cease to be forwarded through the device. The vulnerability is due to an error in how the Firepower Detection Snort Engine ha... • http://www.securityfocus.com/bid/101118 • CWE-399: Resource Management Errors CWE-772: Missing Release of Resource after Effective Lifetime •
CVSS: 8.6EPSS: 0%CPEs: 12EXPL: 0CVE-2017-12244
https://notcve.org/view.php?id=CVE-2017-12244
05 Oct 2017 — A vulnerability in the detection engine parsing of IPv6 packets for Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause high CPU utilization or to cause a denial of service (DoS) condition because the Snort process restarts unexpectedly. The vulnerability is due to improper input validation of the fields in the IPv6 extension header packet. An attacker could exploit this vulnerability by sending a malicious IPv6 packet to the detection engine on the targeted device. An e... • http://www.securityfocus.com/bid/101119 • CWE-20: Improper Input Validation •
CVSS: 5.4EPSS: 0%CPEs: 11EXPL: 0CVE-2017-6716
https://notcve.org/view.php?id=CVE-2017-6716
04 Jul 2017 — A vulnerability in the web framework code of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface of an affected system. Affected Products: Cisco Firepower Management Center Software Releases prior to 6.0.0.0. More Information: CSCuy88785. Known Affected Releases: 5.4.1.6. Una vulnerabilidad en el código del framework web de Firepower Management Center de Cisco, podría permitir a un atacante ... • http://www.securityfocus.com/bid/99220 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 22EXPL: 0CVE-2017-6717
https://notcve.org/view.php?id=CVE-2017-6717
04 Jul 2017 — A vulnerability in the web framework of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface. More Information: CSCvc38801. Known Affected Releases: 6.0.1.3 6.2.1. Known Fixed Releases: 6.2.1. Una vulnerabilidad en el framework web de Firepower Management Center de Cisco, podría permitir a un atacante remoto identificado conducir un ataque de tipo cross-site scripting (XSS) contra un usuario de la i... • http://www.securityfocus.com/bid/99217 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 9EXPL: 0CVE-2017-6715
https://notcve.org/view.php?id=CVE-2017-6715
04 Jul 2017 — A vulnerability in the web framework of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface. Affected Products: Cisco Firepower Management Center Releases 5.4.1.x and prior. More Information: CSCuy88951. Known Affected Releases: 5.4.1.6. Una vulnerabilidad en el framework web de Firepower Management Center de Cisco, podría permitir a un atacante remoto identificado conducir un ataque de tipo cross-... • http://www.securityfocus.com/bid/99209 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •