CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Cisco ASA and FTD Web Services Interface Memory Information Disclosure Vulnerability (CVE-2020-3259) Analysis & Mitigation Guide
[Affected Scope] Cisco ASA Software and Cisco FTD Software with AnyConnect VPN or WebVPN configurations enabled
[Impact] An unauthenticated, remote attacker can retrieve sensitive memory contents (such as user credentials and session tokens) by sending crafted HTTP GET requests
[Mitigation] Apply the official firmware patches provided by Cisco immediately, or restrict access to the web services interface if patching is delayed
Cisco ASA WebVPN Login Page Cross-Site Scripting (XSS) Vulnerability (CVE-2014-2120) Analysis and Mitigation Guide
[Affected Scope] Cisco Adaptive Security Appliance (ASA) Software with WebVPN (SSL VPN) feature enabled
[Impact] Remote attackers can execute arbitrary JavaScript or HTML code in the context of the user's browser session, leading to session hijacking or credential theft
[Mitigation] Apply official Cisco software updates, restrict WebVPN access via ACLs, and monitor HTTP request logs