CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2013-5537
https://notcve.org/view.php?id=CVE-2013-5537
The web framework on Cisco Web Security Appliance (WSA), Email Security Appliance (ESA), and Content Security Management Appliance (SMA) devices does not properly manage the state of HTTP and HTTPS sessions, which allows remote attackers to cause a denial of service (management GUI outage) via multiple TCP connections, aka Bug IDs CSCuj59411, CSCuf89818, and CSCuh05635. El framework web en dispositivos Cisco Web Security Appliance (WSA), Email Security Appliance (ESA), y Content Security Management Appliance (SMA) no manejan correctamente el estado de sesiones HTTP y HTTPS, lo cual permite a atacantes remotos causar denegación de servicio (agotamiento de GUI de gestión) a través de múltiples conexiones TCP, también conocido como bug IDs CSCuj59411, CSCuf89818, y CSCuh05635. • http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5537 • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2013-3395 – Cisco Ironport Cross Site Request Forgery / Cross Site Scripting
https://notcve.org/view.php?id=CVE-2013-3395
Cross-site request forgery (CSRF) vulnerability in the web framework on Cisco IronPort Web Security Appliance (WSA) devices, Email Security Appliance (ESA) devices, and Content Security Management Appliance (SMA) devices allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCuh70263, CSCuh70323, and CSCuh26634. Vulnerabilidad CSRG en el framework web en los dispositivos Cisco IronPort Web Security Appliance (WSA), Email Security Appliance (ESA) y Content Security Management Appliance (SMA), permite a atacantes remotos secuestrar la autenticación de usuarios arbitrarios. Aka Bug IDs CSCuh70263, CSCuh70323, y CSCuh26634. Cisco IronPort Security Management Appliance M170 version 7.9.1-030 suffers from cross site scripting and cross site request forgery vulnerabilities. • http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3395 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.8EPSS: 0%CPEs: 11EXPL: 0CVE-2013-3385
https://notcve.org/view.php?id=CVE-2013-3385
The management GUI in the web framework in IronPort AsyncOS on Cisco Web Security Appliance devices before 7.1.3-013, 7.5 before 7.5.0-838, and 7.7 before 7.7.0-602; Email Security Appliance devices before 7.1.5-106 and 7.3, 7.5, and 7.6 before 7.6.3-019; and Content Security Management Appliance devices before 7.9.1-102 and 8.0 before 8.0.0-404 allows remote attackers to cause a denial of service (system hang) via a series of (1) HTTP or (2) HTTPS requests to a management interface, aka Bug IDs CSCzv58669, CSCzv63329, and CSCzv78669. La interfaz de gestión en el framwork web de IronPort AsyncOS en dispositivos Cisco Web Security Appliance antes de v7.1.3-013, antes de v7.5.0-838 v7.5, y v7.7 antes de v7.7.0-602; Email Security Appliance dispositivos antes de v7.1.5-106 y v7.3, v7.5 y v7.6 antes de v7.6.3-019; y dispositivos Content Security Management Appliance antes de v7.9.1-102 y v8.0 antes v8.0.0-404 permite a atacantes remotos provocar una denegación de servicio (cuelgue del sistema) a través de una serie de (1) o HTTP (2) solicitudes HTTPS a una interfaz de gestión, también conocido como Bug ID CSCzv58669, CSCzv63329 y CSCzv78669. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130626-esa http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130626-sma http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130626-wsa • CWE-399: Resource Management Errors •
CVSS: 9.0EPSS: 0%CPEs: 4EXPL: 0CVE-2013-3383
https://notcve.org/view.php?id=CVE-2013-3383
The web framework in IronPort AsyncOS on Cisco Web Security Appliance devices before 7.1.3-013, 7.5 before 7.5.0-838, and 7.7 before 7.7.0-550 allows remote authenticated users to execute arbitrary commands via crafted command-line input in a URL sent over IPv4, aka Bug ID CSCzv69294. El framework web de IronPort AsyncOS en dispositivos Cisco Web Security Appliance antes v7.1.3-013, v7.5 antes de v7.5.0-838, y v7.7 antes de v7.7.0-550 permite a los usuarios autenticados remotamente ejecutar código arbitrario a través de entrada de línea de comandos diseñado en una URL, también conocido como Bug ID CSCzv69294. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130626-wsa • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.0EPSS: 0%CPEs: 11EXPL: 0CVE-2013-3384
https://notcve.org/view.php?id=CVE-2013-3384
The web framework in IronPort AsyncOS on Cisco Web Security Appliance devices before 7.1.3-013, 7.5 before 7.5.0-838, and 7.7 before 7.7.0-550; Email Security Appliance devices before 7.1.5-104, 7.3 before 7.3.2-026, 7.5 before 7.5.2-203, and 7.6 before 7.6.3-019; and Content Security Management Appliance devices before 7.2.2-110, 7.7 before 7.7.0-213, and 7.8 and 7.9 before 7.9.1-102 allows remote authenticated users to execute arbitrary commands via crafted command-line input in a URL, aka Bug IDs CSCzv85726, CSCzv44633, and CSCzv24579. El framework web de IronPort AsyncOS en dispositivos Cisco Web Security Appliance antes v7.1.3-013, v7.5 antes de v7.5.0-838, y v7.7 antes de v7.7.0-550, dispositivos Email Security Appliance antes de v7.1.5-104, v7.3 antes de v7.3.2-026, v7.5 antes v7.5.2-203 y v7.6 antes v7.6.3-019, y dispositivos Content Security Management Appliance antes de v7.2.2-110, v7.7 antes de v7.7.0-213 y v7.8 y v7.9 antes de 7.9.1-102 permite a los usuarios remotos autenticados ejecutar código arbitrario a través de entrada de línea de comandos diseñado en una URL, también conocido como Bug ID CSCzv85726, CSCzv44633 y CSCzv24579. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130626-esa http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130626-sma http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130626-wsa • CWE-94: Improper Control of Generation of Code ('Code Injection') •