CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-1438 – Cisco Wide Area Application Services Software Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2021-1438
A vulnerability in Cisco Wide Area Application Services (WAAS) Software could allow an authenticated, local attacker to gain access to sensitive information on an affected device. The vulnerability is due to improper input validation and authorization of specific commands that a user can execute within the CLI. An attacker could exploit this vulnerability by authenticating to an affected device and issuing a specific set of commands. A successful exploit could allow the attacker to read arbitrary files that they originally did not have permissions to access. Una vulnerabilidad en el software Cisco Wide Area Application Services (WAAS) podría permitir a un atacante local autenticado conseguir acceso a información confidencial en un dispositivo afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-waas-infdisc-Twb4EypK • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2019-1876 – Cisco Wide Area Application Services Software HTTPS Proxy Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2019-1876
A vulnerability in the HTTPS proxy feature of Cisco Wide Area Application Services (WAAS) Software could allow an unauthenticated, remote attacker to use the Central Manager as an HTTPS proxy. The vulnerability is due to insufficient authentication of proxy connection requests. An attacker could exploit this vulnerability by sending a malicious HTTPS CONNECT message to the Central Manager. A successful exploit could allow the attacker to access public internet resources that would normally be blocked by corporate policies. Una vulnerabilidad en la función proxy HTTPS del software Wide Area Application Services (WAAS) de Cisco, podría permitir a un atacante remoto no autenticado utilizar el Administrador Central como un proxy HTTPS. • http://www.securityfocus.com/bid/108863 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-waas-authbypass • CWE-306: Missing Authentication for Critical Function •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2018-0329
https://notcve.org/view.php?id=CVE-2018-0329
A vulnerability in the default configuration of the Simple Network Management Protocol (SNMP) feature of Cisco Wide Area Application Services (WAAS) Software could allow an unauthenticated, remote attacker to read data from an affected device via SNMP. The vulnerability is due to a hard-coded, read-only community string in the configuration file for the SNMP daemon. An attacker could exploit this vulnerability by using the static community string in SNMP version 2c queries to an affected device. A successful exploit could allow the attacker to read any data that is accessible via SNMP on the affected device. Note: The static credentials are defined in an internal configuration file and are not visible in the current operation configuration ('running-config') or the startup configuration ('startup-config'). • http://www.securityfocus.com/bid/104590 http://www.securitytracker.com/id/1041078 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-waas-snmp • CWE-798: Use of Hard-coded Credentials •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2017-6628
https://notcve.org/view.php?id=CVE-2017-6628
A vulnerability in SMART-SSL Accelerator functionality for Cisco Wide Area Application Services (WAAS) 6.2.1, 6.2.1a, and 6.2.3a could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition where the WAN optimization could stop functioning while the process restarts. The vulnerability is due to a Secure Sockets Layer/Transport Layer Security (SSL/TLS) alert being incorrectly handled when in a specific SSL/TLS connection state. An attacker could exploit this vulnerability by establishing a SMART-SSL connection through the targeted device. The attacker would then send a crafted stream of SSL/TLS traffic. An exploit could allow the attacker to cause a DoS condition where WAN optimization could stop processing traffic for a short period of time. • http://www.securityfocus.com/bid/98294 http://www.securitytracker.com/id/1038399 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170503-waas • CWE-399: Resource Management Errors CWE-755: Improper Handling of Exceptional Conditions •