CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2017-6766
https://notcve.org/view.php?id=CVE-2017-6766
A vulnerability in the Secure Sockets Layer (SSL) Decryption and Inspection feature of Cisco Firepower System Software 5.4.0, 5.4.1, 6.0.0, 6.1.0, 6.2.0, 6.2.1, and 6.2.2 could allow an unauthenticated, remote attacker to bypass the SSL policy for decrypting and inspecting traffic on an affected system. The vulnerability is due to unexpected interaction with Known Key and Decrypt and Resign configuration settings of SSL policies when the affected software receives unexpected SSL packet headers. An attacker could exploit this vulnerability by sending a crafted SSL packet through an affected device in a valid SSL session. A successful exploit could allow the attacker to bypass the SSL decryption and inspection policy for the affected system, which could allow traffic to flow through the system without being inspected. Cisco Bug IDs: CSCve12652. • https://quickview.cloudapps.cisco.com/quickview/bug/CSCve12652 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170802-fpw • CWE-310: Cryptographic Issues •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-6471
https://notcve.org/view.php?id=CVE-2016-6471
A vulnerability in the web-based management interface of Cisco Firepower Management Center running FireSIGHT System software could allow an authenticated, remote attacker to view the Remote Storage Password. More Information: CSCvb19366. Known Affected Releases: 5.4.1.6. Una vulnerabilidad la interfaz de administración basada en web de Cisco Firepower Management Center funcionando con el software FireSIGHT System puede permitir a un atacante remoto no autenticado ver la Remote Storage Password. Más información: CSCvb19366. • http://www.securityfocus.com/bid/94805 http://www.securitytracker.com/id/1037411 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-vdc • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2016-6460
https://notcve.org/view.php?id=CVE-2016-6460
A vulnerability in the FTP Representational State Transfer Application Programming Interface (REST API) for Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass FTP malware detection rules and download malware over an FTP connection. Cisco Firepower System Software is affected when the device has a file policy with malware block configured for FTP connections. More Information: CSCuv36188 CSCuy91156. Known Affected Releases: 5.4.0.2 5.4.1.1 5.4.1.6 6.0.0 6.1.0 6.2.0. Known Fixed Releases: 6.0.0. • http://www.securityfocus.com/bid/94359 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161116-fss • CWE-254: 7PK - Security Features •
CVSS: 8.8EPSS: 0%CPEs: 70EXPL: 0CVE-2016-6417
https://notcve.org/view.php?id=CVE-2016-6417
Cross-site request forgery (CSRF) vulnerability in Cisco FireSIGHT System Software 4.10.2 through 6.1.0 and Firepower Management Center allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCva21636. Vulnerabilidad de CSRF en Cisco FireSIGHT System Software 4.10.2 hasta la versión 6.1.0 y Firepower Management Center permite a atacantes remotos secuestrar la autenticación de usuarios arbitrarios, vulnerabilidad también conocida como Bug ID CSCva21636. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-fmc http://www.securityfocus.com/bid/93199 http://www.securitytracker.com/id/1036918 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.1EPSS: 0%CPEs: 38EXPL: 0CVE-2016-6394
https://notcve.org/view.php?id=CVE-2016-6394
Session fixation vulnerability in Cisco Firepower Management Center and Cisco FireSIGHT System Software through 6.1.0 allows remote attackers to hijack web sessions via a session identifier, aka Bug ID CSCuz80503. Vulnerabilidad de fijación de sesión en Cisco Firepower Management Center y Cisco FireSIGHT System Software hasta la versión 6.1.0 permite a atacantes remotos secuestrar sesiones web a través de un identificador de sesión, vulnerabilidad también conocida como Bug ID CSCuz80503. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160907-fsmc http://www.securityfocus.com/bid/92825 http://www.securitytracker.com/id/1036757 • CWE-264: Permissions, Privileges, and Access Controls •