CVE-2016-6436

MEDIUM

Cisco HostScan Engine 3.0.08062-3.1.14018 - Cross-Site Scripting via Crafted URL

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in HostScan Engine 3.0.08062 through 3.1.14018 in the Cisco Host Scan package, as used in ASA Web VPN, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuz14682.

References (2)

Core 2

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/93407

Vendor Advisory vendor-advisory x_refsource_cisco

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-chs

Scores

CVSS v3 6.1

EPSS 0.0076

EPSS Percentile 51.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (22)

cisco/hostscan_engine 3.0.08062

cisco/hostscan_engine 3.0.08066

cisco/hostscan_engine 3.1.01065

cisco/hostscan_engine 3.1.02016

cisco/hostscan_engine 3.1.02026

cisco/hostscan_engine 3.1.02040

cisco/hostscan_engine 3.1.02043

cisco/hostscan_engine 3.1.03103

cisco/hostscan_engine 3.1.03104

cisco/hostscan_engine 3.1.04060

... and 12 more

Published Oct 06, 2016

Tracked Since Feb 18, 2026