https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 14:13:02 +0000 https://cve.radiocsirt.org/vuln/bdu:2021-04151 bdu:2021-04151 https://cve.radiocsirt.org/vuln/bdu:2021-04151 https://cve.radiocsirt.org/vuln/cisco-sa-sni-data-exfil-mfgzxqln <p>A vulnerability in the web filtering features of multiple Cisco products could allow an unauthenticated, remote attacker to bypass web reputation filters and threat detection mechanisms on an affected device and exfiltrate data from a compromised host to a blocked external server. This vulnerability is due to inadequate inspection of the Server Name Identification (SNI) header in the SSL/TLS handshake. An attacker could exploit this vulnerability by using data from the TLS client hello packet to communicate with a blocked external server. A successful exploit could be used to exfiltrate data from a protected network. The attacker must compromise a host on the network to exfiltrate the sensitive data. The following Snort rule can be used to detect possible exploitation of this vulnerability: Snort SID 58062. There are no workarounds that address this vulnerability.</p> <p>A vulnerability in the web filtering features of multiple Cisco products could allow an unauthenticated, remote attacker to bypass web reputation filters and threat detection mechanisms on an affected device and exfiltrate data from a compromised host to a blocked external server. This vulnerability is due to inadequate inspection of the Server Name Identification (SNI) header in the SSL/TLS handshake. An attacker could exploit this vulnerability by using data from the TLS client hello packet to communicate with a blocked external server. A successful exploit could be used to exfiltrate data from a protected network. The attacker must compromise a host on the network to exfiltrate the sensitive data. The following Snort rule can be used to detect possible exploitation of this vulnerability: Snort SID 58062. There are no workarounds that address this vulnerability.</p> https://cve.radiocsirt.org/vuln/cisco-sa-sni-data-exfil-mfgzxqln https://cve.radiocsirt.org/vuln/euvd-2026-200185 EUVD-2026-200185 https://cve.radiocsirt.org/vuln/euvd-2026-200185 https://cve.radiocsirt.org/vuln/fkie_cve-2021-34749 <p>A vulnerability in Server Name Identification (SNI) request filtering of Cisco Web Security Appliance (WSA), Cisco Firepower Threat Defense (FTD), and the Snort detection engine could allow an unauthenticated, remote attacker to bypass filtering technology on an affected device and exfiltrate data from a compromised host. This vulnerability is due to inadequate filtering of the SSL handshake. An attacker could exploit this vulnerability by using data from the SSL client hello packet to communicate with an external server. A successful exploit could allow the attacker to execute a command-and-control attack on a compromised host and perform additional data exfiltration attacks.</p> <p>A vulnerability in Server Name Identification (SNI) request filtering of Cisco Web Security Appliance (WSA), Cisco Firepower Threat Defense (FTD), and the Snort detection engine could allow an unauthenticated, remote attacker to bypass filtering technology on an affected device and exfiltrate data from a compromised host. This vulnerability is due to inadequate filtering of the SSL handshake. An attacker could exploit this vulnerability by using data from the SSL client hello packet to communicate with an external server. A successful exploit could allow the attacker to execute a command-and-control attack on a compromised host and perform additional data exfiltration attacks.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-34749 https://cve.radiocsirt.org/vuln/ghsa-x64m-mg53-f49j <p>A vulnerability in Server Name Identification (SNI) request filtering of Cisco Web Security Appliance (WSA), Cisco Firepower Threat Defense (FTD), and the Snort detection engine could allow an unauthenticated, remote attacker to bypass filtering technology on an affected device and exfiltrate data from a compromised host. This vulnerability is due to inadequate filtering of the SSL handshake. An attacker could exploit this vulnerability by using data from the SSL client hello packet to communicate with an external server. A successful exploit could allow the attacker to execute a command-and-control attack on a compromised host and perform additional data exfiltration attacks.</p> <p>A vulnerability in Server Name Identification (SNI) request filtering of Cisco Web Security Appliance (WSA), Cisco Firepower Threat Defense (FTD), and the Snort detection engine could allow an unauthenticated, remote attacker to bypass filtering technology on an affected device and exfiltrate data from a compromised host. This vulnerability is due to inadequate filtering of the SSL handshake. An attacker could exploit this vulnerability by using data from the SSL client hello packet to communicate with an external server. A successful exploit could allow the attacker to execute a command-and-control attack on a compromised host and perform additional data exfiltration attacks.</p> https://cve.radiocsirt.org/vuln/ghsa-x64m-mg53-f49j https://cve.radiocsirt.org/vuln/gsd-2021-34749 gsd-2021-34749 https://cve.radiocsirt.org/vuln/gsd-2021-34749 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-34749 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: snort, Ubuntu:16.04:LTS: snort, Ubuntu:18.04:LTS: snort, Ubuntu:20.04:LTS: snort, Ubuntu:22.04:LTS: snort</p> <p>A vulnerability in Server Name Identification (SNI) request filtering of Cisco Web Security Appliance (WSA), Cisco Firepower Threat Defense (FTD), and the Snort detection engine could allow an unauthenticated, remote attacker to bypass filtering technology on an affected device and exfiltrate data from a compromised host. This vulnerability is due to inadequate filtering of the SSL handshake. An attacker could exploit this vulnerability by using data from the SSL client hello packet to communicate with an external server. A successful exploit could allow the attacker to execute a command-and-control attack on a compromised host and perform additional data exfiltration attacks.</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: snort, Ubuntu:16.04:LTS: snort, Ubuntu:18.04:LTS: snort, Ubuntu:20.04:LTS: snort, Ubuntu:22.04:LTS: snort</p> <p>A vulnerability in Server Name Identification (SNI) request filtering of Cisco Web Security Appliance (WSA), Cisco Firepower Threat Defense (FTD), and the Snort detection engine could allow an unauthenticated, remote attacker to bypass filtering technology on an affected device and exfiltrate data from a compromised host. This vulnerability is due to inadequate filtering of the SSL handshake. An attacker could exploit this vulnerability by using data from the SSL client hello packet to communicate with an external server. A successful exploit could allow the attacker to execute a command-and-control attack on a compromised host and perform additional data exfiltration attacks.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-34749 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0336 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in mehreren Cisco Produkten und Snort ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in mehreren Cisco Produkten und Snort ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0336