Cisco Web Security Appliance vulnerabilities

65 CVEs affecting Cisco Web Security Appliance, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-20120, published 2023-06-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-20032, published 2023-03-01. Critical severity, CVSS 9.8. EPSS: 29.3% chance of exploitation in the next 30 days. On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and…
CVE-2017-6746, published 2017-07-25. High severity, CVSS 7.2. EPSS: 4.4% chance of exploitation in the next 30 days. A vulnerability in the web interface of the Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to perform command injection and elevate privileges to root. The attacker…
CVE-2018-0410, published 2018-08-15. High severity, CVSS 8.6. EPSS: 4.1% chance of exploitation in the next 30 days. A vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliances could allow an unauthenticated, remote attacker to exhaust system memory and cause a denial…
CVE-2018-0353, published 2018-06-07. High severity, CVSS 7.5. EPSS: 3.8% chance of exploitation in the next 30 days. A vulnerability in traffic-monitoring functions in Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to circumvent Layer 4 Traffic Monitor (L4TM) functionality and…
CVE-2016-1405, published 2016-06-08. High severity, CVSS 7.5. EPSS: 3.4% chance of exploitation in the next 30 days. libclamav in ClamAV (aka Clam AntiVirus), as used in Advanced Malware Protection (AMP) on Cisco Email Security Appliance (ESA) devices before 9.7.0-125 and Web Security Appliance (WSA) devices before…
CVE-2016-9212, published 2016-12-14. High severity, CVSS 7.5. EPSS: 2.8% chance of exploitation in the next 30 days. A vulnerability in the Decrypt for End-User Notification configuration parameter of Cisco AsyncOS Software for Cisco Web Security Appliances could allow an unauthenticated, remote attacker to connect…
CVE-2015-6321, published 2015-11-06. High severity, CVSS 7.8. EPSS: 2.8% chance of exploitation in the next 30 days. Cisco AsyncOS before 8.5.7-042, 9.x before 9.1.0-032, 9.1.x before 9.1.1-023, and 9.5.x and 9.6.x before 9.6.0-042 on Email Security Appliance (ESA) devices; before 9.1.0-032, 9.1.1 before 9.1.1-005,…
CVE-2017-6750, published 2017-07-25. High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days. A vulnerability in AsyncOS for the Cisco Web Security Appliance (WSA) could allow an unauthenticated, local attacker to log in to the device with the privileges of a limited user or an…
CVE-2016-6407, published 2016-09-17. High severity, CVSS 7.5. EPSS: 2.5% chance of exploitation in the next 30 days. Cisco AsyncOS through 9.5.0-444 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (link saturation) by making many HTTP requests for overlapping byte ranges…
CVE-2014-3289, published 2014-06-10. Medium severity, CVSS 4.3. EPSS: 2.4% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the web management interface in Cisco AsyncOS on the Email Security Appliance (ESA) 8.0, Web Security Appliance (WSA) 8.0 (.5 Hot Patch 1) and earlier, and…

Latest

CVE-2023-20120, published 2023-06-28. Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days. Multiple vulnerabilities in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager; Cisco Secure Email Gateway, formerly Cisco Email Security Appliance…
CVE-2023-20119, published 2023-06-28. Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, formerly known as Content Security Management Appliance (SMA) could allow an…
CVE-2023-20028, published 2023-06-28. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. Multiple vulnerabilities in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager; Cisco Secure Email Gateway, formerly Cisco Email Security Appliance…
CVE-2022-20784, published 2022-04-06. Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability in the Web-Based Reputation Score (WBRS) engine of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to bypass established…
CVE-2021-1359, published 2021-07-08. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. A vulnerability in the configuration management of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to perform command injection and elevate…
CVE-2021-1566, published 2021-06-16. High severity, CVSS 7.4. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability in the Cisco Advanced Malware Protection (AMP) for Endpoints integration of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco Web Security Appliance (WSA) could allow…
CVE-2021-1516, published 2021-05-06. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA), Cisco Email Security Appliance (ESA), and Cisco Web Security…
CVE-2021-1490, published 2021-05-06. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS)…
CVE-2021-1129, published 2021-01-20. Medium severity, CVSS 5.3. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability in the authentication for the general purpose APIs implementation of Cisco Email Security Appliance (ESA), Cisco Content Security Management Appliance (SMA), and Cisco Web Security…