CVSS: 7.8EPSS: 0%CPEs: 56EXPL: 0CVE-2016-6356
https://notcve.org/view.php?id=CVE-2016-6356
A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an unauthenticated, remote attacker to cause an affected device to stop scanning and forwarding email messages due to a denial of service (DoS) condition. Affected Products: This vulnerability affects all releases prior to the first fixed release of Cisco AsyncOS Software for Cisco Email Security Appliances, both virtual and hardware appliances, if the software is configured to apply a message filter or content filter to incoming email attachments. The vulnerability is not limited to any specific rules or actions for a message filter or content filter. More Information: CSCuz63143. Known Affected Releases: 8.5.7-042 9.7.0-125. • http://www.securityfocus.com/bid/93907 http://www.securitytracker.com/id/1037122 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161026-esa3 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 16EXPL: 0CVE-2015-6291
https://notcve.org/view.php?id=CVE-2015-6291
Cisco AsyncOS before 8.5.7-043, 9.x before 9.1.1-023, and 9.5.x and 9.6.x before 9.6.0-046 on Email Security Appliance (ESA) devices mishandles malformed fields during body-contains, attachment-contains, every-attachment-contains, attachment-binary-contains, dictionary-match, and attachment-dictionary-match filtering, which allows remote attackers to cause a denial of service (memory consumption) via a crafted attachment in an e-mail message, aka Bug ID CSCuv47151. Cisco AsyncOS en versiones anteriores a 8.5.7-043, 9.x en versiones anteriores a 9.1.1-023 y 9.5.x y 9.6.x en versiones anteriores a 9.6.0-046 en dispositivos Email Security Appliance (ESA) no maneja correctamente los campos mal formados durante el filtrado body-contains, attachment-contains, every-attachment-contains, attachment-binary-contains, dictionary-match y attachment-dictionary-match, lo que permite a atacantes remotos causar una denegación de servicio (consumo de memoria) a través de un archivo adjunto manipulado en un mensaje de correo electrónico, también conocido como Bug ID CSCuv47151. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151104-esa2 http://www.securitytracker.com/id/1034064 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 40EXPL: 0CVE-2015-6321
https://notcve.org/view.php?id=CVE-2015-6321
Cisco AsyncOS before 8.5.7-042, 9.x before 9.1.0-032, 9.1.x before 9.1.1-023, and 9.5.x and 9.6.x before 9.6.0-042 on Email Security Appliance (ESA) devices; before 9.1.0-032, 9.1.1 before 9.1.1-005, and 9.5.x before 9.5.0-025 on Content Security Management Appliance (SMA) devices; and before 7.7.0-725 and 8.x before 8.0.8-113 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (memory consumption) via a flood of TCP packets, aka Bug IDs CSCus79774, CSCus79777, and CSCzv95795. Cisco AsyncOS en versiones anteriores a 8.5.7-042, 9.x en versiones anteriores a 9.1.0-032, 9.1.x en versiones anteriores a 9.1.1-023 y 9.5.x y 9.6.x en versiones anteriores a 9.6.0-042 en dispositivos Email Security Appliance (ESA); en versiones anteriores a 9.1.0-032, 9.1.1 en versiones anteriores a 9.1.1-005 y 9.5.x en versiones anteriores a 9.5.0-025 en dispositivos Content Security Management Appliance (SMA); y en versiones anteriores a 7.7.0-725 y 8.x en versiones anteriores a 8.0.8-113 en dispositivos Web Security Appliance (WSA) permite atacantes remotos causar una denegación de servicio (consumo de memoria) a través de una inundación de paquetes TCP, también conocidos como Bug IDs CSCus79774, CSCus79777 y CSCzv95795. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151104-aos http://www.securitytracker.com/id/1034060 http://www.securitytracker.com/id/1034061 • CWE-399: Resource Management Errors •
CVSS: 6.4EPSS: 0%CPEs: 2EXPL: 0CVE-2015-6285
https://notcve.org/view.php?id=CVE-2015-6285
Format string vulnerability in Cisco Email Security Appliance (ESA) 7.6.0 and 8.0.0 allows remote attackers to cause a denial of service (memory overwrite or service outage) via format string specifiers in an HTTP request, aka Bug ID CSCug21497. Vulnerabilidad de formato de cadena en Cisco Email Security Appliance (ESA) 7.6.0 y 8.0.0, permite a atacantes remotos causar una denegación de servicio (sobreescritura de memoria e interrupción del proceso) a través de especificadores de formato de cadena en una petición HTTP, también conocida como Bug ID CSCug21497. • http://tools.cisco.com/security/center/viewAlert.x?alertId=40844 http://www.securitytracker.com/id/1033531 • CWE-134: Use of Externally-Controlled Format String •
CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2015-4184
https://notcve.org/view.php?id=CVE-2015-4184
The anti-spam scanner on Cisco Email Security Appliance (ESA) devices 3.3.1-09, 7.5.1-gpl-022, and 8.5.6-074 allows remote attackers to bypass intended e-mail restrictions via a malformed DNS SPF record, aka Bug IDs CSCuu35853 and CSCuu37733. El escáner anti-spam en los dispositivos Cisco Email Security Appliance (ESA) 3.3.1-09, 7.5.1-gpl-022, y 8.5.6-074 permite a atacantes remotos evadir les restricciones de email a través de un registro DNS SPF malformado, también conocido como Bug IDs CSCuu35853 y CSCuu37733. • http://tools.cisco.com/security/center/viewAlert.x?alertId=39339 http://www.securityfocus.com/bid/75181 http://www.securitytracker.com/id/1032582 • CWE-20: Improper Input Validation •