CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 0CVE-2019-1983 – Cisco Email Security Appliance and Cisco Content Security Management Appliance Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2019-1983
23 Sep 2020 — A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) and Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to cause repeated crashes in some internal processes that are running on the affected devices, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient input validation of email attachments. An attacker could exploit this vulnerability by sending an emai... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200219-esa-sma-dos • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2020-3547 – Cisco Email Security Appliance, Cisco Content Security Management Appliance, and Cisco Web Security Appliance Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-3547
04 Sep 2020 — A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA), Cisco Content Security Management Appliance (SMA), and Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability exists because an insecure method is used to mask certain passwords on the web-based management interface. An attacker could exploit this vulnerability by looking at the raw HTML co... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-wsa-esa-info-dis-vsvPzOHP • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-522: Insufficiently Protected Credentials •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-3546 – Cisco Email Security Appliance Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-3546
04 Sep 2020 — A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to insufficient validation of requests that are sent to the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the interface of an affected device. A successful exploit could allow the attacker to obtain t... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-info-disclosure-vMJMMgJ • CWE-20: Improper Input Validation •
CVSS: 5.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-3368 – Cisco Email Security Appliance URL Filtering Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2020-3368
18 Jun 2020 — A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. The vulnerability is due to insufficient input validation of URLs. An attacker could exploit this vulnerability by crafting the URL in a particular way. A successful exploit could allow the attacker to bypass the URL reputation filters that are configured for the affected device, wh... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-url-bypass-WO4BZ75s • CWE-20: Improper Input Validation •
CVSS: 8.6EPSS: 0%CPEs: 3EXPL: 0CVE-2018-15460 – Cisco Email Security Appliance URL Filtering Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2018-15460
10 Jan 2019 — A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to cause the CPU utilization to increase to 100 percent, causing a denial of service (DoS) condition on an affected device. The vulnerability is due to improper filtering of email messages that contain references to whitelisted URLs. An attacker could exploit this vulnerability by sending a malicious email message that contains a large num... • http://www.securityfocus.com/bid/106507 • CWE-20: Improper Input Validation CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2016-1461
https://notcve.org/view.php?id=CVE-2016-1461
01 Aug 2016 — Cisco AsyncOS on Email Security Appliance (ESA) devices through 9.7.0-125 allows remote attackers to bypass malware detection via a crafted attachment in an e-mail message, aka Bug ID CSCuz14932. Cisco AsyncOS en dispositivos Email Security Appliance (ESA) hasta la versión 9.7.0-125 permite a atacantes remotos eludir la detección de malware a través de un adjunto manipulado en un mensaje de e-mail, también conocido como Bug ID CSCuz14932. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160727-esa • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2015-0605
https://notcve.org/view.php?id=CVE-2015-0605
07 Feb 2015 — The uuencode inspection engine in Cisco AsyncOS on Cisco Email Security Appliance (ESA) devices 8.5 and earlier allows remote attackers to bypass intended content restrictions via a crafted e-mail attachment with uuencode encoding, aka Bug ID CSCzv54343. El motor de inspección uuencode en Cisco AsyncOS en los dispositivos Cisco Email Security Appliance (ESA) 8.5 y anteriores permite a atacantes remotos evadir las restricciones de contenido a través de un adjunto de email manipulado con cifrado uuencode, tam... • http://secunia.com/advisories/62829 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-3381
https://notcve.org/view.php?id=CVE-2014-3381
19 Oct 2014 — The ZIP inspection engine in Cisco AsyncOS 8.5 and earlier on the Cisco Email Security Appliance (ESA) does not properly analyze ZIP archives, which allows remote attackers to bypass malware filtering via a crafted archive, aka Bug ID CSCup07934. El motor de inspección ZIP en Cisco AsyncOS 8.5 y anteriores en Cisco Email Security Appliance (ESA) no analiza correctamente los archivos ZIP, lo que permite a atacantes remotos evadir la filtración de malware a través de un archivo manipulado, también conocido co... • http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3381 • CWE-264: Permissions, Privileges, and Access Controls •