Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2768▼ 428 respecto a la semana anterior
Críticas / altas1324▼ 116 respecto a la semana anterior
Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)265▼ 243 respecto a la semana anterior
156 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Modificada | Media (5) | 2.0% | — | Cisco WEB Security Virtual Appliance | 14/9/2015 | 17/6/2026 | Cisco Web Security Appliance (WSA) 8.0.6-078 and 8.0.6-115 allows remote attackers to cause a denial of service (service outage) via a flood of TCP traffic that leads to DNS resolution delays, aka Bug IDs CSCur32005 and CSCur07907. | |
| Modificada | Media (4.3) | 0.48% | — | Cisco WEB Security ApplianceCisco Email Security ApplianceCisco Content Security Management Appliance | 29/7/2015 | 17/6/2026 | The LDAP implementation on the Cisco Web Security Appliance (WSA) 8.5.0-000, Email Security Appliance (ESA) 8.5.7-042, and Content Security Management Appliance (SMA) 8.3.6-048 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive… | |
| Modificada | Media (4.3) | 1.8% | — | Cisco WEB Security ApplianceCisco Content Security Management Virtual ApplianceCisco Email Security Appliance Firmware | 29/7/2015 | 17/6/2026 | Cross-site scripting (XSS) vulnerability in Cisco AsyncOS on the Web Security Appliance (WSA) 9.0.0-193; Email Security Appliance (ESA) 8.5.6-113, 9.1.0-032, 9.1.1-000, and 9.6.0-000; and Content Security Management Appliance (SMA) 9.1.0-033 allows remote attackers to inject arbitrary web script or HTML via an… | |
| Modificada | Media (4.3) | 2.2% | — | Cisco Content Security Management Virtual ApplianceCisco Email Security Virtual ApplianceCisco WEB Security Virtual Appliance | 26/6/2015 | 17/6/2026 | The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices before 2015-06-25 uses the same default SSH host keys across different customers' installations, which makes it easier for remote attackers to… | |
| Modificada | Media (5) | 3.3% | — | Cisco Content Security Management Virtual ApplianceCisco Email Security Virtual ApplianceCisco WEB Security Virtual Appliance | 26/6/2015 | 17/6/2026 | The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices before 2015-06-25 uses the same default SSH root authorized key across different customers' installations, which makes it easier for remote… | |
| Modificada | Media (4.3) | 2.1% | — | Cisco WEB Security Appliance | 20/6/2015 | 17/6/2026 | Cross-site scripting (XSS) vulnerability in the web framework on Cisco Web Security Appliance (WSA) devices with software 8.5.0-497 allows remote attackers to inject arbitrary web script or HTML via an unspecified HTTP header, aka Bug ID CSCuu24409. | |
| Modificada | Media (4.3) | 1.5% | — | Cisco WEB Security Appliance | 17/5/2015 | 17/6/2026 | Cross-site scripting (XSS) vulnerability in the Web Tracking Report page on Cisco Web Security Appliance (WSA) devices 8.5.0-497 allows remote attackers to inject arbitrary web script or HTML via an unspecified field, aka Bug ID CSCuu16008. | |
| Modificada | Media (4.3) | 1.5% | — | Cisco WEB Security Appliance | 15/4/2015 | 17/6/2026 | Multiple cross-site scripting (XSS) vulnerabilities in filter search forms in admin web pages on Cisco Web Security Appliance (WSA) devices with software 8.5.0-497 allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCut39213. | |
| Modificada | Alta (7.2) | 0.38% | — | Cisco WEB Security Appliance | 15/4/2015 | 17/6/2026 | Cisco Web Security Appliance (WSA) devices with software 8.5.0-ise-147 do not properly restrict use of the pickle Python module during certain tunnel-status checks, which allows local users to execute arbitrary Python code and gain privileges via a crafted pickle file, aka Bug ID CSCut39259. | |
| Modificada | Alta (7.2) | 0.38% | — | Cisco WEB Security Appliance | 11/4/2015 | 17/6/2026 | Cisco Web Security Appliance (WSA) devices with software 8.5.0-ise-147 do not properly restrict use of the pickle Python module during certain tunnel-status checks, which allows local users to execute arbitrary Python code and gain privileges via crafted serialized objects, aka Bug ID CSCut39230. | |
| Modificada | Media (4.3) | 2.5% | — | Websense Triton AP WEBWebsense Triton WEB FilterWebsense Triton WEB SecurityWebsense Triton WEB Security Gateway+1 | 25/3/2015 | 17/6/2026 | Multiple cross-site scripting (XSS) vulnerabilities in the Investigative Reports in Websense TRITON AP-WEB before 8.0.0 and Web Security and Filter, Web Security Gateway, and Web Security Gateway Anywhere 7.8.3 before Hotfix 02 and 7.8.4 before Hotfix 01 allow remote attackers to inject arbitrary web script or HTML… | |
| Modificada | Media (4.3) | 2.2% | — | Cisco Content Security Management ApplianceCisco WEB Security ApplianceCisco Email Security Appliance Firmware | 21/2/2015 | 17/6/2026 | The web framework in Cisco AsyncOS on Email Security Appliance (ESA), Content Security Management Appliance (SMA), and Web Security Appliance (WSA) devices allows remote attackers to trigger redirects via a crafted HTTP header, aka Bug IDs CSCur44412, CSCur44415, CSCur89630, CSCur89636, CSCur89633, and CSCur89639. | |
| Modificada | Media (5) | 1.2% | — | Cisco WEB Security Appliance | 20/2/2015 | 17/6/2026 | The proxy engine on Cisco Web Security Appliance (WSA) devices allows remote attackers to bypass intended proxying restrictions via a malformed HTTP method, aka Bug ID CSCus79174. | |
| Modificada | Media (4.3) | 0.94% | — | Cisco WEB Security Appliance | 19/2/2015 | 17/6/2026 | Cross-site scripting (XSS) vulnerability in the Administrator report page on Cisco Web Security Appliance (WSA) devices allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCus40627. | |
| Modificada | Media (4) | 1.5% | — | Trendmicro Interscan WEB Security Virtual Appliance | 7/11/2014 | 17/6/2026 | The AdminUI in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) before 6.0 HF build 1244 allows remote authenticated users to read arbitrary files via vectors related to configuration input when saving filters. | |
| Modificada | Media (4.3) | 2.4% | — | Cisco Ironport AsyncosCisco WEB Security ApplianceCisco Content Security Management ApplianceCisco Email Security Appliance Firmware | 10/6/2014 | 17/6/2026 | Cross-site scripting (XSS) vulnerability in the web management interface in Cisco AsyncOS on the Email Security Appliance (ESA) 8.0, Web Security Appliance (WSA) 8.0 (.5 Hot Patch 1) and earlier, and Content Security Management Appliance (SMA) 8.3 and earlier allows remote attackers to inject arbitrary web script or… | |
| Modificada | Baja (3.5) | 1.3% | — | Websense Triton Unified Security CenterWebsense Triton WEB FilterWebsense Triton WEB SecurityWebsense Triton WEB Security Gateway+1 | 12/4/2014 | 17/6/2026 | The Settings module in Websense Triton Unified Security Center 7.7.3 before Hotfix 31, Web Filter 7.7.3 before Hotfix 31, Web Security 7.7.3 before Hotfix 31, Web Security Gateway 7.7.3 before Hotfix 31, and Web Security Gateway Anywhere 7.7.3 before Hotfix 31 allows remote authenticated users to read cleartext… | |
| Modificada | Media (4.3) | 0.95% | — | Cisco WEB Security Virtual ApplianceCisco WEB Security Appliance | 2/4/2014 | 17/6/2026 | CRLF injection vulnerability in the web framework in Cisco Web Security Appliance (WSA) 7.7 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks via a crafted URL, aka Bug ID CSCuj61002. | |
| Modificada | Alta (7.8) | 1.3% | — | Cisco WEB Security ApplianceCisco Content Security Management ApplianceCisco Email Security Appliance Firmware | 24/10/2013 | 16/6/2026 | The web framework on Cisco Web Security Appliance (WSA), Email Security Appliance (ESA), and Content Security Management Appliance (SMA) devices does not properly manage the state of HTTP and HTTPS sessions, which allows remote attackers to cause a denial of service (management GUI outage) via multiple TCP… | |
| Modificada | Media (6.8) | 0.58% | — | Cisco Content Security Management ApplianceCisco WEB Security ApplianceCisco Email Security Appliance Firmware | 2/7/2013 | 16/6/2026 | Cross-site request forgery (CSRF) vulnerability in the web framework on Cisco IronPort Web Security Appliance (WSA) devices, Email Security Appliance (ESA) devices, and Content Security Management Appliance (SMA) devices allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCuh70263,… | |
| Modificada | Alta (7.8) | 1.9% | — | Mcafee Email AND WEB Security | 25/9/2012 | 16/6/2026 | Unspecified vulnerability in McAfee Email Anti-virus (formerly WebShield SMTP) allows remote attackers to cause a denial of service via unknown vectors. | |
| Modificada | Media (5) | 1.3% | — | Websense WEB FilterWebsense WEB Security | 26/8/2012 | 16/6/2026 | The Filtering Service in Websense Web Security and Web Filter before 6.3.1 Hotfix 106 and 7.x before 7.1 allow remote attackers to cause a denial of service (filtering outage) via a crafted URL. | |
| Modificada | Alta (7) | 0.30% | — | Drweb WEB Security Space | 25/8/2012 | 16/6/2026 | Race condition in Dr.Web Security Space Pro 6.0.0.03100 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler… | |
| Modificada | Media (4.3) | 1.3% | — | Websense WEB Security | 23/8/2012 | 16/6/2026 | The TRITON management console in Websense Web Security before 7.6 Hotfix 24 allows remote attackers to bypass authentication and read arbitrary reports via a crafted uid field, in conjunction with a crafted userRoles field, in a cookie, as demonstrated by a request to explorer_wse/favorites.exe. | |
| Modificada | Alta (7.5) | 3.5% | — | Websense WEB FilterWebsense WEB SecurityWebsense WEB Security GatewayWebsense WEB Security Gateway Anywhere | 23/8/2012 | 16/6/2026 | The Investigative Reports web interface in the TRITON management console in Websense Web Security 7.1 before Hotfix 109, 7.1.1 before Hotfix 06, 7.5 before Hotfix 78, 7.5.1 before Hotfix 12, 7.6 before Hotfix 24, and 7.6.2 before Hotfix 12; Web Filter; Web Security Gateway; and Web Security Gateway Anywhere allows… |