CVSS: 7.5EPSS: 0%CPEs: 12EXPL: 0CVE-2015-4217
https://notcve.org/view.php?id=CVE-2015-4217
26 Jun 2015 — The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices before 2015-06-25 uses the same default SSH host keys across different customers' installations, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a private key from another installation, aka Bug IDs CSCus29681, CSCuu95676, and CSCuu96601. La característica de soporte remo... • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150625-ironport • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-310: Cryptographic Issues •
CVSS: 6.1EPSS: 0%CPEs: 9EXPL: 0CVE-2014-2137
https://notcve.org/view.php?id=CVE-2014-2137
02 Apr 2014 — CRLF injection vulnerability in the web framework in Cisco Web Security Appliance (WSA) 7.7 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks via a crafted URL, aka Bug ID CSCuj61002. Vulnerabilidad de inyección CRLF en el framework web en Cisco Web Security Appliance (WSA) 7.7 y anteriores permite a atacantes remotos inyectar cabeceras HTTP arbitrarias y realizar ataques de redirección a través de una URL manipulada, también conocido como Bug ID CSCuj61002... • http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2137 • CWE-20: Improper Input Validation •