CVE-2017-12245
HighSummary
A vulnerability in SSL traffic decryption for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause depletion of system memory, leading to a denial of service (DoS) condition. The issue arises from an error in how the Firepower Detection Snort Engine handles SSL traffic decryption.
Risk Assessment
If the memory leak persists over time, a DoS condition could develop, resulting in the inability to forward traffic through the device. This could lead to significant disruptions in network operations.
Recommendation
It is recommended to update Cisco Firepower Threat Defense software to the latest version to mitigate this vulnerability and to monitor SSL traffic for potential attacks.
Related vulnerabilities
- CVE-2026-100382Critical
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection. This issue affects Mediawiki - ExternalData Extension: from * before 3.7.
- CVE-2026-97064Critical
X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the database seed. Unauthenticated attackers can authenticate as any user by submitting the public master code to the emailOrMobileLogin endpoint with a known email or mobile number.
- CVE-2026-97063Critical
X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them to account owners. Attackers can request codes using known mobile numbers or email addresses, read them from responses, and authenticate as victims via POST /sys/emailOrMobileLogin/login to hijack accounts.
- CVE-2026-84458Critical
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the "Automatic account link on initial logon" setting is enabled, Zammad binds an incoming third-party (SSO) identity to an existing local account by matching the email address the identity provider reports, without verifying that the provider actually confirmed ownership of that email. An attacker who controls any identity at a configured provider, including, by default, any Azure AD tenant via Zammad's multi-tenant Microsoft 365 /common app registration, can set that identity's email to a victim's address, authenticate, and be logged in as the victim. This bypasses the victim's local password entirely and affects any existing account, including agents and administrators. Zammad will honor the xms_edov ID token claim when email verification is required in the Microsoft 365 setting, treating a missing claim as unverified. This issue is fixed in version 7.1.2.
- CVE-2026-48482Critical
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifier that traverses outside the intended custom-asset directory. The imported file can be written to an executable server location, allowing a malicious script to be invoked remotely. This issue is fixed in version 11.0.8.
- CVE-2026-92161Critical
Before versions 1.7.4 and 2.0.0-beta.4, the Discord OAuth provider in FriendsOfFlarum does not check the 'verified' field for an OAuth email before passing it to Flarum core as trusted. This allows an unauthenticated attacker who knows a victim's email address to configure a Discord account with that unverified address and sign in as the victim without a password.
- CVE-2026-62262Critical
In Piwigo up to version 17.0.0beta1, when rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings[] value and open the returned search URL. The value is not validated and is used as the upper bound in an SQL query, allowing extraction of database information or time delays.
- CVE-2026-42322Critical
In Piwigo before version 16.4.0, admin/themes_standard_pages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension in the filename. An authenticated administrator can upload a file with a server-executable extension, leading to code execution when placed in the logo directory.
- CVE-2026-39353Critical
In InvoicePlane before version 1.7.2-rc-1, the permitted template list is built by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious PHP file placed in the directory is automatically trusted and can be selected as a public template, then executed when rendering a public invoice.
- CVE-2026-93647Critical
An unauthenticated calendar sender can place active markup in a COUNTER message's From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim.
Original NVD description (English source)
A vulnerability in SSL traffic decryption for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause depletion of system memory, aka a Firepower Detection Engine SSL Decryption Memory Consumption Denial of Service vulnerability. If this memory leak persists over time, a denial of service (DoS) condition could develop because traffic can cease to be forwarded through the device. The vulnerability is due to an error in how the Firepower Detection Snort Engine handles SSL traffic decryption and notifications to and from the Adaptive Security Appliance (ASA) handler. An attacker could exploit this vulnerability by sending a steady stream of malicious Secure Sockets Layer (SSL) traffic through the device. An exploit could allow the attacker to cause a DoS condition when the device runs low on system memory. This vulnerability affects Cisco Firepower Threat Defense (FTD) Software Releases 6.0.1 and later, running on any of the following Cisco p
Vulnerability data from NVD (NIST) · CISA KEV · EPSS