Cisco Ironport Asyncos vulnerabilities

7 CVEs affecting Cisco Ironport Asyncos, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2014-3289, published 2014-06-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-3384, published 2013-06-27. High severity, CVSS 9.0. EPSS: 3.5% chance of exploitation in the next 30 days. The web framework in IronPort AsyncOS on Cisco Web Security Appliance devices before 7.1.3-013, 7.5 before 7.5.0-838, and 7.7 before 7.7.0-550; Email Security Appliance devices before 7.1.5-104, 7.3…
CVE-2013-3383, published 2013-06-27. High severity, CVSS 9.0. EPSS: 3% chance of exploitation in the next 30 days. The web framework in IronPort AsyncOS on Cisco Web Security Appliance devices before 7.1.3-013, 7.5 before 7.5.0-838, and 7.7 before 7.7.0-550 allows remote authenticated users to execute arbitrary…
CVE-2013-3385, published 2013-06-27. High severity, CVSS 7.8. EPSS: 2.7% chance of exploitation in the next 30 days. The management GUI in the web framework in IronPort AsyncOS on Cisco Web Security Appliance devices before 7.1.3-013, 7.5 before 7.5.0-838, and 7.7 before 7.7.0-602; Email Security Appliance devices…
CVE-2014-2119, published 2014-03-21. High severity, CVSS 8.5. EPSS: 2.7% chance of exploitation in the next 30 days. The End User Safelist/Blocklist (aka SLBL) service in Cisco AsyncOS Software for Email Security Appliance (ESA) before 7.6.3-023 and 8.x before 8.0.1-023 and Cisco Content Security Management…
CVE-2014-3289, published 2014-06-10. Medium severity, CVSS 4.3. EPSS: 2.4% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the web management interface in Cisco AsyncOS on the Email Security Appliance (ESA) 8.0, Web Security Appliance (WSA) 8.0 (.5 Hot Patch 1) and earlier, and…
CVE-2013-3386, published 2013-06-27. High severity, CVSS 7.8. EPSS: 1.9% chance of exploitation in the next 30 days. The IronPort Spam Quarantine (ISQ) component in the web framework in IronPort AsyncOS on Cisco Email Security Appliance devices before 7.1.5-106 and 7.3, 7.5, and 7.6 before 7.6.3-019 and Content…
CVE-2009-1162, published 2009-06-05. Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the Spam Quarantine login page in Cisco IronPort AsyncOS before 6.5.2 on Series C, M, and X appliances allows remote attackers to inject arbitrary web…