Cisco Cloud Web Security vulnerabilities

3 CVEs affecting Cisco Cloud Web Security, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-3154, published 2020-02-19.

More from Cisco.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2015-0689, published 2017-09-19. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. Cisco Cloud Web Security before 3.0.1.7 allows remote attackers to bypass intended filtering protection mechanisms by leveraging improper handling of HTTP methods, aka Bug ID CSCut69743.
• CVE-2020-3154, published 2020-02-19. Medium severity, CVSS 4.9. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability in the web UI of Cisco Cloud Web Security (CWS) could allow an authenticated, remote attacker to execute arbitrary SQL queries. The vulnerability exists because the web-based…
• CVE-2015-0674, published 2017-07-25. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the Alert Service of Cisco Cloud Web Security base revision allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.