CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2019-12635 – Cisco Content Security Management Appliance Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2019-12635
A vulnerability in the authorization module of Cisco Content Security Management Appliance (SMA) Software could allow an authenticated, remote attacker to gain out-of-scope access to email. The vulnerability exists because the affected software does not correctly implement role permission controls. An attacker could exploit this vulnerability by using a custom role with specific permissions. A successful exploit could allow the attacker to access the spam quarantine of other users. Una vulnerabilidad en el módulo de autorización de Cisco Content Security Management Appliance (SMA) Software, podría permitir a un atacante remoto autenticado conseguir acceso al correo electrónico fuera de alcance. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190904-sma-info-dis • CWE-285: Improper Authorization CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.8EPSS: 0%CPEs: 40EXPL: 0CVE-2015-6321
https://notcve.org/view.php?id=CVE-2015-6321
Cisco AsyncOS before 8.5.7-042, 9.x before 9.1.0-032, 9.1.x before 9.1.1-023, and 9.5.x and 9.6.x before 9.6.0-042 on Email Security Appliance (ESA) devices; before 9.1.0-032, 9.1.1 before 9.1.1-005, and 9.5.x before 9.5.0-025 on Content Security Management Appliance (SMA) devices; and before 7.7.0-725 and 8.x before 8.0.8-113 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (memory consumption) via a flood of TCP packets, aka Bug IDs CSCus79774, CSCus79777, and CSCzv95795. Cisco AsyncOS en versiones anteriores a 8.5.7-042, 9.x en versiones anteriores a 9.1.0-032, 9.1.x en versiones anteriores a 9.1.1-023 y 9.5.x y 9.6.x en versiones anteriores a 9.6.0-042 en dispositivos Email Security Appliance (ESA); en versiones anteriores a 9.1.0-032, 9.1.1 en versiones anteriores a 9.1.1-005 y 9.5.x en versiones anteriores a 9.5.0-025 en dispositivos Content Security Management Appliance (SMA); y en versiones anteriores a 7.7.0-725 y 8.x en versiones anteriores a 8.0.8-113 en dispositivos Web Security Appliance (WSA) permite atacantes remotos causar una denegación de servicio (consumo de memoria) a través de una inundación de paquetes TCP, también conocidos como Bug IDs CSCus79774, CSCus79777 y CSCzv95795. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151104-aos http://www.securitytracker.com/id/1034060 http://www.securitytracker.com/id/1034061 • CWE-399: Resource Management Errors •