Cisco Email Security Appliance Firmware vulnerabilities

27 CVEs affecting Cisco Email Security Appliance Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-20772, published 2022-11-04.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-6406, published 2016-09-22. Critical severity, CVSS 9.8. EPSS: 3.6% chance of exploitation in the next 30 days. Cisco IronPort AsyncOS 9.1.2-023, 9.1.2-028, 9.1.2-036, 9.7.2-046, 9.7.2-047, 9.7.2-054, 10.0.0-124, and 10.0.0-125 on Email Security Appliance (ESA) devices, when Enrollment Client before 1.0.2-065…
CVE-2019-15961, published 2020-01-15. Medium severity, CVSS 6.5. EPSS: 3.1% chance of exploitation in the next 30 days. A vulnerability in the email parsing module Clam AntiVirus (ClamAV) Software versions 0.102.0, 0.101.4 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition…
CVE-2014-2119, published 2014-03-21. High severity, CVSS 8.5. EPSS: 2.7% chance of exploitation in the next 30 days. The End User Safelist/Blocklist (aka SLBL) service in Cisco AsyncOS Software for Email Security Appliance (ESA) before 7.6.3-023 and 8.x before 8.0.1-023 and Cisco Content Security Management…
CVE-2014-3289, published 2014-06-10. Medium severity, CVSS 4.3. EPSS: 2.4% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the web management interface in Cisco AsyncOS on the Email Security Appliance (ESA) 8.0, Web Security Appliance (WSA) 8.0 (.5 Hot Patch 1) and earlier, and…
CVE-2015-4236, published 2015-07-10. Medium severity, CVSS 4.3. EPSS: 2.4% chance of exploitation in the next 30 days. Cisco AsyncOS on Email Security Appliance (ESA) devices with software 8.5.6-073, 8.5.6-074, and 9.0.0-461, when clustering is enabled, allows remote attackers to cause a denial of service (clustering…
CVE-2018-15453, published 2019-01-10. High severity, CVSS 8.6. EPSS: 2.3% chance of exploitation in the next 30 days. A vulnerability in the Secure/Multipurpose Internet Mail Extensions (S/MIME) Decryption and Verification or S/MIME Public Key Harvesting features of Cisco AsyncOS Software for Cisco Email Security…
CVE-2017-3818, published 2017-02-03. Medium severity, CVSS 5.8. EPSS: 2.2% chance of exploitation in the next 30 days. A vulnerability in the Multipurpose Internet Mail Extensions (MIME) scanner of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to…
CVE-2016-6458, published 2016-11-19. High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days. A vulnerability in the content filtering functionality of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an unauthenticated, remote attacker to bypass content filters…
CVE-2015-0624, published 2015-02-21. Medium severity, CVSS 4.3. EPSS: 2.2% chance of exploitation in the next 30 days. The web framework in Cisco AsyncOS on Email Security Appliance (ESA), Content Security Management Appliance (SMA), and Web Security Appliance (WSA) devices allows remote attackers to trigger…
CVE-2016-6462, published 2016-11-19. Medium severity, CVSS 5.3. EPSS: 2% chance of exploitation in the next 30 days. A vulnerability in the email filtering functionality of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an unauthenticated, remote attacker to bypass Advanced Malware…

Latest

CVE-2022-20772, published 2022-11-04. Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability in Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. This…
CVE-2019-15988, published 2019-11-26. Medium severity, CVSS 5.3. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the URL reputation…
CVE-2019-15971, published 2019-11-26. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability in the MP3 detection engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass configured content filters on…
CVE-2019-12706, published 2019-10-02. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability in the Sender Policy Framework (SPF) functionality of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the…
CVE-2019-1955, published 2019-08-08. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. A vulnerability in the Sender Policy Framework (SPF) functionality of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to bypass…
CVE-2018-0140, published 2018-02-08. Medium severity, CVSS 6.5. EPSS: 1.6% chance of exploitation in the next 30 days. A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance could allow an authenticated, remote attacker to download any message from the…
CVE-2017-12309, published 2017-11-16. Medium severity, CVSS 5.3. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability in the Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to conduct a HTTP response splitting attack. The vulnerability is due to the failure of the…
CVE-2017-6671, published 2017-06-13. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. A vulnerability in the email message scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass configured filters on the…