Cisco Content Security Management Appliance vulnerabilities

27 CVEs affecting Cisco Content Security Management Appliance, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-1516, published 2021-05-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-2183, published 2016-09-01. High severity, CVSS 7.5. EPSS: 94.7% chance of exploitation in the next 30 days. The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for…
CVE-2015-6321, published 2015-11-06. High severity, CVSS 7.8. EPSS: 2.8% chance of exploitation in the next 30 days. Cisco AsyncOS before 8.5.7-042, 9.x before 9.1.0-032, 9.1.x before 9.1.1-023, and 9.5.x and 9.6.x before 9.6.0-042 on Email Security Appliance (ESA) devices; before 9.1.0-032, 9.1.1 before 9.1.1-005,…
CVE-2014-2119, published 2014-03-21. High severity, CVSS 8.5. EPSS: 2.7% chance of exploitation in the next 30 days. The End User Safelist/Blocklist (aka SLBL) service in Cisco AsyncOS Software for Email Security Appliance (ESA) before 7.6.3-023 and 8.x before 8.0.1-023 and Cisco Content Security Management…
CVE-2014-3289, published 2014-06-10. Medium severity, CVSS 4.3. EPSS: 2.4% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the web management interface in Cisco AsyncOS on the Email Security Appliance (ESA) 8.0, Web Security Appliance (WSA) 8.0 (.5 Hot Patch 1) and earlier, and…
CVE-2015-6288, published 2015-09-14. Medium severity, CVSS 5.0. EPSS: 2.2% chance of exploitation in the next 30 days. Cisco Content Security Management Appliance (SMA) 7.8.0-000 does not properly validate credentials, which allows remote attackers to cause a denial of service (rapid log-file rollover and application…
CVE-2015-0624, published 2015-02-21. Medium severity, CVSS 4.3. EPSS: 2.2% chance of exploitation in the next 30 days. The web framework in Cisco AsyncOS on Email Security Appliance (ESA), Content Security Management Appliance (SMA), and Web Security Appliance (WSA) devices allows remote attackers to trigger…
CVE-2016-6416, published 2016-10-05. Medium severity, CVSS 5.9. EPSS: 2% chance of exploitation in the next 30 days. The FTP service in Cisco AsyncOS on Email Security Appliance (ESA) devices 9.6.0-000 through 9.9.6-026, Web Security Appliance (WSA) devices 9.0.0-162 through 9.5.0-444, and Content Security…
CVE-2019-1983, published 2020-09-23. Medium severity, CVSS 5.3. EPSS: 1.9% chance of exploitation in the next 30 days. A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) and Cisco Content Security Management Appliance (SMA) could allow an…
CVE-2015-4322, published 2015-08-19. Medium severity, CVSS 5.5. EPSS: 1.7% chance of exploitation in the next 30 days. Cisco Content Security Management Appliance (SMA) 8.3.6-039, 9.1.0-31, and 9.1.0-103 improperly restricts the privileges available after LDAP authentication, which allows remote authenticated users…
CVE-2018-0140, published 2018-02-08. Medium severity, CVSS 6.5. EPSS: 1.6% chance of exploitation in the next 30 days. A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance could allow an authenticated, remote attacker to download any message from the…

Latest

CVE-2021-1516, published 2021-05-06. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA), Cisco Email Security Appliance (ESA), and Cisco Web Security…
CVE-2021-1447, published 2021-05-06. Medium severity, CVSS 6.7. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability in the user account management system of Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) could allow an authenticated, local attacker to elevate their privileges…
CVE-2021-1129, published 2021-01-20. Medium severity, CVSS 5.3. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability in the authentication for the general purpose APIs implementation of Cisco Email Security Appliance (ESA), Cisco Content Security Management Appliance (SMA), and Cisco Web Security…
CVE-2020-3117, published 2020-09-23. Medium severity, CVSS 4.7. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability in the API Framework of Cisco AsyncOS for Cisco Web Security Appliance (WSA) and Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to…
CVE-2020-3447, published 2020-08-17. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability in the CLI of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) could allow an authenticated, remote…
CVE-2020-3178, published 2020-05-06. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. Multiple vulnerabilities in the web-based GUI of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to redirect a user to a…
CVE-2020-3164, published 2020-03-04. Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Email Security Appliance (ESA), Cisco Web Security Appliance (WSA), and Cisco Content Security Management Appliance…
CVE-2019-12635, published 2019-09-05. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability in the authorization module of Cisco Content Security Management Appliance (SMA) Software could allow an authenticated, remote attacker to gain out-of-scope access to email. The…
CVE-2018-15393, published 2018-11-08. Medium severity, CVSS 6.1. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Content Security Management Appliance (SMA) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting…