Description
Cross-site scripting (XSS) vulnerability in Cisco AsyncOS on the Web Security Appliance (WSA) 9.0.0-193; Email Security Appliance (ESA) 8.5.6-113, 9.1.0-032, 9.1.1-000, and 9.6.0-000; and Content Security Management Appliance (SMA) 9.1.0-033 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug IDs CSCuu37430, CSCuu37420, CSCut71981, and CSCuv50167.
References (3)
Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1033086
Vendor Advisory vendor-advisory
x_refsource_cisco
http://tools.cisco.com/security/center/viewAlert.x?alertId=40172
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1033087
Scores
EPSS
0.0179
EPSS Percentile
76.0%
Details
CWE
CWE-79
Status
published
Products (6)
cisco/content_security_management_virtual_appliance
9.1.0-033
cisco/email_security_appliance_firmware
8.5.6-113
cisco/email_security_appliance_firmware
9.1.0-032
cisco/email_security_appliance_firmware
9.1.1-000
cisco/email_security_appliance_firmware
9.6.0-000
cisco/web_security_appliance
9.0.0-193
Published
Jul 29, 2015
Tracked Since
Feb 18, 2026