CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2020-3164 – Cisco ESA, Cisco WSA, and Cisco SMA GUI Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2020-3164
A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Email Security Appliance (ESA), Cisco Web Security Appliance (WSA), and Cisco Content Security Management Appliance (SMA) could allow an unauthenticated remote attacker to cause high CPU usage on an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of specific HTTP request headers. An attacker could exploit this vulnerability by sending a malformed HTTP request to an affected device. A successful exploit could allow the attacker to trigger a prolonged status of high CPU utilization relative to the GUI process(es). Upon successful exploitation of this vulnerability, an affected device will still be operative, but its response time and overall performance may be degraded. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cont-sec-gui-dos-nJ625dXb • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2019-15956 – Cisco Web Security Appliance Unauthorized Device Reset Vulnerability
https://notcve.org/view.php?id=CVE-2019-15956
A vulnerability in the web management interface of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to perform an unauthorized system reset on an affected device. The vulnerability is due to improper authorization controls for a specific URL in the web management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could have a twofold impact: the attacker could either change the administrator password, gaining privileged access, or reset the network configuration details, causing a denial of service (DoS) condition. In both scenarios, manual intervention is required to restore normal operations. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-wsa-unauth-devreset • CWE-284: Improper Access Control •
CVSS: 7.7EPSS: 0%CPEs: 7EXPL: 0CVE-2019-1884 – Cisco Web Security Appliance Web Proxy Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2019-1884
A vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation mechanisms for certain fields in HTTP/HTTPS requests sent through an affected device. A successful attacker could exploit this vulnerability by sending a malicious HTTP/HTTPS request through an affected device. An exploit could allow the attacker to force the device to stop processing traffic, resulting in a DoS condition. Una vulnerabilidad en la funcionalidad de proxy web de Cisco AsyncOS Software para Cisco Web Security Appliance (WSA) podría permitir que un atacante remoto autenticado provoque una condición de denegación de servicio (DoS) en un dispositivo afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-asyncos-wsa • CWE-20: Improper Input Validation •
CVSS: 8.6EPSS: 0%CPEs: 5EXPL: 0CVE-2019-1886 – Cisco Web Security Appliance HTTPS Certificate Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2019-1886
A vulnerability in the HTTPS decryption feature of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to insufficient validation of Secure Sockets Layer (SSL) server certificates. An attacker could exploit this vulnerability by installing a malformed certificate in a web server and sending a request to it through the Cisco WSA. A successful exploit could allow the attacker to cause an unexpected restart of the proxy process on an affected device. Una vulnerabilidad en la función de descifrado HTTPS de Cisco Web Security Appliance (WSA) podría permitir que un atacante remoto no autenticado provoque una condición de denegación de servicio (DoS). • http://www.securityfocus.com/bid/109049 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-wsa-dos • CWE-20: Improper Input Validation CWE-295: Improper Certificate Validation •
CVSS: 8.6EPSS: 0%CPEs: 4EXPL: 0CVE-2019-1817 – Cisco Web Security Appliance Malformed Request Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2019-1817
A vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliance could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper validation of HTTP and HTTPS requests. An attacker could exploit this vulnerability by sending a malformed HTTP or HTTPS request to an affected device. An exploit could allow the attacker to cause a restart of the web proxy process, resulting in a temporary DoS condition. Una vulnerabilidad en la funcionalidad web proxy de Cisco AsyncOS Software para Cisco Web Security Appliance, podría permitir que un atacante remoto no identificado cause una condición de Denegación de Servicio (DoS) en un dispositivo afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-wsa-dos • CWE-20: Improper Input Validation •