Broadcom Advanced Secure Gateway vulnerabilities

16 CVEs affecting Broadcom Advanced Secure Gateway, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-23955, published 2023-06-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-13677, published 2018-04-11. High severity, CVSS 7.5. EPSS: 5% chance of exploitation in the next 30 days. Denial-of-service (DoS) vulnerability in the Symantec Advanced Secure Gateway (ASG) and ProxySG management consoles. A remote attacker can use crafted HTTP/HTTPS requests to cause denial-of-service…
CVE-2016-10258, published 2018-04-11. Medium severity, CVSS 6.8. EPSS: 4.8% chance of exploitation in the next 30 days. Unrestricted file upload vulnerability in the Symantec Advanced Secure Gateway (ASG) and ProxySG management consoles. A malicious appliance administrator can upload arbitrary malicious files to the…
CVE-2018-5241, published 2018-05-29. Critical severity, CVSS 9.8. EPSS: 4.5% chance of exploitation in the next 30 days. Symantec Advanced Secure Gateway (ASG) 6.6 and 6.7, and ProxySG 6.5, 6.6, and 6.7 are susceptible to a SAML authentication bypass vulnerability. The products can be configured with a SAML…
CVE-2016-9097, published 2017-05-11. High severity, CVSS 7.2. EPSS: 2.4% chance of exploitation in the next 30 days. The Symantec Advanced Secure Gateway (ASG) 6.6 prior to 6.6.5.8, ProxySG 6.5 prior 6.5.10.6, ProxySG 6.6 prior to 6.6.5.8, and ProxySG 6.7 prior to 6.7.1.2 management consoles do not, under certain…
CVE-2016-9099, published 2017-05-11. Medium severity, CVSS 6.1. EPSS: 1.8% chance of exploitation in the next 30 days. Symantec Advanced Secure Gateway (ASG) 6.6, ASG 6.7 prior to 6.7.2.1, ProxySG 6.5 prior to 6.5.10.6, ProxySG 6.6, and ProxySG 6.7 prior to 6.7.2.1 are susceptible to an open redirection…
CVE-2021-46825, published 2022-07-07. Critical severity, CVSS 9.1. EPSS: 1.6% chance of exploitation in the next 30 days. Symantec Advanced Secure Gateway (ASG) and ProxySG are susceptible to an HTTP desync vulnerability. When a remote unauthenticated attacker and other web clients communicate through the proxy with the…
CVE-2016-10257, published 2018-01-10. Medium severity, CVSS 6.1. EPSS: 1.5% chance of exploitation in the next 30 days. The Symantec Advanced Secure Gateway (ASG) 6.6, ASG 6.7 (prior to 6.7.2.1), ProxySG 6.5 (prior to 6.5.10.6), ProxySG 6.6, and ProxySG 6.7 (prior to 6.7.2.1) management console is susceptible to a…
CVE-2023-23952, published 2023-06-01. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Command Injection vulnerability.
CVE-2019-18375, published 2020-04-10. Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days. The ASG and ProxySG management consoles are susceptible to a session hijacking vulnerability. A remote attacker, with access to the appliance management interface, can hijack the session of a…
CVE-2017-13678, published 2018-04-11. Medium severity, CVSS 4.8. EPSS: 1% chance of exploitation in the next 30 days. Stored XSS vulnerability in the Symantec Advanced Secure Gateway (ASG) and ProxySG management consoles. A malicious appliance administrator can inject arbitrary JavaScript code in the management…

Latest

CVE-2023-23955, published 2023-06-01. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Server-Side Request Forgery vulnerability.
CVE-2023-23954, published 2023-06-01. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Stored Cross-Site Scripting vulnerability.
CVE-2023-23953, published 2023-06-01. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to an Elevation of Privilege vulnerability.
CVE-2018-18371, published 2019-08-30. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web browser. An information disclosure vulnerability in the WebFTP…
CVE-2018-18370, published 2019-08-30. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web browser. A stored cross-site scripting (XSS) vulnerability in…