CVSS: 7.7EPSS: 0%CPEs: 7EXPL: 0CVE-2019-1884 – Cisco Web Security Appliance Web Proxy Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2019-1884
A vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation mechanisms for certain fields in HTTP/HTTPS requests sent through an affected device. A successful attacker could exploit this vulnerability by sending a malicious HTTP/HTTPS request through an affected device. An exploit could allow the attacker to force the device to stop processing traffic, resulting in a DoS condition. Una vulnerabilidad en la funcionalidad de proxy web de Cisco AsyncOS Software para Cisco Web Security Appliance (WSA) podría permitir que un atacante remoto autenticado provoque una condición de denegación de servicio (DoS) en un dispositivo afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-asyncos-wsa • CWE-20: Improper Input Validation •
CVSS: 8.6EPSS: 0%CPEs: 3EXPL: 0CVE-2018-15460 – Cisco Email Security Appliance URL Filtering Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2018-15460
A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to cause the CPU utilization to increase to 100 percent, causing a denial of service (DoS) condition on an affected device. The vulnerability is due to improper filtering of email messages that contain references to whitelisted URLs. An attacker could exploit this vulnerability by sending a malicious email message that contains a large number of whitelisted URLs. A successful exploit could allow the attacker to cause a sustained DoS condition that could force the affected device to stop scanning and forwarding email messages. Una vulnerabilidad en la funcionalidad de filtrado de mensajes de correo electrónico de Cisco AsyncOS Software para Cisco Email Security Appliances (ESA) podría permitir que un atacante remoto no autenticado aumente el uso de la CPU hasta el 100 por ciento, provocando una condición de denegación de servicio (DoS) en un dispositivo afectado. • http://www.securityfocus.com/bid/106507 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190109-esa-url-dos • CWE-20: Improper Input Validation CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2017-12303
https://notcve.org/view.php?id=CVE-2017-12303
A vulnerability in the Advanced Malware Protection (AMP) file filtering feature of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to bypass a configured AMP file filtering rule. The file types affected are zipped or archived file types. The vulnerability is due to incorrect and different file hash values when AMP scans the file. An attacker could exploit this vulnerability by sending a crafted email file attachment through the targeted device. An exploit could allow the attacker to bypass a configured AMP file filter. • http://www.securityfocus.com/bid/101932 http://www.securitytracker.com/id/1039828 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171115-wsa • CWE-358: Improperly Implemented Security Check for Standard •