Cisco Email Security Appliance vulnerabilities

50 CVEs affecting Cisco Email Security Appliance, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-3548, published 2024-11-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-4184, published 2015-06-13. Medium severity, CVSS 5.0. EPSS: 3.5% chance of exploitation in the next 30 days. The anti-spam scanner on Cisco Email Security Appliance (ESA) devices 3.3.1-09, 7.5.1-gpl-022, and 8.5.6-074 allows remote attackers to bypass intended e-mail restrictions via a malformed DNS SPF…
CVE-2016-1405, published 2016-06-08. High severity, CVSS 7.5. EPSS: 3.4% chance of exploitation in the next 30 days. libclamav in ClamAV (aka Clam AntiVirus), as used in Advanced Malware Protection (AMP) on Cisco Email Security Appliance (ESA) devices before 9.7.0-125 and Web Security Appliance (WSA) devices before…
CVE-2016-1481, published 2016-10-28. High severity, CVSS 7.5. EPSS: 3% chance of exploitation in the next 30 days. A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an unauthenticated, remote attacker to cause a denial of service (DoS)…
CVE-2016-6356, published 2016-10-28. High severity, CVSS 7.5. EPSS: 3% chance of exploitation in the next 30 days. A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an unauthenticated, remote attacker to cause an affected device to…
CVE-2016-1486, published 2016-10-28. High severity, CVSS 7.5. EPSS: 3% chance of exploitation in the next 30 days. A vulnerability in the email attachment scanning functionality of the Advanced Malware Protection (AMP) feature of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an…
CVE-2018-0419, published 2018-08-15. High severity, CVSS 7.5. EPSS: 2.8% chance of exploitation in the next 30 days. A vulnerability in certain attachment detection mechanisms of Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to bypass the filtering functionality of an…
CVE-2015-6321, published 2015-11-06. High severity, CVSS 7.8. EPSS: 2.8% chance of exploitation in the next 30 days. Cisco AsyncOS before 8.5.7-042, 9.x before 9.1.0-032, 9.1.x before 9.1.1-023, and 9.5.x and 9.6.x before 9.6.0-042 on Email Security Appliance (ESA) devices; before 9.1.0-032, 9.1.1 before 9.1.1-005,…
CVE-2016-6357, published 2016-10-28. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. A vulnerability in the configured security policies, including drop email filtering, in Cisco AsyncOS for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to…
CVE-2016-1480, published 2016-10-28. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. A vulnerability in the Multipurpose Internet Mail Extensions (MIME) scanner of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) and Web Security Appliances (WSA) could allow an…
CVE-2015-4236, published 2015-07-10. Medium severity, CVSS 4.3. EPSS: 2.4% chance of exploitation in the next 30 days. Cisco AsyncOS on Email Security Appliance (ESA) devices with software 8.5.6-073, 8.5.6-074, and 9.0.0-461, when clustering is enabled, allows remote attackers to cause a denial of service (clustering…

Latest

CVE-2020-3548, published 2024-11-18. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability in the Transport Layer Security (TLS) protocol implementation of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote…
CVE-2023-20075, published 2023-03-01. Medium severity, CVSS 6.7. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the CLI of Cisco Secure Email Gateway could allow an authenticated, remote attacker to execute arbitrary commands. These vulnerability is due to improper input validation in the…
CVE-2023-20009, published 2023-03-01. High severity, CVSS 7.2. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability in the Web UI and administrative CLI of the Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA) could allow an authenticated remote attacker and or…
CVE-2022-20960, published 2022-11-04. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability in Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition on an affected…
CVE-2022-20798, published 2022-06-15. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. A vulnerability in the external authentication functionality of Cisco Secure Email and Web Manager, formerly known as Cisco Security Management Appliance (SMA), and Cisco Email Security Appliance…
CVE-2022-20664, published 2022-06-15. High severity, CVSS 7.7. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability in the web management interface of Cisco Secure Email and Web Manager, formerly Cisco Security Management Appliance (SMA), and Cisco Email Security Appliance (ESA) could allow an…
CVE-2021-1566, published 2021-06-16. High severity, CVSS 7.4. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability in the Cisco Advanced Malware Protection (AMP) for Endpoints integration of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco Web Security Appliance (WSA) could allow…
CVE-2021-1516, published 2021-05-06. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA), Cisco Email Security Appliance (ESA), and Cisco Web Security…
CVE-2021-1129, published 2021-01-20. Medium severity, CVSS 5.3. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability in the authentication for the general purpose APIs implementation of Cisco Email Security Appliance (ESA), Cisco Content Security Management Appliance (SMA), and Cisco Web Security…
CVE-2020-3137, published 2020-09-23. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a…