CVSS: 8.6EPSS: 0%CPEs: 10EXPL: 0CVE-2018-0410
https://notcve.org/view.php?id=CVE-2018-0410
15 Aug 2018 — A vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliances could allow an unauthenticated, remote attacker to exhaust system memory and cause a denial of service (DoS) condition on an affected system. The vulnerability exists because the affected software improperly manages memory resources for TCP connections to a targeted device. An attacker could exploit this vulnerability by establishing a high number of TCP connections to the data interface of an affected... • http://www.securityfocus.com/bid/105098 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 0CVE-2018-0428
https://notcve.org/view.php?id=CVE-2018-0428
15 Aug 2018 — A vulnerability in the account management subsystem of Cisco Web Security Appliance (WSA) could allow an authenticated, local attacker to elevate privileges to root. The attacker must authenticate with valid administrator credentials. The vulnerability is due to improper implementation of access controls. An attacker could exploit this vulnerability by authenticating to the device as a specific user to gain the information needed to elevate privileges to root in a separate login shell. A successful exploit ... • http://www.securityfocus.com/bid/105104 • CWE-269: Improper Privilege Management CWE-284: Improper Access Control •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2018-0406
https://notcve.org/view.php?id=CVE-2018-0406
01 Aug 2018 — A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to conduct a reflected or Document Object Model based (DOM-based) cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a... • http://www.securityfocus.com/bid/104945 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-0353
https://notcve.org/view.php?id=CVE-2018-0353
07 Jun 2018 — A vulnerability in traffic-monitoring functions in Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to circumvent Layer 4 Traffic Monitor (L4TM) functionality and bypass security protections. The vulnerability is due to a change in the underlying operating system software that is responsible for monitoring affected traffic. An attacker could exploit this vulnerability by sending crafted IP packets to an affected device. A successful exploit could allow the attacker to pass ... • http://www.securityfocus.com/bid/104417 • CWE-254: 7PK - Security Features •
CVSS: 9.0EPSS: 0%CPEs: 11EXPL: 0CVE-2017-6746
https://notcve.org/view.php?id=CVE-2017-6746
25 Jul 2017 — A vulnerability in the web interface of the Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to perform command injection and elevate privileges to root. The attacker must authenticate with valid administrator credentials. Affected Products: Cisco AsyncOS Software 10.0 and later for WSA on both virtual and hardware appliances. More Information: CSCvd88862. Known Affected Releases: 10.1.0-204. • http://www.securityfocus.com/bid/99877 • CWE-20: Improper Input Validation •
CVSS: 7.2EPSS: 0%CPEs: 19EXPL: 0CVE-2017-6748
https://notcve.org/view.php?id=CVE-2017-6748
25 Jul 2017 — A vulnerability in the CLI parser of the Cisco Web Security Appliance (WSA) could allow an authenticated, local attacker to perform command injection and elevate privileges to root. The attacker must authenticate with valid operator-level or administrator-level credentials. Affected Products: virtual and hardware versions of Cisco Web Security Appliance (WSA). More Information: CSCvd88855. Known Affected Releases: 10.1.0-204. • http://www.securityfocus.com/bid/99918 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •