CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2017-12250
https://notcve.org/view.php?id=CVE-2017-12250
A vulnerability in the HTTP web interface for Cisco Wide Area Application Services (WAAS) could allow an unauthenticated, remote attacker to cause an HTTP Application Optimization (AO) related process to restart, causing a partial denial of service (DoS) condition. The vulnerability is due to lack of input validation of user-supplied input parameters within an HTTP request. An attacker could exploit this vulnerability by sending a crafted HTTP request through the targeted device. An exploit could allow the attacker to cause a DoS condition due to a process unexpectedly restarting. The WAAS could drop traffic during the brief time the process is restarting. • http://www.securityfocus.com/bid/100928 http://www.securitytracker.com/id/1039415 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170920-waas • CWE-20: Improper Input Validation CWE-399: Resource Management Errors •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2017-6730
https://notcve.org/view.php?id=CVE-2017-6730
A vulnerability in the web-based GUI of Cisco Wide Area Application Services (WAAS) Central Manager could allow an unauthenticated, remote attacker to retrieve completed reports from an affected system, aka Information Disclosure. This vulnerability affects the following products if they are running an affected release of Cisco Wide Area Application Services (WAAS) Software and are configured to use the Central Manager function: Cisco Virtual Wide Area Application Services (vWAAS), Cisco Wide Area Application Services (WAAS) Appliances, Cisco Wide Area Application Services (WAAS) Modules. Only Cisco WAAS products that are configured with the Central Manager role are affected by this vulnerability. More Information: CSCvd87574. Known Affected Releases: 4.4(7) 6.2(1) 6.2(3). • http://www.securityfocus.com/bid/99481 http://www.securitytracker.com/id/1038825 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-waas1 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2017-6727
https://notcve.org/view.php?id=CVE-2017-6727
A vulnerability in the Server Message Block (SMB) protocol of Cisco Wide Area Application Services (WAAS) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device due to a process restarting unexpectedly and creating Core Dump files. More Information: CSCvc63035. Known Affected Releases: 6.2(3a). Known Fixed Releases: 6.3(0.167) 6.2(3c)5 6.2(3.22). Una vulnerabilidad en el protocolo Server Message Block (SMB) de Cisco Wide Area Application Services (WAAS) podría permitir que un atacante remoto no autenticado provoque una condición de denegación de servicio (DoS) en un dispositivo afectado. • http://www.securityfocus.com/bid/99483 http://www.securitytracker.com/id/1038824 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-waas • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2017-6721
https://notcve.org/view.php?id=CVE-2017-6721
A vulnerability in the ingress processing of fragmented TCP packets by Cisco Wide Area Application Services (WAAS) could allow an unauthenticated, remote attacker to cause the WAASNET process to restart unexpectedly, causing a denial of service (DoS) condition. More Information: CSCvc57428. Known Affected Releases: 6.3(1). Known Fixed Releases: 6.3(0.143) 6.2(3c)6 6.2(3.22). Una vulnerabilidad en el procesamiento de ingreso de paquetes TCP fragmentados por Wide Area Application Services (WAAS) de Cisco, podría permitir a un atacante remoto no identificado causar que el proceso WAASNET se reinicie inesperadamente, causando una condición de denegación de servicio (DoS). • http://www.securityfocus.com/bid/99200 http://www.securitytracker.com/id/1038747 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-waas • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2017-6628
https://notcve.org/view.php?id=CVE-2017-6628
A vulnerability in SMART-SSL Accelerator functionality for Cisco Wide Area Application Services (WAAS) 6.2.1, 6.2.1a, and 6.2.3a could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition where the WAN optimization could stop functioning while the process restarts. The vulnerability is due to a Secure Sockets Layer/Transport Layer Security (SSL/TLS) alert being incorrectly handled when in a specific SSL/TLS connection state. An attacker could exploit this vulnerability by establishing a SMART-SSL connection through the targeted device. The attacker would then send a crafted stream of SSL/TLS traffic. An exploit could allow the attacker to cause a DoS condition where WAN optimization could stop processing traffic for a short period of time. • http://www.securityfocus.com/bid/98294 http://www.securitytracker.com/id/1038399 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170503-waas • CWE-399: Resource Management Errors CWE-755: Improper Handling of Exceptional Conditions •