CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2017-6766
https://notcve.org/view.php?id=CVE-2017-6766
A vulnerability in the Secure Sockets Layer (SSL) Decryption and Inspection feature of Cisco Firepower System Software 5.4.0, 5.4.1, 6.0.0, 6.1.0, 6.2.0, 6.2.1, and 6.2.2 could allow an unauthenticated, remote attacker to bypass the SSL policy for decrypting and inspecting traffic on an affected system. The vulnerability is due to unexpected interaction with Known Key and Decrypt and Resign configuration settings of SSL policies when the affected software receives unexpected SSL packet headers. An attacker could exploit this vulnerability by sending a crafted SSL packet through an affected device in a valid SSL session. A successful exploit could allow the attacker to bypass the SSL decryption and inspection policy for the affected system, which could allow traffic to flow through the system without being inspected. Cisco Bug IDs: CSCve12652. • https://quickview.cloudapps.cisco.com/quickview/bug/CSCve12652 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170802-fpw • CWE-310: Cryptographic Issues •
CVSS: 8.8EPSS: 0%CPEs: 70EXPL: 0CVE-2016-6417
https://notcve.org/view.php?id=CVE-2016-6417
Cross-site request forgery (CSRF) vulnerability in Cisco FireSIGHT System Software 4.10.2 through 6.1.0 and Firepower Management Center allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCva21636. Vulnerabilidad de CSRF en Cisco FireSIGHT System Software 4.10.2 hasta la versión 6.1.0 y Firepower Management Center permite a atacantes remotos secuestrar la autenticación de usuarios arbitrarios, vulnerabilidad también conocida como Bug ID CSCva21636. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-fmc http://www.securityfocus.com/bid/93199 http://www.securitytracker.com/id/1036918 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.3EPSS: 0%CPEs: 52EXPL: 0CVE-2016-6396
https://notcve.org/view.php?id=CVE-2016-6396
Cisco Firepower Management Center before 6.1 and FireSIGHT System Software before 6.1, when certain malware blocking options are enabled, allow remote attackers to bypass malware detection via crafted fields in HTTP headers, aka Bug ID CSCuz44482. Cisco Firepower Management Center en versiones anteriores a 6.1 y FireSIGHT System Software en versiones anteriores a 6.1, permite a atacantes remotos, cuando ciertas opciones de bloqueo de malware están habilitadas, eludir la detección de malware a través de campos manipulados en cabeceras HTTP, vulnerabilidad también conocida como Bug ID CSCuz44482. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160907-fsss1 http://www.securityfocus.com/bid/92826 http://www.securitytracker.com/id/1036756 • CWE-20: Improper Input Validation •
CVSS: 9.1EPSS: 0%CPEs: 38EXPL: 0CVE-2016-6394
https://notcve.org/view.php?id=CVE-2016-6394
Session fixation vulnerability in Cisco Firepower Management Center and Cisco FireSIGHT System Software through 6.1.0 allows remote attackers to hijack web sessions via a session identifier, aka Bug ID CSCuz80503. Vulnerabilidad de fijación de sesión en Cisco Firepower Management Center y Cisco FireSIGHT System Software hasta la versión 6.1.0 permite a atacantes remotos secuestrar sesiones web a través de un identificador de sesión, vulnerabilidad también conocida como Bug ID CSCuz80503. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160907-fsmc http://www.securityfocus.com/bid/92825 http://www.securitytracker.com/id/1036757 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.4EPSS: 0%CPEs: 52EXPL: 0CVE-2016-6395
https://notcve.org/view.php?id=CVE-2016-6395
Cross-site scripting (XSS) vulnerability in the web-based management interface in Cisco Firepower Management Center before 6.1 and FireSIGHT System Software before 6.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuz58658. Vulnerabilidad de XSS en la interfaz de administración basada en web en Cisco Firepower Management Center en versiones anteriores a 6.1 y FireSIGHT System Software en versiones anteriores a 6.1 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de una URL manipulada, vulnerabilidad también conocida como Bug ID CSCuz58658. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160907-fsss http://www.securityfocus.com/bid/92824 http://www.securitytracker.com/id/1036755 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •