CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2017-6661
https://notcve.org/view.php?id=CVE-2017-6661
A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA) and Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device, aka Message Tracking XSS. More Information: CSCvd30805 CSCvd34861. Known Affected Releases: 10.0.0-203 10.1.0-049. Una vulnerabilidad en la interfaz de administración basada en web de Email Security Appliance (ESA) y Content Security Management Appliance (SMA) de Cisco, podría permitir a un atacante remoto no identificado conducir un ataque de tipo cross-site-scripting (XSS) contra un usuario de la interfaz de administración basada en web de un dispositivo afectado, también se conoce como XSS de Rastreo de Mensajes. Más información: CSCvd30805 CSCvd34861. • http://www.securityfocus.com/bid/98950 http://www.securitytracker.com/id/1038637 http://www.securitytracker.com/id/1038638 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-esa • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.8EPSS: 0%CPEs: 12EXPL: 0CVE-2017-3827
https://notcve.org/view.php?id=CVE-2017-3827
A vulnerability in the Multipurpose Internet Mail Extensions (MIME) scanner of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) and Web Security Appliances (WSA) could allow an unauthenticated, remote attacker to bypass configured user filters on the device. Affected Products: This vulnerability affects all releases prior to the first fixed release of Cisco AsyncOS Software for Cisco ESA and Cisco WSA, both virtual and hardware appliances, that are configured with message or content filters to scan incoming email attachments on the ESA or services scanning content of web access on the WSA. More Information: SCvb91473, CSCvc76500. Known Affected Releases: 10.0.0-203 9.9.9-894 WSA10.0.0-233. Una vulnerabilidad en el escáner Multipurpose Internet Mail Extensions (MIME) de Cisco AsyncOS Software para Cisco Email Security Appliances (ESA) y Web Security Appliances (WSA) podría permitir a un atacante remoto no autenticado eludir filtros configurados por en usuario en el dispositivo. • http://www.securityfocus.com/bid/96239 http://www.securitytracker.com/id/1037831 http://www.securitytracker.com/id/1037832 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-asyncos • CWE-20: Improper Input Validation •
CVSS: 5.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-3818
https://notcve.org/view.php?id=CVE-2017-3818
A vulnerability in the Multipurpose Internet Mail Extensions (MIME) scanner of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to bypass configured user filters on the device, aka a Malformed MIME Header Filtering Bypass. This vulnerability affects all releases prior to the first fixed release of Cisco AsyncOS Software for Cisco Email Security Appliances, both virtual and hardware appliances, if the software is configured to apply a message filter or content filter to incoming email attachments. More Information: CSCvb65245. Known Affected Releases: 9.7.1-066. Known Fixed Releases: 9.8.0-092. • http://www.securityfocus.com/bid/95939 http://www.securitytracker.com/id/1037773 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170201-esa1 • CWE-20: Improper Input Validation •
CVSS: 5.8EPSS: 0%CPEs: 3EXPL: 0CVE-2017-3800
https://notcve.org/view.php?id=CVE-2017-3800
A vulnerability in the content scanning engine of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to bypass configured message or content filters on the device. Affected Products: This vulnerability affects all releases prior to the first fixed release of Cisco AsyncOS Software for Cisco Email Security Appliances, both virtual and hardware appliances, if the software is configured to apply a message filter or content filter to incoming email attachments. The vulnerability is not limited to any specific rules or actions for a message filter or content filter. More Information: CSCuz16076. Known Affected Releases: 9.7.1-066 9.7.1-HP2-207 9.8.5-085. • http://www.securityfocus.com/bid/95637 http://www.securitytracker.com/id/1037656 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170118-esa • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 16EXPL: 0CVE-2016-9202
https://notcve.org/view.php?id=CVE-2016-9202
A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA) Switches could allow an unauthenticated, remote attacker to conduct a persistent cross-site scripting (XSS) attack against a user of the affected interface on an affected device. More Information: CSCvb37346. Known Affected Releases: 9.1.1-036 9.7.1-066. Una vulnerabilidad en la interfaz de administración basada en web de Cisco Email Security Appliance (ESA) Switches podría permitir a un atacante remoto no autenticado llevar a cabo un ataque de XSS sostenido contra el usuario de la interfaz afectada en un dispositivo afectado. Más Información: CSCvb37346. • http://www.securityfocus.com/bid/94799 http://www.securitytracker.com/id/1037423 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-esa1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •