Published: 06/10/2016 Updated: 28/11/2016

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 6.1 | Impact Score: 2.7 | Exploitability Score: 2.8

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Cross-site scripting (XSS) vulnerability in HostScan Engine 3.0.08062 up to and including 3.1.14018 in the Cisco Host Scan package, as used in ASA Web VPN, allows remote malicious users to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuz14682.

Vulnerable Product	Search on Vulmon	Subscribe to Product
cisco hostscan engine 3.1.05152
cisco hostscan engine 3.1.14018
cisco hostscan engine 3.1.03104
cisco hostscan engine 3.1.02026
cisco hostscan engine 3.1.05182
cisco hostscan engine 3.1.04075
cisco hostscan engine 3.1.04082
cisco hostscan engine 3.1.06073
cisco hostscan engine 3.1.03103
cisco hostscan engine 3.0.08062
cisco hostscan engine 3.1.05183
cisco hostscan engine 3.1.05178
cisco hostscan engine 3.1.02043
cisco hostscan engine 3.0.08066
cisco hostscan engine 3.1.05163
cisco hostscan engine 3.1.01065
cisco hostscan engine 3.1.04060
cisco hostscan engine 3.1.02016
cisco hostscan engine 3.1.04063
cisco hostscan engine 3.1.05170
cisco hostscan engine 3.1.02040
cisco hostscan engine 3.1.05160

A vulnerability in the Cisco Host Scan package could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of a Cisco Adaptive Security Appliance (ASA) Web VPN deployment The vulnerability is due to insufficient input validation of a user-supplied value An attacker could exploit this vulnerabilit ...

CWE-79 http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-chs http://www.securityfocus.com/bid/93407 https://nvd.nist.gov http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-chs

CVE-2016-6436

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect