CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-20675 – Multiple Cisco Security Products Simple Network Management Protocol Service Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2022-20675
A vulnerability in the TCP/IP stack of Cisco Email Security Appliance (ESA), Cisco Web Security Appliance (WSA), and Cisco Secure Email and Web Manager, formerly Security Management Appliance, could allow an unauthenticated, remote attacker to crash the Simple Network Management Protocol (SNMP) service, resulting in a denial of service (DoS) condition. This vulnerability is due to an open port listener on TCP port 199. An attacker could exploit this vulnerability by connecting to TCP port 199. A successful exploit could allow the attacker to crash the SNMP service, resulting in a DoS condition. Una vulnerabilidad en la pila TCP/IP de Cisco Email Security Appliance (ESA), Cisco Web Security Appliance (WSA) y Cisco Secure Email and Web Manager, anteriormente Security Management Appliance, podría permitir a un atacante remoto no autenticado bloquear el Servicio del Protocolo Simple de Administrador de Redes (SNMP), resultando en una situación de denegación de servicio (DoS). • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ESA-SNMP-JLAJksWK • CWE-248: Uncaught Exception •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2022-20781 – Cisco Web Security Appliance Stored Cross-Site Scripting Vulnerability
https://notcve.org/view.php?id=CVE-2022-20781
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface of an affected device. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by inserting malicious data into a specific data field in an affected interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface. Una vulnerabilidad en la interfaz de administración basada en web del software Cisco AsyncOS para Cisco Web Security Appliance (WSA) podría permitir a un atacante remoto autenticado conducir un ataque de tipo cross-site scripting (XSS) almacenado contra un usuario de la interfaz de un dispositivo afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-stored-xss-XPsJghMY • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-20784 – Cisco Web Security Appliance Filter Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2022-20784
A vulnerability in the Web-Based Reputation Score (WBRS) engine of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to bypass established web request policies and access blocked content on an affected device. This vulnerability is due to incorrect handling of certain character combinations inserted into a URL. An attacker could exploit this vulnerability by sending crafted URLs to be processed by an affected device. A successful exploit could allow the attacker to bypass the web proxy and access web content that has been blocked by policy. Una vulnerabilidad en el motor Web-Based Reputation Score (WBRS) del software Cisco AsyncOS para Cisco Web Security Appliance (WSA) podría permitir a un atacante remoto no autenticado omitir las políticas de petición web establecidas y acceder a contenido bloqueado en un dispositivo afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-swa-filter-bypass-XXXTU3X • CWE-20: Improper Input Validation •
CVSS: 8.6EPSS: 0%CPEs: 10EXPL: 0CVE-2021-34698 – Cisco Web Security Appliance Proxy Service Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2021-34698
A vulnerability in the proxy service of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to exhaust system memory and cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper memory management in the proxy service of an affected device. An attacker could exploit this vulnerability by establishing a large number of HTTPS connections to the affected device. A successful exploit could allow the attacker to cause the system to stop processing new connections, which could result in a DoS condition. Note: Manual intervention may be required to recover from this situation. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-dos-fmHdKswk • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 8.6EPSS: 0%CPEs: 6EXPL: 0CVE-2021-34749 – Multiple Cisco Products Server Name Identification Data Exfiltration Vulnerability
https://notcve.org/view.php?id=CVE-2021-34749
A vulnerability in Server Name Identification (SNI) request filtering of Cisco Web Security Appliance (WSA), Cisco Firepower Threat Defense (FTD), and the Snort detection engine could allow an unauthenticated, remote attacker to bypass filtering technology on an affected device and exfiltrate data from a compromised host. This vulnerability is due to inadequate filtering of the SSL handshake. An attacker could exploit this vulnerability by using data from the SSL client hello packet to communicate with an external server. A successful exploit could allow the attacker to execute a command-and-control attack on a compromised host and perform additional data exfiltration attacks. Una vulnerabilidad en el filtrado de peticiones Server Name Identification (SNI) de Cisco Web Security Appliance (WSA), Cisco Firepower Threat Defense (FTD) y Snort detection engine podría permitir a un atacante no autenticado remoto omitir la tecnología de filtrado en un dispositivo afectado y exfiltrar datos de un host comprometido. • https://lists.debian.org/debian-lts-announce/2023/02/msg00011.html https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sni-data-exfil-mFgzXqLN https://www.debian.org/security/2023/dsa-5354 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •