cve,link,title,description,vendor,products,score,severity,epss,cisa,article,ransomware,exploited,poc,trended,trended_no_1,published,trended_score
CVE-2023-20057,https://securityvulnerability.io/vulnerability/CVE-2023-20057,,"A vulnerability in the URL filtering mechanism of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device.

 This vulnerability is due to improper processing of URLs. An attacker could exploit this vulnerability by crafting a URL in a particular way. A successful exploit could allow the attacker to bypass the URL reputation filters that are configured for an affected device, which could allow malicious URLs to pass through the device.",Cisco,Cisco Email Security Appliance (ESA),5.3,MEDIUM,0.0011099999537691474,false,false,false,false,,false,false,2023-01-20T07:15:00.000Z,0
CVE-2022-20798,https://securityvulnerability.io/vulnerability/CVE-2022-20798,Cisco Email Security Appliance and Cisco Secure Email and Web Manager External Authentication Bypass Vulnerability,"A vulnerability in the external authentication functionality of Cisco Secure Email and Web Manager, formerly known as Cisco Security Management Appliance (SMA), and Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass authentication and log in to the web management interface of an affected device. This vulnerability is due to improper authentication checks when an affected device uses Lightweight Directory Access Protocol (LDAP) for external authentication. An attacker could exploit this vulnerability by entering a specific input on the login page of the affected device. A successful exploit could allow the attacker to gain unauthorized access to the web-based management interface of the affected device.",Cisco,Cisco Email Security Appliance (esa),9.8,CRITICAL,0.004000000189989805,false,false,false,true,,false,false,2022-06-15T00:00:00.000Z,0
CVE-2022-20664,https://securityvulnerability.io/vulnerability/CVE-2022-20664,Cisco Email Security Appliance and Cisco Secure Email and Web Manager Information Disclosure Vulnerability,"A vulnerability in the web management interface of Cisco Secure Email and Web Manager, formerly Cisco Security Management Appliance (SMA), and Cisco Email Security Appliance (ESA) could allow an authenticated, remote attacker to retrieve sensitive information from a Lightweight Directory Access Protocol (LDAP) external authentication server connected to an affected device. This vulnerability is due to a lack of proper input sanitization while querying the external authentication server. An attacker could exploit this vulnerability by sending a crafted query through an external authentication web page. A successful exploit could allow the attacker to gain access to sensitive information, including user credentials from the external authentication server. To exploit this vulnerability, an attacker would need valid operator-level (or higher) credentials.",Cisco,Cisco Email Security Appliance (esa),7.7,HIGH,0.00107999995816499,false,false,false,true,,false,false,2022-06-15T00:00:00.000Z,0
CVE-2022-20653,https://securityvulnerability.io/vulnerability/CVE-2022-20653,Cisco Email Security Appliance DNS Verification Denial of Service Vulnerability,"A vulnerability in the DNS-based Authentication of Named Entities (DANE) email verification component of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient error handling in DNS name resolution by the affected software. An attacker could exploit this vulnerability by sending specially formatted email messages that are processed by an affected device. A successful exploit could allow the attacker to cause the device to become unreachable from management interfaces or to process additional email messages for a period of time until the device recovers, resulting in a DoS condition. Continued attacks could cause the device to become completely unavailable, resulting in a persistent DoS condition.",Cisco,Cisco Email Security Appliance (esa),7.5,HIGH,0.0015899999998509884,false,false,false,true,,false,false,2022-02-17T00:00:00.000Z,0
CVE-2021-34741,https://securityvulnerability.io/vulnerability/CVE-2021-34741,Cisco Email Security Appliance Denial of Service Vulnerability,"A vulnerability in the email scanning algorithm of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to perform a denial of service (DoS) attack against an affected device. This vulnerability is due to insufficient input validation of incoming emails. An attacker could exploit this vulnerability by sending a crafted email through Cisco ESA. A successful exploit could allow the attacker to exhaust all the available CPU resources on an affected device for an extended period of time, preventing other emails from being processed and resulting in a DoS condition.",Cisco,Cisco Email Security Appliance (esa),7.5,HIGH,0.0015899999998509884,false,false,false,true,,false,false,2021-11-04T16:15:00.000Z,0
CVE-2021-1534,https://securityvulnerability.io/vulnerability/CVE-2021-1534,Cisco Email Security Appliance URL Filtering Bypass Vulnerability,"A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. This vulnerability is due to improper processing of URLs. An attacker could exploit this vulnerability by crafting a URL in a particular way. A successful exploit could allow the attacker to bypass the URL reputation filters that are configured for an affected device, which could allow malicious URLs to pass through the device.",Cisco,Cisco Email Security Appliance (esa),5.8,MEDIUM,0.001290000043809414,false,false,false,true,,false,false,2021-10-06T00:00:00.000Z,0
CVE-2020-3568,https://securityvulnerability.io/vulnerability/CVE-2020-3568,Cisco Email Security Appliance URL Filtering Bypass Vulnerability,"A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. The vulnerability is due to insufficient input validation of URLs. An attacker could exploit this vulnerability by crafting a URL in a particular way. A successful exploit could allow the attacker to bypass the URL reputation filters that are configured for the affected device, which could allow malicious URLs to pass through the device.",Cisco,Cisco Email Security Appliance (esa),5.8,MEDIUM,0.001290000043809414,false,false,false,true,,false,false,2020-10-08T05:15:00.000Z,0
CVE-2020-3133,https://securityvulnerability.io/vulnerability/CVE-2020-3133,Cisco Email Security Appliance Content Filter Bypass Vulnerability,"A vulnerability in the email message scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass configured filters on the device. The vulnerability is due to improper validation of incoming emails. An attacker could exploit this vulnerability by sending a crafted email message to a recipient protected by the ESA. A successful exploit could allow the attacker to bypass the configured content filters, which could allow malicious content to pass through the device.",Cisco,Cisco Email Security Appliance (esa),5.8,MEDIUM,0.00139999995008111,false,false,false,true,,false,false,2020-09-23T01:15:00.000Z,0
CVE-2019-1983,https://securityvulnerability.io/vulnerability/CVE-2019-1983,Cisco Email Security Appliance and Cisco Content Security Management Appliance Denial of Service Vulnerability,"A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) and Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to cause repeated crashes in some internal processes that are running on the affected devices, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient input validation of email attachments. An attacker could exploit this vulnerability by sending an email message with a crafted attachment through an affected device. A successful exploit could allow the attacker to cause specific processes to crash repeatedly, resulting in the complete unavailability of both the Cisco Advanced Malware Protection (AMP) and message tracking features and in severe performance degradation while processing email. After the affected processes restart, the software resumes filtering for the same attachment, causing the affected processes to crash and restart again. A successful exploit could also allow the attacker to cause a repeated DoS condition. Manual intervention may be required to recover from this situation.",Cisco,Cisco Email Security Appliance (esa),7.5,HIGH,0.001500000013038516,false,false,false,true,,false,false,2020-09-23T01:15:00.000Z,0
CVE-2019-1947,https://securityvulnerability.io/vulnerability/CVE-2019-1947,Cisco Email Security Appliance Denial of Service Vulnerability,"A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause the CPU utilization to increase to 100 percent, causing a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of email messages that contain large attachments. An attacker could exploit this vulnerability by sending a malicious email message through the targeted device. A successful exploit could allow the attacker to cause a permanent DoS condition due to high CPU utilization. This vulnerability may require manual intervention to recover the ESA.",Cisco,Cisco Email Security Appliance (esa),8.6,HIGH,0.0015999999595806003,false,false,false,true,,false,false,2020-09-23T01:15:00.000Z,0
CVE-2020-3137,https://securityvulnerability.io/vulnerability/CVE-2020-3137,Cisco Email Security Appliance Cross-Site Scripting Vulnerability,"A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability exists because the web-based management interface of the affected device does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or to access sensitive, browser-based information.",Cisco,Cisco Email Security Appliance (esa),6.1,MEDIUM,0.001509999972768128,false,false,false,true,,false,false,2020-09-23T01:15:00.000Z,0
CVE-2020-3546,https://securityvulnerability.io/vulnerability/CVE-2020-3546,Cisco Email Security Appliance Information Disclosure Vulnerability,"A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to insufficient validation of requests that are sent to the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the interface of an affected device. A successful exploit could allow the attacker to obtain the IP addresses that are configured on the internal interfaces of the affected device. There is a workaround that addresses this vulnerability.",Cisco,Cisco Email Security Appliance (esa),5.3,MEDIUM,0.0013599999947473407,false,false,false,true,,false,false,2020-09-04T03:15:00.000Z,0
CVE-2020-3447,https://securityvulnerability.io/vulnerability/CVE-2020-3447,Cisco Email Security Appliance and Cisco Content Security Management Appliance Information Disclosure Vulnerability,"A vulnerability in the CLI of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to excessive verbosity in certain log subscriptions. An attacker could exploit this vulnerability by accessing specific log files on an affected device. A successful exploit could allow the attacker to obtain sensitive log data, which may include user credentials. To exploit this vulnerability, the attacker would need to have valid credentials at the operator level or higher on the affected device.",Cisco,Cisco Email Security Appliance (esa),5.5,MEDIUM,0.001500000013038516,false,false,false,true,,false,false,2020-08-17T18:15:00.000Z,0
CVE-2020-3370,https://securityvulnerability.io/vulnerability/CVE-2020-3370,Cisco Content Security Management Appliance Filter Bypass Vulnerability,"A vulnerability in URL filtering of Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to bypass URL filtering on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted, malicious HTTP request to an affected device. A successful exploit could allow the attacker to redirect users to malicious sites.",Cisco,Cisco Email Security Appliance (esa),4,MEDIUM,0.001290000043809414,false,false,false,true,,false,false,2020-07-16T18:15:00.000Z,0
CVE-2020-3368,https://securityvulnerability.io/vulnerability/CVE-2020-3368,Cisco Email Security Appliance URL Filtering Bypass Vulnerability,"A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. The vulnerability is due to insufficient input validation of URLs. An attacker could exploit this vulnerability by crafting the URL in a particular way. A successful exploit could allow the attacker to bypass the URL reputation filters that are configured for the affected device, which could allow malicious URLs to pass through the device.",Cisco,Cisco Email Security Appliance (esa),5.8,MEDIUM,0.001290000043809414,false,false,false,true,,false,false,2020-06-18T03:15:00.000Z,0
CVE-2020-3181,https://securityvulnerability.io/vulnerability/CVE-2020-3181,Cisco Email Security Appliance Uncontrolled Resource Exhaustion Vulnerability,A vulnerability in the malware detection functionality in Cisco Advanced Malware Protection (AMP) in Cisco AsyncOS Software for Cisco Email Security Appliances (ESAs) could allow an unauthenticated remote attacker to exhaust resources on an affected device. The vulnerability is due to insufficient control over system memory allocation. An attacker could exploit this vulnerability by sending a crafted email through the targeted device. A successful exploit could allow the attacker to cause an email attachment that contains malware to be delivered to a user and cause email processing delays.,Cisco,Cisco Email Security Appliance (esa),6.5,MEDIUM,0.001500000013038516,false,false,false,true,,false,false,2020-03-04T00:00:00.000Z,0
CVE-2020-3132,https://securityvulnerability.io/vulnerability/CVE-2020-3132,Cisco Email Security Appliance Shortened URL Denial of Service Vulnerability,"A vulnerability in the email message scanning feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause a temporary denial of service (DoS) condition on an affected device. The vulnerability is due to inadequate parsing mechanisms for specific email body components. An attacker could exploit this vulnerability by sending a malicious email containing a high number of shortened URLs through an affected device. A successful exploit could allow the attacker to consume processing resources, causing a DoS condition on an affected device. To successfully exploit this vulnerability, certain conditions beyond the control of the attacker must occur.",Cisco,Cisco Email Security Appliance (esa),6.8,MEDIUM,0.0015899999998509884,false,false,false,true,,false,false,2020-02-19T00:00:00.000Z,0
CVE-2020-3134,https://securityvulnerability.io/vulnerability/CVE-2020-3134,Cisco Email Security Appliance Zip Decompression Engine Denial of Service Vulnerability,"A vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper validation of zip files. An attacker could exploit this vulnerability by sending an email message with a crafted zip-compressed attachment. A successful exploit could trigger a restart of the content-scanning process, causing a temporary DoS condition. This vulnerability affects Cisco AsyncOS Software for Cisco ESA releases earlier than 13.0.",Cisco,Cisco Email Security Appliance (esa),6.5,MEDIUM,0.001500000013038516,false,false,false,false,,false,false,2020-01-26T05:15:00.000Z,0
CVE-2019-15988,https://securityvulnerability.io/vulnerability/CVE-2019-15988,Cisco Email Security Appliance URL Filtering Bypass Vulnerability,"A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. The vulnerability is due to insufficient input validation of URLs. An attacker could exploit this vulnerability by crafting the URL in a particular way. A successful exploit could allow the attacker to bypass the URL reputation filters that are configured for the affected device, which could allow malicious URLs to pass through the device.",Cisco,Cisco Email Security Appliance (esa),5.8,MEDIUM,0.001290000043809414,false,false,false,true,,false,false,2019-11-26T04:15:00.000Z,0
CVE-2019-15971,https://securityvulnerability.io/vulnerability/CVE-2019-15971,Cisco Email Security Appliance MP3 Content Filter Bypass Vulnerability,"A vulnerability in the MP3 detection engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass configured content filters on the device. The vulnerability is due to improper validation of certain MP3 file types. An attacker could exploit this vulnerability by sending a crafted MP3 file through the targeted device. A successful exploit could allow the attacker to bypass configured content filters that would normally drop the email.",Cisco,Cisco Email Security Appliance (esa),5.8,MEDIUM,0.0010900000343099236,false,false,false,true,,false,false,2019-11-26T04:15:00.000Z,0
CVE-2019-12706,https://securityvulnerability.io/vulnerability/CVE-2019-12706,Cisco Email Security Appliance Filter Bypass Vulnerability,"A vulnerability in the Sender Policy Framework (SPF) functionality of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the configured user filters on an affected device. The vulnerability exists because the affected software insufficiently validates certain incoming SPF messages. An attacker could exploit this vulnerability by sending a custom SPF packet to an affected device. A successful exploit could allow the attacker to bypass the configured header filters, which could allow malicious content to pass through the device.",Cisco,Cisco Email Security Appliance (esa),6.5,MEDIUM,0.00139999995008111,false,false,false,true,,false,false,2019-10-02T00:00:00.000Z,0
CVE-2019-1955,https://securityvulnerability.io/vulnerability/CVE-2019-1955,Cisco Email Security Appliance Header Injection Vulnerability,"A vulnerability in the Sender Policy Framework (SPF) functionality of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to bypass configured user filters on the device. The vulnerability is due to incomplete input and validation checking mechanisms for certain SPF messages that are sent to an affected device. An attacker could exploit this vulnerability by sending a customized SPF packet to an affected device. A successful exploit could allow the attacker to bypass the header filters that are configured for the affected device, which could allow malicious content to pass through the device.",Cisco,Cisco Email Security Appliance (esa),5.3,MEDIUM,0.00139999995008111,false,false,false,true,,false,false,2019-08-08T08:15:00.000Z,0
CVE-2019-1921,https://securityvulnerability.io/vulnerability/CVE-2019-1921,Cisco Email Security Appliance Content Filter Bypass Vulnerability,"A vulnerability in the attachment scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass configured content filters on the device. The vulnerability is due to improper input validation of the email body. An attacker could exploit this vulnerability by naming a malicious attachment with a specific pattern. A successful exploit could allow the attacker to bypass configured content filters that would normally block the attachment.",Cisco,Cisco Email Security Appliance (esa),5.8,MEDIUM,0.00139999995008111,false,false,false,true,,false,false,2019-07-06T02:15:00.000Z,0
CVE-2019-1933,https://securityvulnerability.io/vulnerability/CVE-2019-1933,Cisco Email Security Appliance Content Filter Bypass Vulnerability,"A vulnerability in the email message scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass configured filters on the device. The vulnerability is due to improper input validation of certain email fields. An attacker could exploit this vulnerability by sending a crafted email message to a recipient protected by the ESA. A successful exploit could allow the attacker to bypass configured message filters and inject arbitrary scripting code inside the email body. The malicious code is not executed by default unless the recipient's email client is configured to execute scripts contained in emails.",Cisco,Cisco Email Security Appliance (esa),5.8,MEDIUM,0.0012199999764561653,false,false,false,true,,false,false,2019-07-06T02:15:00.000Z,0
CVE-2019-1905,https://securityvulnerability.io/vulnerability/CVE-2019-1905,Cisco Email Security Appliance GZIP Content Filter Bypass Vulnerability,"A vulnerability in the GZIP decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass configured content filters on the device. The vulnerability is due to improper validation of GZIP-formatted files. An attacker could exploit this vulnerability by sending a malicious file inside a crafted GZIP-compressed file. A successful exploit could allow the attacker to bypass configured content filters that would normally drop the email.",Cisco,Cisco Email Security Appliance (esa),5.8,MEDIUM,0.0007099999929778278,false,false,false,true,,false,false,2019-06-20T03:15:00.000Z,0