Page 2 of 9 results (0.012 seconds)

CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0

CVE-2019-12635 – Cisco Content Security Management Appliance Information Disclosure Vulnerability

https://notcve.org/view.php?id=CVE-2019-12635

A vulnerability in the authorization module of Cisco Content Security Management Appliance (SMA) Software could allow an authenticated, remote attacker to gain out-of-scope access to email. The vulnerability exists because the affected software does not correctly implement role permission controls. An attacker could exploit this vulnerability by using a custom role with specific permissions. A successful exploit could allow the attacker to access the spam quarantine of other users. Una vulnerabilidad en el módulo de autorización de Cisco Content Security Management Appliance (SMA) Software, podría permitir a un atacante remoto autenticado conseguir acceso al correo electrónico fuera de alcance. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190904-sma-info-dis • CWE-285: Improper Authorization CWE-732: Incorrect Permission Assignment for Critical Resource •

CVSS: 7.8EPSS: 0%CPEs: 40EXPL: 0

CVE-2015-6321

https://notcve.org/view.php?id=CVE-2015-6321

Cisco AsyncOS before 8.5.7-042, 9.x before 9.1.0-032, 9.1.x before 9.1.1-023, and 9.5.x and 9.6.x before 9.6.0-042 on Email Security Appliance (ESA) devices; before 9.1.0-032, 9.1.1 before 9.1.1-005, and 9.5.x before 9.5.0-025 on Content Security Management Appliance (SMA) devices; and before 7.7.0-725 and 8.x before 8.0.8-113 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (memory consumption) via a flood of TCP packets, aka Bug IDs CSCus79774, CSCus79777, and CSCzv95795. Cisco AsyncOS en versiones anteriores a 8.5.7-042, 9.x en versiones anteriores a 9.1.0-032, 9.1.x en versiones anteriores a 9.1.1-023 y 9.5.x y 9.6.x en versiones anteriores a 9.6.0-042 en dispositivos Email Security Appliance (ESA); en versiones anteriores a 9.1.0-032, 9.1.1 en versiones anteriores a 9.1.1-005 y 9.5.x en versiones anteriores a 9.5.0-025 en dispositivos Content Security Management Appliance (SMA); y en versiones anteriores a 7.7.0-725 y 8.x en versiones anteriores a 8.0.8-113 en dispositivos Web Security Appliance (WSA) permite atacantes remotos causar una denegación de servicio (consumo de memoria) a través de una inundación de paquetes TCP, también conocidos como Bug IDs CSCus79774, CSCus79777 y CSCzv95795. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151104-aos http://www.securitytracker.com/id/1034060 http://www.securitytracker.com/id/1034061 • CWE-399: Resource Management Errors •

CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0

CVE-2015-4322

https://notcve.org/view.php?id=CVE-2015-4322

Cisco Content Security Management Appliance (SMA) 8.3.6-039, 9.1.0-31, and 9.1.0-103 improperly restricts the privileges available after LDAP authentication, which allows remote authenticated users to read or write to an arbitrary user's Spam Quarantine folder by visiting a spam-notification URL, aka Bug ID CSCuv65894. Vulnerabilidad en Cisco Content Security Management Appliance (SMA) 8.3.6-039, 9.1.0-31, y 9.1.0-103, restringe incorrectamente los privilegios disponibles tras la autenticación LDAP, lo que permite a usuarios remotos autenticados leer o escribir en una carpeta de Cuarentena de Spam de un usuario arbitrario visitando una URL de notificación de spam, también conocida como Bug ID CSCuv65894. • http://tools.cisco.com/security/center/viewAlert.x?alertId=40450 http://www.securityfocus.com/bid/76365 http://www.securitytracker.com/id/1033322 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0

CVE-2015-4288

https://notcve.org/view.php?id=CVE-2015-4288

The LDAP implementation on the Cisco Web Security Appliance (WSA) 8.5.0-000, Email Security Appliance (ESA) 8.5.7-042, and Content Security Management Appliance (SMA) 8.3.6-048 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, aka Bug IDs CSCuo29561, CSCuv40466, and CSCuv40470. Vulnerabilidad en la implementación LDAP en Cisco Web Security Appliance (WSA) 8.5.0-000, Email Security Appliance (ESA) 8.5.7-042 y Content Security Management Appliance (SMA) 8.3.6-048, no verifica los certificados X.509 de los servidores SSL, lo que permite a atacantes man-in-the-middle falsificar servidores y obtener información sensible a través de un certificado manipulado, también conocido como Bug IDs CSCuo29561, CSCuv40466, and CSCuv40470. • http://tools.cisco.com/security/center/viewAlert.x?alertId=40137 • CWE-310: Cryptographic Issues •