CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2018-0406
https://notcve.org/view.php?id=CVE-2018-0406
01 Aug 2018 — A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to conduct a reflected or Document Object Model based (DOM-based) cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a... • http://www.securityfocus.com/bid/104945 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 1%CPEs: 5EXPL: 0CVE-2018-0353
https://notcve.org/view.php?id=CVE-2018-0353
07 Jun 2018 — A vulnerability in traffic-monitoring functions in Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to circumvent Layer 4 Traffic Monitor (L4TM) functionality and bypass security protections. The vulnerability is due to a change in the underlying operating system software that is responsible for monitoring affected traffic. An attacker could exploit this vulnerability by sending crafted IP packets to an affected device. A successful exploit could allow the attacker to pass ... • http://www.securityfocus.com/bid/104417 • CWE-254: 7PK - Security Features •